How to get rid of Search Marquis from Mac [Chrome, Firefox, Safari]

What is Search Marquis?

The cyber threat analysts have determined that Search Marquis is a potentially unwanted application (PUA) that belongs to the group of browser hijackers. Browser hijacker is a kind of software that is developed to change the internet browser settings without the knowledge or permission of the computer user, and it usually redirects the affected system’s browser to some advertisement-related webpages. A browser hijacker redirects user web searches to its own web-page, generates multiple pop-up ads, changes the default web browser search engine or start page, initiates numerous pop ups and installs multiple toolbars on the internet browser. If your web browser is affected by a browser hijacker you may need to follow manual steps or use a malware removal tool to revert changes made to your internet browsers.

Typically, browser hijackers and PUAs promote fake search engines by setting their address as the homepage or search engine of the affected browser. In this case, the Search Marquis browser hijacker changes the browser settings to searchmarquis[.]com. That is, in other words, this browser hijacker is created for the sole purpose of forcing the user to visit the searchmarquis[.]com when the user opens the homepage or uses the search provider. Therefore, the only way to get rid of a browser redirect to this unwanted website is to completely remove the browser hijacker associated with it. The reason for this is that potentially unwanted apps and browser hijackers often block the ability to change browser settings, thus preventing the user from restoring the home page and search provider. For example, in this case, to delete searchmarquis[.]com from the address of the homepage and search provider, the user needs to uninstall the Search Marquis browser hijacker.

As well as unwanted browser redirects to searchmarquis[.]com, Search Marquis can collect your World Wide Web browsing activity by recording URLs visited, IP addresses, internet browser version and type, cookie information, Internet Service Provider (ISP) and web-pages visited. Such kind of behavior can lead to serious security problems or user data theft.

How can Search Marquis get on your MAC OS

Many browser hijackers like Search Marquis come from browser toolbars, browser extensions, BHOs (browser helper objects) and additional applications. Most often, these items claim itself as apps that improve your experience on the Internet by providing a fast and interactive startpage or a search engine that does not track you. Remember, how to avoid the unwanted programs. Be cautious, start only reputable applications which download from reputable sources. NEVER install an unknown and suspicious application.

Threat Summary

Name	Search Marquis
Type	search engine hijacker, browser hijacker, PUP, startpage hijacker, redirect virus
Affected Browser Settings	start page, new tab URL, search provider
Distribution	fake update tools, freeware installation packages, misleading pop up advertisements, fake Java updates
Symptoms	Unwanted advertisements appear on web pages that you are visiting. Your browser is re-directed to web-sites you did not want. New entries appear in your Applications folder. An unexpected web-browser addon appears in your web browser. Your internet browser home page has modified and you are unable to change it back.
Removal	Search Marquis removal guide

 

How to remove Search Marquis hijacker (removal guide)

To get rid of Search Marquis from your web-browser, you must uninstall all suspicious apps and remove every component that could be related to the browser hijacker. Besides, to fix your web browser search engine by default, startpage and new tab page, you should reset the affected internet browsers. As soon as you are complete with Search Marquis removal process, we advise you scan your Mac with malicious software removal utilities listed below. It’ll complete the removal procedure on your computer.

To remove Search Marquis, execute the steps below:

1. Remove profiles created by Search Marquis
2. Check the list of installed applications
3. Remove Search Marquis related files and folders
4. Scan your Mac with MalwareBytes
5. Remove Search Marquis from Safari, Chrome, Firefox
6. How to stop Search Marquis redirects
7. Finish words

Remove profiles created by Search Marquis

Search Marquis can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the browser hijacker.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to Search Marquis.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac device, which is normal.

Check the list of installed applications

One of the first things to attempt for removal of hijacker is to check your Mac computer installed programs screen and look for unwanted and questionable applications. If there are any programs you do not recognize or are no longer using, you should uninstall them. If that doesn’t work, then you may need to run malware removal tool such as MalwareBytes Free.

Open Finder and click “Applications”.

It will display a list of all software installed on your Apple Mac. Scroll through the all list, and remove any dubious and unknown apps. Right click to suspicious program and select “Move to Trash”. Another solution is drag the program from the Applications folder to the Trash.

Most important, scroll through the all list, and move to trash any unknown applications. Don’t forget, choose Finder -> Empty Trash.

Remove Search Marquis related files and folders

Now you need to try to find Search Marquis related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Search Marquis creates several files, these files must be found and removed. Below is a list of files associated with this unwanted program.

• /Library/LaunchDaemons/com.SearchMarquis.system.plist
• ~/Library/LaunchAgents/com.SearchMarquis.service.plist
• /Library/Application Support/.(RANDOM)/System/com.SearchMarquis.system
• ~/Library/Application Support/.(RANDOM)/Services/com.SearchMarquis.service.app

Some files created by Search Marquis are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for Search Marquis generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.SearchMarquis.service.plist, macsearch.plist, search.plist, com.machelper.plist, installapp.plist, com.net-preferences.plist and com.google.defaultsearch.plist, . Most often, potentially unwanted programs, browser hijackers and adware software create several files with similar names.

Check for Search Marquis generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.SearchMarquis.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for Search Marquis generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for Search Marquis generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.installapp.system.plist, com.SearchMarquis.system.plist, com.search.system.plist, com.macsearch.system.plist and com.machelper.system.plist. In most cases, adware, PUPs and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

We suggest using MalwareBytes Anti-Malware (MBAM). You can download and install MalwareBytes Anti Malware to look for and remove Search Marquis related apps from your Mac. When installed and updated, the malware remover automatically identifies and deletes all security threats exist on the MAC.

Click the following link to download the latest version of MalwareBytes Anti-Malware (MBAM) for Mac OS.

When downloading is finished, close all software and windows on your MAC. Run the saved file. Follow the prompts.

The MalwareBytes Anti Malware (MBAM) will automatically start and you can see its main screen as on the image below.

Now click the “Scan” button . MalwareBytes Anti Malware will scan through the whole MAC OS for the Search Marquis hijacker. This task can take quite a while, so please be patient. During the scan MalwareBytes Free will scan for threats exist on your computer.

When that process is done, MalwareBytes Free will display a list of detected items. In order to remove all threats, simply click the “Quarantine” button. The MalwareBytes will begin to remove the Search Marquis browser hijacker.

Remove Search Marquis from Safari, Chrome, Firefox

If you are still getting Search Marquis browser redirects, then you can try to delete it by uninstalling harmful extensions.

Google Chrome	Mozilla Firefox
In the top right corner, click on Chrome’s main menu button, represented by three vertical dots. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to get rid of Search Marquis hijacker by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with Search Marquis browser hijacker removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stop Search Marquis redirects

It’s also critical to protect your browsers from harmful web pages and advertisements by using an ad-blocking application such as AdGuard. Security experts says that it’ll greatly reduce the risk of malicious software, and potentially save lots of money. Additionally, the AdGuard can also protect your privacy by blocking almost all trackers.

1. Installing the AdGuard is simple. First you’ll need to download AdGuard from the link below.
   
   

   AdGuard for Mac download
   3686 downloads
   Author: © Adguard
   Category: Security tools
   Update: January 17, 2018
   
2. After the download is done, run the downloaded file. You will see the “Setup Wizard” program window. Follow the prompts.
3. When the installation is done, press “Skip” to close the installation application and use the default settings, or click “Get Started” to see an quick tutorial which will help you get to know AdGuard better.
4. In most cases, the default settings are enough and you don’t need to change anything. Each time, when you start your MAC OS, AdGuard will run automatically and stop intrusive advertisements, block Search Marquis redirects, as well as other harmful or misleading web sites.

To sum up

Now your Apple Mac should be clean of the Search Marquis browser hijacker. We suggest that you keep AdGuard (to help you stop unwanted ads and unwanted harmful web pages) and MalwareBytes AntiMalware (to periodically scan your MAC for new malicious software, browser hijackers and adware). Make sure that you have all the Critical Updates recommended for Mac OS. Without regular updates you WILL NOT be protected when new hijackers, malicious apps and adware software are released.

If you are still having problems while trying to remove Search Marquis from your web browser, then ask for help here.