How to get rid of Search Marquis Mac

Search Marquis

Search Marquis is a rogue search engine that hijacks the homepage of Mac browsers, changing it to searchmarquis.com. Search Marquis enters the system via app-bundles and seeks to promote certain websites and ads through aggressive automatic page-redirects that it causes in the hijacked browsers.

Many users refer to this hijacker as a virus, but that’s not technically correct because, although Search Marquis could indeed make unwanted changes in the browser and control its behavior without your permission, it is not capable of harming your Mac or spreading to other parts of the system. That said, you are still strongly advised to delete this hijacker alongside the app that brought it to your Mac and also revokes any changes that it may have made in your Safari, Chrome, Firefox, or another browser.

What Is Search Marquis?

As we already mentioned, the moment this browser hijacker gets installed on the computer, it automatically changes the homepage of your main browser to the searchmarquis.com address. At first glance, this may look like a regular search engine but in reality, Search Marquis cannot perform any online searches.

What is Search Marquis

Many users ask “what is Search Marquis?”, once they are infected with it.

Instead, if you use it to search for something on the Internet, when you select the Search button you will be taken to a Bing search results page. Getting rerouted to Bing is obviously not a problem because the latter is a legitimate search engine, but this could be a bit irritating if you prefer to use, say, Google or Yahoo as your default search engine option. The real problem here, however, is what happens between the moment you start the search and the moment you land on the Bing page. Though it may seem like you get redirected to Bing instantly, this is not quite true. Before it gets to Bing, your browser would actually rapidly get rerouted through a series of other websites that it would only visit for a split second, so you may not even notice this. In reality, this is the main goal of the hijacker – to take your browser through those other sites, thus artificially gaining them more views and boosting their ratings. This might seem harmless, but you should know that some of those intermediate sites could be hazardous and unsafe. They might gather data from your browser or even target you with malware despite the fact that your browser is only visiting them for a fraction of a second. Therefore, the presence of Search Marquis on your browser is not to be underestimated – even though the hijacker itself is not capable of causing damage to your Mac, the threats it may potentially expose you to (threats such as Trojans, Rootkits, Ransomware, and Spyware) can be quite harmful to your computer and virtual privacy.

Other problems with Search Marquis

This aggressive hijacker may also cause additional issues that make it even more unwelcome. It may spam the screen with adverts and banners, some of which may be disguised as warning messages from your system claiming that you need to download and install some (fake) security app that would make the (non-existent) problem go away. Also, the hijacker could install helper elements in the system and the browser (such as rogue browser extensions) to gain more control and persistence and thus become more difficult to uninstall. Last but not least, you must also not forget that most hijackers tend to gather info from the browser and then sell it to third parties who may use it in potentially harmful ways without your knowledge.

With all that said, it should be apparent that the only viable action for those of you who have Search Marquis in their computers is to uninstall the unpleasant hijacker, which is what we are going to show you how to do in the following removal guide.

SUMMARY:

Name Search Marquis
Type Browser Hijacker
Danger Level Medium (nowhere near threats like Ransomware, but still a security risk)
Symptoms A change in the browser’s homepage or the main search engine is a typical symptom of a Browser Hijacker.
Distribution Method Software bundles, torrents, ads, freeware sites, shareware platforms, automatic installers.
Detection Tool

How to Get Rid of Search Marquis

To get rid of Search Marquis you should start with quitting its process and deleting the app that caused it to get installed on your Mac.

  1. Go to Finder, open Applications > Utilities, then start the Activity Monitor, and find and Quit the hijacker process(es).
  2. Next, to get rid of Search Marquis, go back to Applications and there try to find and uninstall the rogue app that got this hijacker in your system.
  3. Click on the Apple logo menu, go to System Preferences > Users & Groups > Login Items, and there remove any suspicious items you are not familiar with.
  4. Lastly, from System Preferences, go to Profiles and delete all Mac accounts that you don’t recognize.

Those short four steps are a quick way of getting rid of the hijacker that would hopefully work for most of our readers. If, however, you need more detailed instructions and/or if completing those steps didn’t rid you of Search Marquis, below we have prepared a more in-depth explanation of how to uninstall this unwanted hijacker where we’ve included some extra steps to ensure that nothing from it would remain in the system.

Detailed how-to get rid of Search Marquis Instructions

  1. From the menu bar at the top of your screen, select the Finder button and then click on the Applications icon that’s in the left sidebar.
  2. From the Applications folder, go to Utilities, and there open the Activity Monitor app.
  3. Look through the listed processes and try to find the one that has been launched by Search Marquis. The process will likely not have the same name as the hijacker so use your own discretion to figure out which one it is. Here are some tips on what you need to be looking for:
    • Processes with odd names that seem out of place or are unfamiliar to you.
    • Processes that are using up large chunks of your system resources (RAM, CPU, battery life) without being related to any program that’s currently running on your Mac or any important system function.
    • Processes that appear only when the browser is running yet have different names from the other browser processes.
  4. If you have a high level of certainty that a given process could be linked to the hijacker, select its entry in the Activity Monitor and then click on the button in the upper-left corner to quit the process.
    • If you are unsure about whether you must quit the process that you suspect, try to find more information about it on the Internet by searching for its name – in most cases, if it is an unwanted process, that should show up in the search results.
      Activity Monitor Mac
  5. After you stop the suspected process, return to the Applications folder and there try to find an app with which you think the hijacker may have been bundled – app-bundling is one of the most common distribution methods for hijackers like Search Marquis so this is likely how it got on in your system too.
    • Note that apps that have been downloaded from third-party sources (rather than from the official Apple App Store) are more likely to carry hijackers that have been bundled with them due to lower security standards in most third-party app download platforms.
  6. If you think you’ve figured out which app must be removed, drag it to the Trash icon on your Desktop and then empty the Trash.
  7. Next, select the Apple menu from the top-left of your screen and go to System Preferences.
  8. Select the Users & Groups settings and then go to Login Items.
  9. There you will see the different apps that are automatically launched when your Mac starts – if any of them seem sketchy or you think could be linked to Search Marquis, remove them from the list by clicking on them and selecting the minus button below the list.
    Maclogin Items
  10. Again from System Preferences, select Profiles and remove any profiles from the list that haven’t been created by you or by other admins of the computer.
    • Note that even if the profiles seem to have legitimate names such as “Safari settings” or “Chrome settings“, they should still be removed unless you or another admin has purposefully created them.

Search Marquis Removal from Mac

To complete the Search Marquis Removal from Mac, you should also delete any files created in the system by this hijacker.

  1. Open the /Library/LaunchAgents folder, look through the most recent files, and if you find any suspicious ones delete them.
  2. Delete recently added suspicious looking files from the ~/Library/LaunchAgents, and /Library/LaunchDaemons folders as well.
  3. Finally, for the Search Marquis Removal from your Mac to be completed, go to ~/Library/Application Support, and there look for folders (not separate files) that seem linked to the hijacker and delete them.

Below, we will provide you with more details on how to find and delete the Search Marquis files from those folders.

Detailed Search Marquis Removal Instructions

  1. Press the Command + Sift + G key combination from your keyboard and when the Go window appears copy-past in it the following folder location: /Library/LaunchAgents.
  2. Click on Go to open that folder and in it look at all files created around and after the moment Search Marquis got installed on your Mac. If any of those files look questionable, scan them with the free malware scanner posted below, and if they are flagged as potential threats delete them by sending them to the Trash.
    Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is free and will always remain free for our website's users.
    This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
    Drag and Drop File Here To Scan
    Drag and Drop File Here To Scan
    Loading
    Analyzing 0 s
    Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
      This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.
    • If you see any of the following files in that folder, delete them without the need for scanning them as they are confirmed to be Search Marquis files:
      • com.msp.agent.plist
      • com.updater.mcy.plist
      • com.pcv.hlpramc.plist
      • com.avickUpd.plist
    • Next, Go to the ~/Library/LaunchAgents and /Library/LaunchDaemons, look for recently added suspicious files in them too, scan what you find, and delete the ones that the scanner flags as malware/unwanted software.
      • If in the ~/Library/LaunchAgents folder you notice any of the confirmed Search Marquis files we listed above for the /Library/LaunchAgents folder (without the “~” sign), delete them right away as there’s no need to scan them.
      • The confirmed Search Marquis files you may find in the /Library/LaunchDaemons and which you should delete are:
        • pplauncher.plist
        • com.startup.plist
        • com.ExpertModuleSearchDaemon.plist
    • Lastly, visit the ~/Library/Application Support folder and in it look for subfolders that are likely to have been created by the hijacker. The following are examples of confirmed Search Marquis folders that you must delete if you see them there:
      • ValidGeneration
      • BoostCoordinator
      • OperativeState
      • InitialWindow
      • AdjustableProduct

    How to Remove Search Marquis from Mac

    To remove Search Marquis from Mac, you must make sure that the hijacker is uninstalled from any other browsers in your system, such as Google Chrome.

    1. Open Chrome, type the following in its URL bar, and press Enter: chrome://settings.
    2. Select the Extensions settings and if you see any add-ons potentially related to the hijacker uninstall them.
    3. If you first need to check if an add-on is unwanted, disable it and if the hijacker symptoms stop, then that add-on needs to be deleted.
    4. Go to chrome://settings again and click on Search Engine from the left and then on Manage Search Engines.
    5. Block any unknown search engines listed on that page to remove Search Marquis from Mac and from your Chrome browser.

    Detailed how-to remove Search Marquis from Mac Instructions

    1. When you open Google Chrome, click on the browser menu icon in the top-right (three dots) and click on More Tools.
    2. From the More Tools submenu, go to Extensions and on the Extensions page try to find any extensions that haven’t been installed by you and delete them.
    3. Also, delete extensions that you don’t use and ones that you think might be causing problems.
    4. If an extension doesn’t get deleted even after you select the Remove button, click on the Disable button first (the small toggle button below the extension), and then click on Remove again.
      Chrome Extensions2
    5. Open the browser menu again, this time click on Settings, and from the Settings page select Search Engine (the sidebar to the left).
    6. Expand the Manage Search Engines settings from the middle and then find and remove from the browser all search engines listed there that you are not familiar with and that you don’t think you can trust.
    7. To remove a search engine, simply click on the small three-dot icon next to it and then click on the Remove from list button to stop Chrome from using this search engine in the future.
      Chrome Extensions
    8. Next, from the sidebar of the Settings page, select the Privacy and Security options and then click on the Clear Browsing Data button.
    9. Check the different boxes leaving only the one for the Passwords and other sign-in data unchecked, select the All time range, and click on Clear Data to carry out the action.
      Chrome Clear Data
    10. Lastly, open the Appearance settings from the sidebar of the Settings page and see what the browser’s new-tab page address is – if it is searchmarquis.com or anything similar that looks like it has been added by the hijacker, replaced it with the URL of a reputable and safe website that will be the new homepage of your browser (or simply type the address of your old homepage).

    How to Remove Search Marquis from Safari

    To remove Search Marquis from Safari, one must uninstall all undesirable extensions that may have been added to it by the hijacker and then reset the browser settings.

    1. When you start the browser, click on the Safari menu, go to Preferences > Extensions, and uninstall any suspicious extensions that you haven’t added yourself.
    2. Next, go to Preferences from the browser menu, select General, and restore the browser homepage if it has been changed by the hijacker.
    3. To remove Search Marquis from Safari, next, select the Privacy tab, click on Remove All Website Data, and then on Remove Now.
    4. Finally, go to the History Menu > Clear History, set the command to the All History setting, and click on Clear History again.

    Detailed how-to remove Search Marquis from Safari Instructions

    1. When you start the Safari browser, click on the Safari button from the top-left and then go to Preferences.
      Preferences in Safari
    2. From there, select Extensions and explore the items shown on that page – any extension that you don’t remember adding to the browser, that you don’t normally use, or that seems otherwise unwanted should be removed.
      extensions in safari
    3. Next, open the General tab from the Preferences bar, check the current address of the homepage and if it is searchmarquis.com or anything else that makes you think that address has been enforced by the hijacker, delete the URL and type in its place the address of a safe and legitimate website.
      General Tab in Safari
    4. Visit the Privacy tab and use the Remove All Website Data option to clear file caches and site cookies that may hold information related to Search Marquis.
      Privacy in Safari
    5. Delete the browser history by selecting the History menu, clicking on the Clear History button, and confirming the action in the next window. For a history deletion setting, we suggest that you use the All History one.
    blank

    About the author

    blank

    Lidia Howler

    Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

    6 Comments

      • Hi Cal Benton,
        yes we recommend ComboCleaner and its a trusted program. You can download it and use its trial version to remove the malware from your Mac.

    • Hey Brandon, I followed this article (remove search marquis virus mac) up until the point when it told me to go to the action monitor and take a sample of any “suspicious processes.” I am able to take the samples, but I don’t know what to do with them. How do I analyze these samples to know whether or not I should delete them?

      The search marquis has gotten quite out of hand at this point. I am automatically redirected to it every time I open a new tab, or even if I click the back button to return to my google search results. I have removed it from all settings that I can find, yet still the problem persists. Thanks for your help.

      • Hi Dan, I believe you sample any of the suspicious processes so you can find the paths to the files related to these processes, you can use the online virus scanner on the page to confirm or deny your suspicions.

    • Hi Petkov, where is this online virus scanner , please? If it is combocleaner, this function is no longer free and I am unaware of it it’ll remove completely if I pay.
      Thanks

    Leave a Comment