What is SearchMarquis?
SearchMarquis is a type of adware that causes redirecting within the web browser on your Mac. Often times the redirecting displays or downloads advertising material (often unwanted) when a user is online. It's typically found within your web browser and it might be unknowingly bundled with other free software you download off the Internet. It may also mask itself as other, more well know software, like Adobe Flash Player. Once installed, it can modify the default homepage and search engine, and display ads or pop-ups on pages where they may have never appeared before, or even show a message that your browser is being managed by your organization, when it is not the case.
Users should be very cautious about the applications they agree to install and should never download files or software from untrusted sources.
Removing SearchMarquis From Your Mac
It can be difficult to get rid of adware, so we've created this article to assist you. It's important to follow all of the instructions outlined below. If you have any questions or concerns about completing these steps as listed, we recommend Contacting Intego Support for further assistance.
To completely remove SearchMarquis from your Mac, follow these steps in order:
Scan Your Mac with VirusBarrier
Remove Malicious Applications
Remove LaunchAgents and LaunchDaemons
Uninstall Adware Extensions
Update Your Default Search Engine and Reset Web Browsers
Remove Login Items and Network Proxies
Remove Unwanted Device Profiles
Scan Your Mac With VirusBarrier to Remove Adware and Pop-Ups
The best course of action if your Mac is infected with adware is to scan it with an antivirus solution to delete all malicious files from your device. Intego's award-winning VirusBarrier software is the best solution available to protect your Mac from malware, viruses, ransomware and adware. You can download and install VirusBarrier X9 as part of our Internet Security bundle from the link below:
Download Mac Internet Security X9, Including VirusBarrier
After the download is complete, double-click the installer file which should appear in your Downloads folder by default.
(Note: It may be in another location if you have modified your browser settings)
Follow the on-screen instructions to properly install the software:
Once installation is complete, open VirusBarrier from the top-right corner of the menu bar using the Intego castle icon:
Now, run a Full Scan:
VirusBarrier will automatically detect any adware or potentially unwanted programs (PUP) on your Mac. Once the scan is complete, use the options provided in the window to Quarantine, Repair, or Delete the infected files.
Remove Malicious Software
After scanning your Mac with VirusBarrier, you'll want to check for any remnants of the malicious applications which may be left behind.
Open a Finder window and navigate to Applications:
Find and Remove Adware or Malicious Software
Look through the list of Applications to locate the software to delete. Once you have found the adware, right-click and select 'Move To Trash'.
A few examples of adware you might find include Mac Cleanup Pro, Dock2Master, WeKnow, Shlayer, Spigot, SurfBuyer, MacSaver, ShopperHelper and CrossRider. (Note: This is not a complete list of all known adware, and the names of these malicious programs change constantly. The name of the application you need to remove on your Mac may differ from this list.)
Empty the Trash from your Dock to completely remove the application from your Mac, then restart your computer to complete the process.
Remove Unwanted LaunchAgents and LaunchDaemons
What Are LaunchAgents & LaunchDaemons?
A daemon is a program running in the background without requiring user input. A typical daemon might perform daily maintenance tasks or scan a device for malware. The main difference between the two is that an agent is run on behalf of the logged-in user, while a daemon runs on behalf of the root user or any user specified.
You will find LaunchAgents and LaunchDaemons installed on your Mac in the following locations:
- /Library/LaunchAgents
- /Library/LaunchDaemons
- /System/Library/LaunchAgents
- /System/Library/LaunchDaemons
- ~/Library/LaunchAgents (inside the home folder)
- ~/Library/Application Support (inside the home folder)
You should remove any unwanted files you may find in these locations. Open a Finder window and select: Go > Go to Folder.. :
Now, enter one of the file paths listed above. It will look like this:
Next, delete any files you see here for adware or unwanted applications.
If you do not immediately see files listed within these locations, it is possible that they may be hidden. macOS hides certain files and locations by default so that they are intentionally more difficult to be found and modified. You can show hidden files by clicking within the Finder window and pressing Command + Shift + . (period). The files will appear differently from the files that are not hidden. Hidden files appear translucent in color. You can see an example of how hidden files appear below:
With great power comes great responsibility! Always be mindful of the files you are removing, since deleting anything by mistake may prevent software from working as expected.
Uninstall Adware Extensions From Your Web Browsers
In addition to scanning your Mac with VirusBarrier, you'll also want to check all of the web browsers you use to see if there are any extensions installed for adware. There are plenty of browsers available for macOS, but we're going to cover the three most popular choices in this article: Safari, Chrome and Firefox.
Delete Unwanted Extensions
Some adware will also install extensions in your web browser which allow them to display ads and pop-ups for potentially unwanted programs and services. You'll want to remove these from your web browser if they exist by using the Uninstall or Remove command.
Safari
Location: Safari > Preferences > Extensions
Chrome
Location: Chrome > Settings > Extensions
Firefox
Location: Firefox > Settings > Extensions & Themes
Update the Homepage
Check the homepage in all of your web browsers and make sure it is set correctly. If you do not recognize the homepage listed, change it to something else.
Safari
Chrome
Firefox
Update Your Default Search Engine and Reset Web Browsers
It is common for redirecting adware to alter your browser settings. It is always a good idea to update your default search engine to your preferred engine and reset your web browsers. This will restore your settings back to that defaults and remove any configuration put in place by SearchMarquis. You can view how to change your default search engine and links to our browser reset articles below.
Safari
Click Here to See How to Reset Your Safari Browser
After opening Safari's Preferences menu, navigate to the Search tab. From here, select your preferred default search engine from the drop down menu.
Chrome
Click Here to See How to Reset Your Google Chrome Browser
Once you have opened Chrome's Settings, click on Search Engine in the left side menu and then select your default search engine within the center area of the window.
Firefox
Click Here to See How to Reset Firefox
Inside of the Settings menu, click on the Search option in the left side menu. From here, navigate to the Default Search Engine area and select the search engine of your choice.
Remove Login Items and Network Proxies
Login Items are applications that begin running when you start up or log into your Mac. It is possible that malware can add unwanted applications to your Login Items list. You can check for and remove these by opening System Preferences on your Mac and clicking on the Users and Groups icon, as seen in the image below.
From here, you will want to click on the gold lock in the lower left corner, and enter your Mac's login password to open the lock, so that you can make necessary changes in the window. Then click on the Login Items tab in the top center area of the window. This will display your Login Items. You will be able to click on to select any items you wish to remove from the list and then click on the - button to remove them completely.
Network Proxies act as intermediaries between a single computer user and the internet so that the network can ensure security, administrative control, and caching service. But they can also be used by malware to manipulate network settings on your Mac. You will want to check for these proxies and remove them.
First, open System Preferences and click on the Network icon.
Then within the Network window, click on the Advanced button in the lower right corner to open up to the Advanced Network Options.
In the new window that appears, click on the Proxies tab and then make sure that there are no options checked within the list. The most common proxy you will see checked/used by malware is the SOCKS Proxy. If you do not recognize any proxy listed as legitimate you will want your window to appear like the one in the image below.
Remove Unwanted Device Profiles
It's very rare that software should ever need to install a profile on your device for it to work properly. This is used mostly by business software to manage a large number of Macs. In fact, most users should not even see the 'Profiles' option listed in System Preferences (by default, it is hidden if no Profiles are installed).
Open System Preferences and select Profiles in the final row. (Note: If you do not see 'Profiles' listed on your Mac, it means you do not have any installed and you do not need to take action)
Check the Device Profiles carefully, and remove any suspicious or unwanted profiles you see in the list. Simply highlight them in the left column and click the minus '-' key in the bottom left corner.
Following all of these steps should help keep your Mac adware-free!
Contact Intego Support
If you still have questions about adware or malware on your Mac and cannot find the answer in this article or our Knowledge Base, please contact our Support Team directly for assistance by completing a support ticket online here:
Comments