Removing "Search Marquis" / "Search Baron" / etc on your own
What happened
All of a sudden Safari began redirecting all your search queries or clickable links to results you did not expect, rudely ignoring your desired Search engine preferences. Those search results or web pages may show "Search Baron" or "Search Marquis" or "Search Now" or Bing or Yahoo or any number of other possibilities... none of which are what you want.
Why it happened
Read How to install adware - Apple Community for a somewhat outdated but still relevant example of this common scourge, which can plague any Mac or PC. Recognition and avoidance of these revenue-grabbing scams is the only effective defense against being deceived into installing them.
What you need to do
Fortunately fixing it is easy and you don't need to install anything.
First, you need to ascertain the cause so that you can eliminate it. Start by inspecting the contents of the following folder:
~/Library/LaunchAgents
To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field:
Make it look like this:
... and click the Go button. A Finder window will open.
- Make sure all that folder's file names are readable by selecting View > as List or other selection that shows that folder's complete contents, including complete file names.
Then, take a screenshot of that Finder window: Take a screenshot on your Mac - Apple Support.
- To learn how to capture a screenshot please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question. It also includes instructions for posting a screenshot in a reply to this Discussion, so keep that Safari window open for now.
- It is not necessary to capture anything other than what is displayed in that Finder window. How to capture a window or menu in Take a screenshot on your Mac describes how to capture only what needs to be shown.
Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.
In the same manner as the above, navigate to this next folder:
/Library/LaunchDaemons
The Finder's Go menu > Go to Folder... field should look like this:
... and click the Go button once again.
Once again ensure all its files and their names are readable and capture a screenshot.
Then, repeat that exercise with the following folder:
/Library/LaunchAgents
Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:
In the end, you will have captured the contents of the following three separate folders:
~/Library/LaunchAgents
/Library/LaunchDaemons
/Library/LaunchAgents
All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.
What happens next
Next, either post a reply to your existing Discussion or post a brand new Discussion containing the entire contents of all three of those windows, one at a time, using the "picture" icon that appears below your reply text:
- When posting your message, please review and confirm the screenshots you post reveal complete, readable file names. If they do not, then please review the above instructions.
Then, your fellow Apple users or the author of this User Tip or even you yourself will be able to identify the files that are likely to be causing the problem.
Please wait for that reply, but if you get impatient and want to "read ahead" to find out what you will be doing next, you can peruse this one recent example among many others. That example Discussion also includes general instructions, if you prefer to proceed on your own.
While you wait for that reply, be sure that you create a backup of your Mac's contents. Why? The reason is only peripherally related to the issue at hand — any device can fail at any time for any reason, or no apparent reason whatsoever. If you do not have a backup of your Mac, it means the prospect of permanently losing all the information on it does not concern you.
Back up your files with Time Machine on Mac - Apple Support describes how to use Apple's Time Machine software, which every Mac already has:
- If you have been using Time Machine, you can fix the problem by restoring a backup created prior to having installed "Search Baron" or whatever else may be causing the browser redirect. Restoring a backup from a "local snapshot" takes only a couple of minutes.
- If you have not been using Time Machine, now would be a good time. Don't put it off any longer.
Impatient? Want to fix it yourself?
Ideally, a human being should investigate the suspicious files responsible for the effects of having installed adware, but the following general instructions are broadly applicable.
- Back up the affected Mac with Time Machine which everyone ought to be doing anyway.
- Boot Safe Mode. The processes causing the browser misbehavior are inactive in that mode, which permits you to remove the files that invoke them.
- While in Safe Mode, identify all the files that result in creating the processes causing the misbehavior, and drag them to the Trash.
The folders to be examined are these three:
~/Library/LaunchAgents
/Library/LaunchDaemons
/Library/LaunchAgents
There should only be few files, if any, in each of the above folders. You should have a passing familiarity with what they are and the reason you need them. If you're unsure, ask.
Legitimate products that deposit system-altering components in those folders commonly include Adobe, Amazon, Citrix, Dropbox, Google and Microsoft, including its product Skype. Teamviewer also, assuming you really need it. Less common but equally legitimate products include Steam (games), various non-Apple "cloud backup" products that don't work very well, and device drivers for external hardware such as older printers and non-Apple input devices. It's incumbent upon every Mac user to know the products they install on your Mac, so the files they deposit in those folders will never come as a surprise.
Illegitimate products notorious for causing trouble include any non-Apple product that claims to "clean", "enhance", "optimize", "protect", or "scan" your Mac. Anything in that broad category of junk should be uninstalled according to their instructions and never reinstalled, ever again.
Everything else should be regarded as suspicious. Some malware will litter those folders with hundreds of randomly named files in a pathetic attempt to obscure itself. For one particularly egregious example refer to notice unysgar.app, but if you have no explanation for any particular file in those folders you need to investigate.
Among a few examples of adware are files containing the following in their names:
calculator
calender
confcloud
copypaste
date
fixer
gettime
helper
hlpr
mafntask
moniter 🙄
pcv
scan
search
smokyashan
systemond
systemExtr
spigot
techyutil
time
updService
util
utilty
vlm
... files containing nothing but a random string of long alphanumeric text
... among a few others, but deleting those is a good place to start.
Then, reset your desired Search Engine, uninstall any strange Extensions, remove any unwanted Login Items, delete any unwanted apps, examine System Preferences for the existence of any Profiles, and finally restart your Mac (normally; not Safe Mode).
Then, evaluate its operation. If something still isn't right re-examine those three folders and determine if you overlooked anything. If something really gets messed up you have Time Machine to fall back on, so keep that important fact in mind.
That in a nutshell is how you get rid of adware, on your own, without having to install some sketchy tool or even ask anyone else for help. If you prefer individual attention specifically tailored to your needs though, then by all means please post a new Discussion. To do that click the Ask the Community link near the top of these pages, and compose your question. Remember to include those three screenshots.