You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

how can I get rid of 'search baron' and /search marquis'?

how can I get rid of 'search baron' and 'search marquis'?

MacBook Pro 13″, macOS 10.15

Posted on Jun 28, 2020 6:27 PM

Reply
8 replies

Jun 28, 2020 6:31 PM in response to metacognito

To ascertain the cause so that you can eliminate it, start by inspecting the contents of the following folder:


~/Library/LaunchAgents


To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:



... and click the Go button.


A Finder window will open. Make sure all its file names are readable by selecting View > as List or other selection that shows that folder's complete contents. Then, take a screenshot of that Finder window.



Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.


In the same manner as the above, navigate to this next folder:


/Library/LaunchDaemons


The Finder's Go menu > Go to Folder... field should look like this:



... and click the Go button once again.


Once again ensure all its files and their names are readable and capture a screenshot.


Then, repeat that exercise with the following folder:


/Library/LaunchAgents


Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:



In the end, you will have captured the contents of the following three separate folders:


~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents


All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.


Post the entire contents of all three windows, one at a time, using the "picture" icon that appears below your reply text:


Jun 30, 2020 7:59 AM in response to metacognito

No worries. You won't be forgotten on this site.


To fix it follow the instructions below. To learn how not to make that mistake again, please read How to install adware, but I have reason to suspect the files responsible for "Search Baron" / "Search Marquis" arose from a questionable "download aggregator" site such as "C net dot com" or "Mac Update dot com" or others just like it. Do not patronize those sites. Please use caution when downloading apps that are not from the Mac App Store.



First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.


  • A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.


Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".


The following files and / or folders need to be deleted while using your Mac in "Safe Mode":



Nothing needs to be deleted from the folders in the second and third screenshots.


Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.


Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).


There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.


Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.


Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:



If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.


Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.


You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.


Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:


~/Library/Application Support


It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.


Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Jul 5, 2020 2:19 PM in response to John Galt

Hi John,


Well, it happened again. Throwing caution to the wind after typing another windy reply to your latest message, I clicked on "This solved my question" and "Link this to Post" (thinking that meant it would be linked to my pending reply) at which point my entire reply - of course - vanished AGAIN. Hoping that a subsequent click on "Reply" followed by a > command/Z might rescue my reply, naturally, proved futile. So... if you've ever failed to have your sage assistance duly acknowledged, said acknowledgement may simply be floating aimlessly trough the vast cyber wilderness somewhere.


In any case, the gist of my reply was that it appears that your recommendations have finally freed me of that pesky 'SearchBaron/SearchMarquis' bug without any peripheral glitches thus far (fingers crossed). And, just to confirm, in regards to the trash bound "Application Support" folders, the second one of "the two folders with a lot of numbers in their names" begins with "com.[numbers]", correct? Although I'm sure there are other trash-worthy folders, I'm a bit paranoid about randomly trashing folders which may or may not be linked to some critical function. Can you kindly provide typical ground rules I may apply before moving other similarly useless folders to the trash bin? Thank you tremendously for your clear, concise bug extermination advice. Cheers,


Will

Jun 29, 2020 7:46 PM in response to John Galt

Hi John, REALLY sorry for getting back to you so slowly.. I was certain that I'd landed into another tech-help deadzone when I eventually refreshed the inquiry I'd left open on my MacBook and discovered your timely reply. Many thanks! Now that I've finally managed to complete the recommended tasks (despite an exasperating, perpetually spinning cursor feature of this particular bug), I can only hope you're still checking for a reply. Pls note suggested screenshots below in order of stated instructions. Anxiously awaiting further clues to the potential extermination of this nasty bug. Cheers, Will

Jun 30, 2020 5:50 PM in response to John Galt

Hi John,


Very happy to find you still hanging in there. After drafting a long reply and including a couple screenshots, I clicked 'post' only to have it hang in an endless spin. After about an hour I finally clicked 'cancel' in hopes of the page returning me to my pending reply. It didn't, of course. I'll copy/save the text before attempting this follow up.


Despite being unable to interact after opening Time Machine (i.e. check 'backup automatically', etc), I decided to press ahead with bug extermination as multiple pages/instances of past-present backups hinted at functionality. While remaining in safe mode, I trashed the likely culprits as recommended. I then opened browser and system preferences on browsers used within the past couple years to check extensions and homepages as well 'default search' and 'other search engines' to discover a few instances of the bug. Firefox, for example, opened with a 'searchmarquis' search page and displayed a 'searchbaron' homepage(!). Chrome displayed Google as default search engine as I had selected but, lurking in 'other search engines', I discovered another instance of 'searchbaron' apparently configured to override my Google default(!). Worth noting is the fact that about a week ago a well-intended friend found and discarded a 'profile' folder resembling your description thinking that might resolve the issue (to no avail).


In any case, while remaining here in safe mode, I am attaching the suggested screenshots of my User Acct's 'Login Items' as well as a top and a bottom shot of my '~/Library/Application Support' folders in hopes of finally ridding my MacBook of any remnants of nuisance adware and returning to bug-free browsing. I really appreciate your insight. Cheers,


Will


Jun 30, 2020 7:11 PM in response to metacognito

You can adapt my instructions for other browsers such as Firefox. They all have their own ways of resetting their Search preferences, extensions, add-ons and the like.


You can definitely remove all the Login Items accompanied with the yellow "caution" icon. Personally I'd remove all of them. All it does is launch those apps every time you log in to your Mac. You can do that on your own after you verify everything is working the way you expect, after which you can add the apps you need, if you wish.


Of the folders shown in Application Support, you can definitely remove the anything containing the following in their names:


Genieo

Mac Cleanup Pro (both)

purevpn

Similar Photo Cleaner

Spigot

... as well as the two folders with a lot of numbers in their names


There are others that can be removed but they are not strictly the product of anything malicious. Without the processes that require them they are inert anyway.


Once everything is complete you may want to review the contents of the first three folders:


~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents


... and confirm no Profiles pane reappears in System Preferences.


After drafting a long reply and including a couple screenshots, I clicked 'post' only to have it hang in an endless spin. After about an hour I finally clicked 'cancel' in hopes of the page returning me to my pending reply. It didn't, of course. I'll copy/save the text before attempting this follow up.


That's an annoying manifestation of this site's protections against spammers—it "times out" after a while, and won't accept a reply until refreshing the page. Cancel and replying again doesn't work; you have to reload the page.


Spam was becoming a major problem on ASC a while ago. As annoying as it is, those preventive measures have been effective. Next time that happens to you try this: click Reply again, but ⌘ Z to "undo". That simple step will often resurrect a meticulously composed message it took a long time to write.

Jul 5, 2020 6:40 PM in response to metacognito

And, just to confirm, in regards to the trash bound "Application Support" folders, the second one of "the two folders with a lot of numbers in their names" begins with "com.[numbers]", correct?


Yes. There are two of them.


Can you kindly provide typical ground rules I may apply before moving other similarly useless folders to the trash bin?


Test after removing them by restarting your Mac and confirming it's generally working as you expect. You can empty the Trash at your leisure, or let it empty automatically if you chose that option. Folders in Application Support should be generally familiar to you since legitimate software makes no attempt to obscure itself.


On that subject I suspect the folder named "mcp" is also related to "Mac Cleanup Pro" and can be deleted also.

how can I get rid of 'search baron' and /search marquis'?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.