How to remove Marguis search engine form Google chrome on my MAC.

Hi, welcome to the Apple Users Community.

Please see this link to help you.

https://support.apple.com/guide/mac-help/protect-your-mac-from-malware-mh40596/mac

Many users here also recommend Malwarebytes to aid in removal.

Best of luck

Getting rid of "Search Baron" / "Search Marquis" is easy and doesn't require installing anything. To fix it follow the instructions below. To learn how not to make that mistake again, please read How to install adware.

To ascertain the cause so that you can eliminate it, start by inspecting the contents of the following folder:

~/Library/LaunchAgents

To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:

... and click the Go button.

A Finder window will open. Make sure all its file names are readable by selecting View > as List or other selection that shows that folder's complete contents. Then, take a screenshot of that Finder window.

• To learn how to capture a screenshot please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question. It also includes instructions for posting a screenshot in a reply to this Discussion, so keep that Safari window open for now.

Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.

In the same manner as the above, navigate to this next folder:

/Library/LaunchDaemons

The Finder's Go menu > Go to Folder... field should look like this:

... and click the Go button once again.

Once again ensure all its files and their names are readable and capture a screenshot.

Then, repeat that exercise with the following folder:

/Library/LaunchAgents

Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:

In the end, you will have captured the contents of the following three separate folders:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.

Post the entire contents of all three windows, one at a time, using the "picture" icon that appears below your reply text:

Sonny, don't be concerned but the information in the screenshots you posted contained some personal information that I asked the site Hosts to remove. I obscured that information in the screenshots below.

Also, you really ought to post your own Discussion. That way, you will receive the individual attention you require in a timely manner. The originator of this one deserves his or her own personal attention too, but he or she has not yet responded. When a Discussion becomes clogged with a lot of "me too" replies the resulting cacophony often causes its OP to drop out.

This is Part 1 of 2 replies so be sure to read the one after it.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Second screenshot:

Nothing needs to be deleted from your third screenshot.

Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use.

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Hi Apple

Today, search marquis/search baron booted up as my search engine.

I have the followed the instructions above.

Thanks for assisting me with the next steps

Regards

Sonny

[Image Edited by Moderator to Remove Personal Information]

Hey there! Looks pretty standard, although in the top Launch Agents folder, (Unsure if that’s in ~Library or /Library, I see some files that are unusual, doesn’t necessarily mean they’re malicious though.

Other folders you can look at that other software installs, besides Launch Agents and Launch Daemons, are:

~/Internet Plugins/, and

/Internet Plugins/, and

/Startup Items/

Typically, if you see something you don’t recognize or something that looks suspicious you can just delete, however, to be safe, you can also deactivate the process, while keeping a copy as a backup by:

Open the folders mentioned above and earlier, select all, (Command + A), then select File > New Folder With Selection, this just creates a folder in that location with the items you selected, then restart and test.

If there is an issue with a particular program after restarting and testing, you can open the new folder in that location and put the file with the apps name back where it was, in the parent folder and restart again if need be, (Quit the app before doing this).

However the best way to remove and prevent malware are to keep your Mac updated with the latest OS and latest version of the OS if possible, a lot of these problems are already sorted out, you just need to update to fix it.

Another step is as simple as a restart, Mac OS has a built in process that checks for known malware and disables/removes it just by restarting your Mac. This is the solution with the least resistance.

Also, as said before, Malware Bytes for Mac is a trusted program and, from experience, also very good at finding any type of malware/adware.

One last location you may want to check out if it’s being stubborn and you’ve updated/restarted is in System Preferences > Profiles, this category is not there by default, but if you see the category there, open it.....if there’s anything you don’t recognize, or you see something to the effect of “Search Baron” “Coupon Search”, as an example and the example above, If remove it by highlighting it and pressing the minus sign below, them, again restart and test.

There may also be leftover extensions causing a problem:

Safari > Preferences > Extensions, if you see something similar there you didn’t install, click it and press “Uninstall”, if it gives an error that it can’t be uninstalled, click Show In Finder, and move it to the trash, and then uninstall.

If it’s stubborn and it says it’s open.....click the magnifying glass on the top right to open Spotlight Search, and search for and open Activity Monitor, in there, click on the CPU tab, on the top right, search for that app/extension/process name, then, if there, click on it, hit the “x” icon on the top left then select Force Quit, it should then allow you to uninstall it either from the Safari Preferences, or it’s location in Finder.

Finally, take a look in System Preferences > Users and Groups > Login Items, programs in this list are trying to open automatically every time you restart/login, you can also stop that by highlighting the app and pressing the minus sign below, then restarting again.

Sometimes, even after removing it, the search engine or home page remain where you don’t want it, in cases like that, you still need to change it back: In Safari:

Safari > Preferences > General (HomePage), set time desired

Also in the Safari > Preferences > Search, can change to your preference again, then quit/re open.

Hope that helps!

Chrome is a little different, for Chrome, to get to this settings, on the top left, select: Chrome > Preferences, there you should see similar settings to Safari such as Extensions, and in Advanced Options, the Search Engines etc. There just hit the three dots next to the search engine that’s suspect and click the option to remove it. If issues continue in Chrome, and the steps have been done above, including previous replies, and all are updated....I’d contact Google support, and stick to Safari until that’s fixed!

Again, the best defense is keeping your OS up to date and, of course being weary of websites you’re visiting, and links you click on, also making sure The web sites you visit are encrypted (Say HTTPS instead of HTTP, and/or have a lock icon on the top left of the address bar), websites without that aren’t as secure, even if they are legitimate.

Thanks! Hope all goes good!

Hope that helps!

Reply Part 2 of 2 follows below.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Next: A scam "cleaning" product is installed, or was installed at one time and not completely uninstalled. Remove "CleanMyMac" in strict accordance with its instructions. Rule 1 of Macs is don't install junk.

Next: Use "TeamViewer" and Oracle's Java product with caution. Both have been used for nefarious purposes.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Glad to hear it.

If Safari saves your passwords and otherwise works ok, then I surmise it's a Google Chrome setting that needs to be turned on or otherwise enabled. Try this: https://support.google.com/chrome/answer/95606

Thanks John & DiZoE

is it possible to delete this entire post for my peace of mind?

Problem solved and I am very happy