You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Search marquis

Hi, my daughters MacBook is infected with search Marquis, following advice I have installed Malwarebytes which seems to have sorted it out on Sarari but not chrome. I have uninstalled and reinstalled chrome but seArch Marquis is still there. Does anyone have any advice to remove it from the machine completely.


thanks

MacBook

Posted on Jan 11, 2021 8:11 AM

Reply
Question marked as Top-ranking reply

Posted on Jan 13, 2021 8:39 AM

Hello, McW5001.


Thank you for using Apple Support Communities.


From your post, it's understood you were able to remove Search Marquis from Safari but not from Google Chrome. We'd be glad to help. Open Chrome, then go to the three dots in the corner of Chrome, and click on Settings. Then go to Advanced and click on Reset Settings. Note, you should see a pop up explaining what the reset will do. After the reset, close the app and open it back up to see if the issue persists.


You can confirm if Malwarebytes was able to remove anything related to this malware by following these steps:


Look for any suspicious files here:


  • /Library/LaunchAgents/
  • /Library/LaunchDaemons/
  • ~/Library/LaunchAgents/


If you see this, "com.gregorian.gettime.plist", remove it.


In addition, follow these steps and remove anything related to gettime malware:


  1. Navigate to the ~/Library/Application Support/ folder in Finder.
  2. Use the keyboard shortcut Command+Shift+Period to reveal hidden items.
  3. Move the folder named '.gettime' to the Trash.
  4. Use the keyboard shortcut Command+Shift+Period to hide hidden items.
  5. Note: If using 'ABC - AZERTY' keyboard layout, use Command+Shift+Fn+Period.
  6. Restart the computer.


Keep us updated.


Cheers!

2 replies
Question marked as Top-ranking reply

Jan 13, 2021 8:39 AM in response to McW5001

Hello, McW5001.


Thank you for using Apple Support Communities.


From your post, it's understood you were able to remove Search Marquis from Safari but not from Google Chrome. We'd be glad to help. Open Chrome, then go to the three dots in the corner of Chrome, and click on Settings. Then go to Advanced and click on Reset Settings. Note, you should see a pop up explaining what the reset will do. After the reset, close the app and open it back up to see if the issue persists.


You can confirm if Malwarebytes was able to remove anything related to this malware by following these steps:


Look for any suspicious files here:


  • /Library/LaunchAgents/
  • /Library/LaunchDaemons/
  • ~/Library/LaunchAgents/


If you see this, "com.gregorian.gettime.plist", remove it.


In addition, follow these steps and remove anything related to gettime malware:


  1. Navigate to the ~/Library/Application Support/ folder in Finder.
  2. Use the keyboard shortcut Command+Shift+Period to reveal hidden items.
  3. Move the folder named '.gettime' to the Trash.
  4. Use the keyboard shortcut Command+Shift+Period to hide hidden items.
  5. Note: If using 'ABC - AZERTY' keyboard layout, use Command+Shift+Fn+Period.
  6. Restart the computer.


Keep us updated.


Cheers!

Search marquis

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.