Search marquis

Go step by step and test.

   1. Remove unknown profiles if present.

      System Preferences > Profiles

      Open System Preferences,  select “General and click  the “Profiles” icon ( a checkmark on a gear) .

      When Profiles pane opens, select the unknown profile and click the minus button at the bottom.

      Section: Remove a configuration profile from your Mac

      Profiles: Use configuration profiles to standardize settings on Mac computers - Apple Support

  2. Remove unknown extensions:  Safari > Preferences > Extensions

      Get extensions to customize Safari on Mac - Apple Support

      Change Extensions preferences in Safari on Mac - Apple Support

   3. Check for adware.

       Run the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

       For instructions: Install Malwarebytes for Mac v4      Uninstall Malwarebytes for Mac

       Click the “FREE DOWNLOAD” button.

       Click the “Scan” button. Once done, quit Malwarebytes for Mac.

       Restart the computer and relaunch Safari holding the shift key down.

       Scan for Malware again.

       Additional steps  if necessary.

  4. Reset search engine:    Customize searching in Safari on Mac - Apple Support

  5. Reset  Homepage.   Change your homepage in Safari on Mac - Apple Support 

If the above don't help:

Run EtreCheck and post the report here.

      https://etrecheck.com

      Click “Free Download” button,  open Downloads folder, click on it to open, and then select ”Open”.

      Click on the bouncing  EtreCheck icon in the Dock.

      “Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.

      Click “Share Report” button in the toolbar, select “Copy to Clipboard” .

      Paste it into the reply.

Should I install a anti virus software ,

No.

Getting rid of "Search Marquis" is easy and you don't need to install anything.

To ascertain the cause so that you can eliminate it, start by inspecting the contents of the following folder:

~/Library/LaunchAgents

To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:

... and click the Go button.

A Finder window will open. Make sure all its file names are readable by selecting View > as List or other selection that shows that folder's complete contents. Then, take a screenshot of that Finder window.

• To learn how to capture a screenshot please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question. It also includes instructions for posting a screenshot in a reply to this Discussion, so keep that Safari window open for now.

Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.

In the same manner as the above, navigate to this next folder:

/Library/LaunchDaemons

The Finder's Go menu > Go to Folder... field should look like this:

... and click the Go button once again.

Once again ensure all its files and their names are readable and capture a screenshot.

Then, repeat that exercise with the following folder:

/Library/LaunchAgents

Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:

In the end, you will have captured the contents of the following three separate folders:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.

Post the entire contents of all three windows, one at a time, using the "picture" icon that appears below your reply text:

It is definitely installed, and was installed a while ago. The problem is that adware peddlers keep changing their names in a pathetic effort to remain obscure. Legitimate software makes no effort to obscure itself.

If you are interested, the following describes a generic adware eradication procedure that can be safely applied.

• Back up the affected Mac with Time Machine which everyone ought to be doing anyway
• Boot Safe Mode
• While in Safe Mode, identify all the files that result in creating the process(es) that cause browser misbehavior, and drag them to the Trash.

The folders to be examined are these three:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

There should only be few files, if any, in each of the above folders. You should have a passing familiarity with what they are and the reason you need them. If you're unsure, ask.

Legitimate products that deposit system-altering components in those folders commonly include Adobe, Amazon, Citrix, Dropbox, Google and Microsoft, including its product Skype. Teamviewer also, assuming you really need it. Less common but equally legitimate products include Steam (games), various non-Apple "cloud backup" products that don't work very well, and device drivers for external hardware such as printers and non-Apple input devices. It's incumbent upon every Mac user to know the products they install on your Mac, so the files they deposit in those folders will never come as a surprise.

Illegitimate products notorious for causing trouble include any non-Apple product that claims to "clean", "enhance", "optimize", "protect", or "scan" your Mac. Anything in that broad category of junk should be uninstalled according to their instructions and never reinstalled, ever again.

Everything else should be regarded as suspicious. Some malware will litter those folders with hundreds of randomly named files in a pathetic attempt to obscure itself. For one particularly egregious example refer to notice unysgar.app, but if you have no explanation for any particular file in those folders you need to investigate.

Among a few examples are files containing the following in their names:

calculator

cleaner

combo

confcloud

copypaste

date

fixer

helper

hlpr

mafntask

moniter 🙄

pcv

scan

search

systemExtr

spigot

techyutil

time

updService

util

utilty

vlm

... files containing nothing but a random string of long alphanumeric text

... among a few others, but deleting those is a good place to start.

Then, reset your desired Search Engine, uninstall any strange Extensions, remove any unwanted Login Items, delete any unwanted apps, examine System Preferences for the existence of any Profiles, and finally restart your Mac (normally; not Safe Mode).

Then, evaluate its operation. If something still isn't right re-examine those three folders and determine if you overlooked anything. If something really gets messed up you have Time Machine to fall back on, so keep that important fact in mind.

That in a nutshell is how you get rid of adware, on your own, without having to install some sketchy tool or even ask anyone else for help. If you prefer individual attention specifically tailored to your needs though, then by all means please post a new Discussion. To do that click the Post link above right, and choose Discussion from the dropdown menu.

Should I install a anti virus software ,

No.

Getting rid of "Search Marquis" is easy and you don't need to install anything.

To ascertain the cause so that you can eliminate it, start by inspecting the contents of the following folder:

~/Library/LaunchAgents

To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:

... and click the Go button.

A Finder window will open. Make sure all its file names are readable by selecting View > as List or other selection that shows that folder's complete contents. Then, take a screenshot of that Finder window.

• To learn how to capture a screenshot please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question. It also includes instructions for posting a screenshot in a reply to this Discussion, so keep that Safari window open for now.

Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.

In the same manner as the above, navigate to this next folder:

/Library/LaunchDaemons

The Finder's Go menu > Go to Folder... field should look like this:

... and click the Go button once again.

Once again ensure all its files and their names are readable and capture a screenshot.

Then, repeat that exercise with the following folder:

/Library/LaunchAgents

Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:

In the end, you will have captured the contents of the following three separate folders:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.

Post the entire contents of all three windows, one at a time, using the "picture" icon that appears below your reply text:

Getting rid of adware is easy and doesn't require installing anything else. To fix it follow the instructions below. To learn how not to make that mistake again, please read How to install adware.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: How to use safe mode on your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Delete all files except the two with "google" in their names.

Nothing needs to be deleted from the folders in the other two screenshots.

Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Booting Safe Mode is an absolute prerequisite, so we have to fix that first. Be sure you are following the instructions for the Intel processor in How to use safe mode on your Mac. If you do not see the words "Safe Boot" in red at the upper-right corner of the screen when you log in, then for some reason it didn't take.

There is another way to force Safe Mode. Use the Terminal app, and type the command

sudo nvram boot-args="-x"

... followed by your usual login password. After that, you should be able to type

nvram -p

... which may return many lines of text, but one of them should indicate

boot-args -x

That will force your Mac to start in Safe Mode all the time, so to undo it the easiest way is to reset NVRAM to its defaults. To do that read Reset NVRAM or PRAM on your Mac - Apple Support.

In any event booting Safe Mode is a roadblock that has to be overcome first.

That Mac is not allowing you to alter NVRAM, which is likely to be related to the fact you can't boot Safe Mode.

Two suggestions, neither one of which may help:

• Perform an SMC Reset: How to reset the SMC of your Mac - Apple Support
• Boot Recovery (as you suggested, ⌘ R) and remove the Firmware Password, assuming you set one to begin with:

Use macOS Recovery on an Intel-based Mac - Apple Support

Set a firmware password on your Mac - Apple Support

~/Library/LaunchAgents

Thanks so much John for your speedy reply. I will first study your link "How to install Adware" (even though I don't believe I ever installed adware before and not interested in installing Adware). Second I will study "Back up Mac with Time Machine" to be sure that the one I did earlier today was accurate. Then I will proceed with doing the "Safe Mode" to delete all but the files with "google" in their name and follow your other instructions. Hoping and looking for a clean and easy result. Thanks again for being out there and all the help you have provided.

Tom

Hi John,

Still having problems. I can't get my MacBook Pro 2019 into "Safe Mode".

I have installed macOS Monterey V12.4 and updated all app's, reinstalled macOS v12.4, I tried adding a new user, and restarted many times with holding the shift key down and it always returns to Normal Boot. Any suggestion? Should I reboot with "Command + R" then go into "Disk Utility" and run "First Aid"?

Thanks so much,

Tom

Hi John,

Still at the "Safe Mode" Road Block.

I went to the terminal and typed in: sudo nvram boot-args="-x"

When prompted to enter password keyboard does not respond can not enter any characters at all.

Thanks,

Tom

When prompted to enter password keyboard does not respond can not enter any characters at all.

That's normal. What you type will not be echoed, not even with •••• characters. Just type your password and hit Return.

Hi John,

I tried as you last advised and entered password with no results.

I also tried this procedure on my "iMac 27" 2017 Retina 5K" and it worked perfectly well, however I do not have the "Search Marquis" problem on that machine, I was just trying out the steps you gave me which all worked fine.

I tried this several times on my "MacBook Pro 16" 2019 Intel Core i7" the affected computer. Here are the screen shots:

2nd Screen shot after I put in my password and press enter

Any other thoughts on getting by this Road Block to "Safe Mode"

Thanks again,

Tom

Thanks John,

I read the article SMC Reset, and just have one question before I do it. My MacBook Pro is a 2019 16" Intel i7, the only instructions that apply are for MacBooks Pros 2009 through 2017 is it ok to try on my new one? Here's a screen shot of what I'm talking about.

Thanks,

Tom

Success!!! it Worked.

Thanks so much John,

FYI, the SMC Reset did not work, but the Boot Recovery and the removal of the Firmware Password and Turning off the Firmware Password worked.....

I'm in "Safe Mode" and will now delete those files other than the 2 files containing "google" in the string. And then follow your other directions.

Looking for smooth sailing. I'll let you know how it works out in removing "Search Marquis"

Thanks Again,

Tom