Remove Search Marquis

mamu272 wrote:

what should I do, pleas?

Please read Removing "Search Marquis" / "Search Baron" / etc on your own - Apple Community, and post the three screenshots it describes in a reply to this Discussion.

Ideally, post them in a brand new Discussion that you create because this Discussion has grown large and unwieldy.

To create a new Discussion, click the Ask the Community link at the top of this page. Type the subject of your question (for example, "Need help removing Search Marquis"), insert those three screenshots in the body of the message, choose a device (your Mac) choose a topic (Safari) then Submit.

But if you prefer to reply to this Discussion, that's ok too.

Macnotwork, follow the instructions below.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Drag all the files except the one with Amazon in its name to the Trash.

Nothing needs to be deleted from the folders in the other two screenshots.

Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Balzac bob wrote:

did you have to agree to their license and pay going forward?

I don't know whose license you are referring to, but you most definitely do not have to install or pay for anything to get rid of the "search baron" problem. You can do it on your own, and all you might need is some assistance from me or others on this site.

To get started read Removing "Search Marquis" / "Search Baron" / etc on your own - Apple Community. Capture and post the three separate screenshots as described in a reply to this Discussion or a new Discussion that you create — your choice. I'll look for it.

Efitz659, solving the problem requires that you follow instructions with care. Your last screenshot shows the contents of /System/Library/LaunchAgents, which is not one of the three you need to examine.

The instructions are on the first page of this Discussion.

Remove Search Marquis - Apple Community

Please review the instructions I posted and try again. You need to open and capture the contents of the following three separate folders:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

Getting rid of adware is easy and doesn't require installing anything else. To fix it follow the instructions below. To learn how not to make that mistake again, please read How to install adware.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: How to use safe mode on your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

Third screenshot:

Nothing needs to be deleted from the first or second screenshots (those folders are empty).

Drag all those files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Hi,

I wanted to give you guys an update: I ended up following step #3 from Dominic and IT WAS WORKED! The Malwarebytes removed all of the search marquis in the iMac. Safari, and others (Chrome & Firefox) are back to normal as orginial now.

Again thank you!

MariaKiblinger, follow the instructions below.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Nothing needs to be deleted from the folders in the other two screenshots.

Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

kendrajo1022 I provided instructions here: Need Help removing search marquis - Apple Community.

Thanks for posting a new Discussion. This one has grown old and unwieldy.

System Preferences > Security and Privacy > Automation and uncheck the boxes of Safary and Chrome.

Chrome offers these instructions to reset it to its default configuration:

Reset Chrome settings to default

You can restore your browser settings in Chrome at any time. You might need to do this if apps or extensions you installed changed your settings without your knowledge. Your saved bookmarks and passwords won't be cleared or changed.

I don't use it though.

SanibelHightide, you posted two screenshots of the same folder. Please review my instructions and post a screenshot of the missing one. It may be empty, in which case just say so.

With the understanding that I will be working with incomplete information, you can delete all the files in the first screenshot while in Safe Mode. Follow the instructions I posted for other participants of this Discussion.

While in that mode, you can also delete all the files in the second screenshot. with the exception of the three with "carbonite" in their names.

Then, restart your Mac normally (not "Safe Mode"). If the "Search Marquis" problem is fixed and everything else is working as it should, you're done.

2nd /Library /LaunchDaemons

The Hide checkbox does exactly that: it merely hides those applications from view. To prevent them from opening automatically when you log in, select (single-click) the item and click the [—] (minus) button at the lower left.

That action does not remove those applications; it merely prevents them from opening automatically when you log in. To uninstall them, follow their respective uninstallation instructions. I suspect they have already been removed though; the yellow "caution" icon is an indication of that.

"Similar Photo Cleaner" is adware. Refer to this Discussion: remove similar photo cleaner - Apple Community. I believe the files I asked you to remove are a consequence of having installed that product.

You can generally follow the same instructions I posted for CamiPer above: in your third screenshot, delete everything except the Dropbox and Google files. Leave them alone.

Don't delete any files shown in your first or second screenshots: the files with Apple, Adobe, Microsoft, and Zoom in their names are all ok.

Follow the general instructions I posted earlier.

These are the files that need to be removed while in "Safe Mode":

Some or all of them were installed as a consequence of installing "Mac Cleanup Pro". You will want to remove all remnants of that product. Non-Apple "cleaning" products are categorically junk. Rule 1 of Macs is don't install junk.