I may have a MARQUIS virus in the presence of a torrent client. What is this, how do I remove this?

jeanneapple wrote:

Thank you for the help! I did not know that about VPN's. I did connect it once & then turned if off, then had this eu-localhosT Zone issue which showed up on both Firefox and Chrome's Inspect. So I am sending the wrong time zone from my machine?

I think the VPN is responsible for that. If you turned it off it may not have actually been disabled. The EtreCheck report indicates that it remains active. That's all it can do, and it's all we can determine.

Localhost needs to be investigated, and the /etc/hosts file is the obvious place to start. It seems you had a legitimate need to modify it, but perhaps something else did that without your subsequent knowledge or consent. The fact that it has been modified is all we can determine. etresoft's Fixing a hacked /etc/hosts file - Apple Community expands on that subject should you need to investigate it further.

Also I suppose reformatting the disk is the only way to clean up the mess from the "anti-virus" software?

It's premature to conclude that will be required. Just uninstall whatever it is according to its instructions — assuming you can find them, and that they work. Uninstallers that work with complete effectiveness are rare, especially with junk "anti-virus" products.

Once you address those problems run EtreCheck again to confirm they are no longer a factor.

Kicking goals @jeanneapple! You have shown grit and tenacity. It seems like you're dealing with a persistent malware issue. Here is a summary of the steps you would follow to remove malware. Some of the steps you have already tried, step 7 showing - some more steps to help you remove it:

1) Check your system profiles: Malware often installs a system profile. Go to System Preferences > Profiles. If you see any profiles that you don't recognize, remove them.

2) Check your network settings: Malware can change your DNS settings. Go to System Preferences > Network > Advanced > DNS. If you see any DNS servers that you don't recognize, remove them.

3) Scan with an antivirus program: Download a reputable antivirus program and perform a full system scan. Some popular options for Mac include Avast, Bitdefender, and Malwarebytes. Make sure to download the antivirus software from the official website to avoid fake versions.

4) Check your browser settings: If the malware has changed your browser settings (like your homepage or default search engine), you'll need to reset them. Also, check your browser extensions and remove any that you don't recognize.

5) Reinstall your browsers: If the malware persists, you might need to uninstall and reinstall your browsers.

6) Check your hosts file: Malware can add entries to your hosts file to redirect certain websites. You can check your hosts file by opening Terminal and typing: 

cat /etc/hosts

If you see any entries for websites that you're having trouble with, you'll need to remove them. Be careful with this step, as modifying your hosts file can cause network issues if done incorrectly.

7) Remove suspicious Entries: Remember, be careful when modifying your hosts file as it can cause network issues if done incorrectly. Always make sure to have a backup of the original file before making changes. To check and remove suspicious entries from your hosts file on macOS, follow these steps:

a. Open Terminal. You can do this by searching for it in Spotlight (Command + Space).

b. Type the following command to open the hosts file in a text editor (nano in this case):

sudo nano /etc/hosts

c. You'll be prompted to enter your password. Do so, and press Enter.

d. You'll now see the contents of your hosts file. It should look something like this:

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1	localhost
255.255.255.255	broadcasthost
::1             localhost

Any additional entries could be suspicious, especially if they're websites you're having trouble with. To remove an entry, simply delete the line it's on.

e. Once you're done, press Control + O to save the file, then Control + X to exit nano.

f. Finally, flush the DNS cache by typing the following command into Terminal:

sudo killall -HUP mDNSResponder

This will ensure that your system starts using the new hosts file immediately.

8) Reinstall your operating system: If all else fails, you might need to erase your hard drive and reinstall your operating system again. Make sure to back up any important data first.

9) Contact a professional: If you're still experiencing issues with MARQUIS after following these steps, you might need to contact a professional. Let me know how you get on.

Amy

Hi jeanneapple

Thanks for posting a new question. Continuing our conversation from Virus - Search-Alpha/ Search - Marquis... - Apple Community, your concerns go beyond the adware's presence.

Barney-15E suggested using EtreCheck and I agree that's where we should start. How to use the Add Text Feature When Posting Large Amounts of Text, i.e. an Etrecheck Report - Apple Community explains how to post its report in a reply to this Discussion. Post it here so that you can get the help you need.

So then I went to install Firefox, and launching the browser, I get the search-alpha MARQUIS search bar website. Therefore I have the Marquis.

Nothing installed at the system level is causing that to occur. Fixing it may be as simple as resetting Firefox's home page, and / or by restoring Firefox's default settings. Its Help menu describes how to do that.

Perform those same equivalent actions with Google Chrome.

That Mac has also been affected by a number of questionable alterations including but not limited to some kind of non-Apple "anti-virus" utility. Those things are categorically worthless — which is to say they provide no benefit, while at the same time they destabilize a Mac, burden it unnecessarily, and permit a greater exposure to threats. Excerpted from Effective defenses against malware and other threats - Apple Community,

• ...
• Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don't want it any more.
• If you elect to use "anti-virus" software, familiarize yourself with its limitations and potential to cause adverse effects, and apply the principle immediately preceding this one.
• Most such utilities will only burden your Mac while they look for viruses that do not exist. They will degrade its performance and prevent it from working properly while conveying no benefit whatsoever—other than to make you "feel good" about security, when you should actually be exercising sound judgment, derived from accurate knowledge, based on verifiable facts.

As for NordVPN, all I can say is... this:

"Don't use VPN services. No, seriously, don't."

Marquis is one of the oldest Adware. It seems to be making a resurgence.

Etrecheck may help you remove it.

Here's how to avoid installing it: How to install adware

You don't have any malware installed. The only suspicious thing is two entries in your /etc/hosts file. If you know what those are, and added them for a reason, then they should be fine.

You might have some kind adware installed inside Firefox. EtreCheck only looks at the system level. It doesn't look inside apps like Chrome or Firefox that could be hosting adware. You will either have to use Safari instead or figure out how to remove the adware from Firefox.