SearchMarquis Adware - How to remove

SearchMarquis (or Searchmarquis.com) is a malicious website and a fake search engine. It appears when an adware app is installed. It hijacks the browser and manipulates searches. SearchMarquis appears because of a malicious app, so to remove it, all the malicious files and settings need to be found and deleted.

About SearchMarquis:

Type of threat	Browser hijacker, adware.
How SearchMarquis hijacks browsers	Searchmarquis.com redirects search to Bing and other sites, it’s caused by malicious apps, browser extensions, and configuration profiles.
How adware gets installed	By deceptive ads, bundled undisclosed with free apps, spread by malicious messages and links, downloaded by other malicious apps.
How to remove SearchMarquis	Delete malicious files yourself or with anti-malware apps (Combo Cleaner, Malwarebytes, or others), remove suspicious apps, browser extensions, and configuration profiles, restore system and browser settings.

What is SearchMarquis

SearchMarquis redirects your searches

Searchmarquis.com is a malicious website, a fake search engine.

A search engine is a site that searches the internet and returns results according to a query. The default search engine is the one used when you don’t open a new page. If I were to type something into my address bar right now, the default search engine (in my case, Google) would return the results.

SearchMarquis hijacks your browser, replacing your new tab page with Searchmarquis.com which waits for you to search, then redirects to Yahoo, Bing.com, Ask.com, Mybrowser-search.com, Search Finder, SearchSnow.com, SearchBaron.com, or another site. It seems to affect Safari the most.

More and more people have been voicing complaints about SearchMarquis taking over Safari (link 1, link 2). The traffic to Searchmarquis.com has been rising for the last few months.

Besides taking over your searches, SearchMarquis collects search logs. It uses that data for advertising and it can share it with other companies. That’s to say, SearchMarquis is terrible for your privacy.

It comes in uninvited

Most likely, SearchMarquis arrived as part of an adware bundle. It may have tricked you into installing it – cyber criminals can be crafty.

Here is how SearchMarquis spreads:

• Free apps that don’t disclose that they bundle additional software. While being installed, such an app could download and install SearchMarquis.
• Fake software updates. Have you seen a pop-up telling you to install the newest macOS update or to update your Flash Player? That’s malicious ads that impersonate trusted companies and use their names to spread malware.
• Fake Start and Download buttons. People think they’re downloading a wanted app or file, click on an ad that looks like a download button, and get malware.
• Malicious links in social media messages, comments, and in spam emails.
• Worst case, a trojan had already been installed and downloaded SearchMarquis.

When you’re removing SearchMarquis, examine the dates of its files to pin down when and how it was installed. Knowing that can help you avoid adware in the future.

How to remove SearchMarquis

Find and delete malware

SearchMarquis can be removed manually or with an antivirus app. Ideally, both methods are combined for the best result.

Frankly, I don’t know which adware app caused SearchMarquis to appear on your computer. That’s why it’s fastest to use an anti-malware app, such as Combo Cleaner, Malwarebytes, or another app that you trust. SearchMarquis may get detected as Genieo, Adload, Adware, Malicious, Malware, and by other names.

Sometimes, though, anti-malware fails to detect or remove SearchMarquis. In that case, it can help to know how to hunt down malware yourself.

Find and delete malicious files and settings

Settings

SearchMarquis might go away if you just delete suspicious configuration profiles:

• Go to System Preferences -> Profiles. Remove all the items that you don’t recognize.
• In System Preferences, Users & Groups, Login Items, remove all the items that you did not add.
• Also in System Preferences, click Network, Advanced, Proxies. If there’s a proxy configured but you did not do it, then uncheck it and click OK.

Files

SearchMarquis needs to have its files found and deleted. Most likely, some malicious code remains in the /Library and ~/Library folders. Specifically in:

• /Library/LaunchAgents
• /Library/LaunchDaemons
• ~/Library/LaunchAgents
• ~/Library/Application Support

Open Finder, open the Go menu, and click on the Go to Folder option. Type or paste in these folder names to open them.

The Library folders hold the settings of your various applications. Unfortunately, they are also used by SearchMarquis to hide in.

Here’s an article on the various ways that malware hides on Macs that can give you an idea of what keeps SearchMarquis installed.

You need to find the files that belong to SearchMarquis and to delete them – while also avoiding deleting legitimate files. Examine each file, look up its name, the date it was added, and do not empty the Trash in case you need to bring back some of the files.

The malicious files are named something mundane, to fit in with all the other files. Here are some examples: “UtilityData“, “MacPerformance”, “ApplicationEvents”, “OpticalCommand”, “ScreenCapture“. Some malicious files also have names that are long strings of random letters and numbers.

As for the browser settings, those instructions are below.

Automatic Malware removal tools

Remove SearchMarquis from the browser