Remove Search Marquis from Safari app on Mac

The Search Marquis is a browser hijacker that automatically changes the default search engine to a malicious search site.

To remove it from the Safari app, you must force quit the browser, end suspicious activity using Activity Monitor, uninstall the unknown extension, and clear browsing data for a complete cleanup.

Step 1: Force Quit the Safari app

If your Safari browser is already running, the first thing you need to do is quit it. If you usually have trouble closing it, you must force quit the browser.

1. Click on the Apple logo for options.
2. From the options list, click on Force Quit… (another way is to press the Cmd + Option + Esc key).
   
3. Force Quit Applications window will pop up.
4. Then select the Safari app within the window.
5. Hit on Force Quit button and close the window.

It will close the Safari browser from the background and terminate all running process threads.

Step 2: Find and Delete Malicious Files

Open Activity Monitor by launching it from the Finder. Navigate to Application > Utilities > Activity Monitor.

You can also use the Spotlight Search to find it.

Within the Activity Monitor window, analyze all the unknown processes. Do this for all processes you think are part of hijacking and quit the malicious process.

Note: Be extremely careful while deleting files or quitting the process. You may damage your system if you delete the wrong file.

Step 3: Check Browser and Prevent Hijacking

Now that we have cleared the closed the browser and hijacked processes, we will check if everything works.

1. Press the shift key while relaunching Safari.
   Pressing the shift key will prevent the previously opened pages from relaunching in Safari.
2. You can release the shift key once Safari is safely launched.

If you still need help, you must take additional steps.

1. Force quit Safari again.
2. Turn off the WiFi connection from the Mac’s menu.
3. Disconnect the ethernet cable if you use an ethernet connection.

It will kill the connection between the malware software and the browser.

Step 4: Delete Marquis Search Extensions

There is a high chance that an unknown browser extension replaced the default search engine. You should identify and delete the extensions from the Safari browser.

You could find an extension named ‘Search Marquis,’ which you should uninstall.

1. Launch the Apple Safari app on your Mac computer.
2. Click on the Safari menu from the menu bar at the top, and select Settings… sub-menu.
   It will open the Safari Settings window.
3. Switch to the Extensions tab in the Settings window.
   It will display the list of all the Safari extensions installed.
4. Uncheck the checkbox in the left pane to Disable the extension.
5. Click the Uninstall button.

It will remove the extension and also delete all malicious activity.

However, if you are unsure which extension to remove, you can disable the checkbox for all extensions until the issue is resolved.

Step 5: Clean up Browser Settings and Data

Now that we have rectified the issue that caused it, it is important to clear and remove any unwanted scripts left in browser storage that caused the malware injection in the first place.

Clear Website Data from the Safari app

The first thing we need to do is delete all browsing data so that no traces are left in the browser. Clearing the website data will also delete all the storage, cookies, and cache.

1. Launch the Safari app on your Mac computer.
2. Click on the Safari menu from the menu bar and select the Settings… sub-menu.It will open the Safari Settings window.
3. Switch to the Privacy tab and click to open the Manage Website Data… button.It will load the list of websites currently storing the cache and cookies in the browser.
4. Hit on the Remove All command and then the Done button.It will flush the cookies and cache for all sites.

Note: Clearing the cookies will log out of the online signed-in account, and you need to log in again.

Reset the Default Homepage

Next, we will ensure the default Homepage is set correctly on the Safari browser. We just wanted to ensure the Marquis search differs from the browser’s homepage.

1. Launch the Safari app.
2. Click on the Safari menu and select the Settings… sub-menu.
3. Select the General tab in the Settings window.
4. Check if your Homepage field is the same as you have entered.
   

If something else, change it to whatever you want to see first when you open the Safari app—preferably a search engine like Google or Bing. You can also leave it as Safari’s default start page.

Clear Browsing History

Lastly, we will delete all the browsing history so you won’t accidentally open a problematic web page again.

1. Go to the History from the menubar within the Safari app.
2. Click on the Clear History menu at the bottom.
3. Choose the Time range from the drop-down.
4. Hit the Clear History command button.
   It will delete the browsing history.

Select the most extended date range from the drop-down, probably before the Search Marquis takeover.

Bottom Line

The Safari browser is set to its default start page. However, malware can modify and replace settings within the app. We have to delete the unwanted extensions and clear the data that contains the injected scripts.

Similarly, there has been an issue with Yahoo, and Bing redirects in the Safari app, which follows a similar pattern to Search Marquis malware.