The Search Marquis is a browser hijacker that automatically changes the default search engine to a malicious search site.
To remove it from the Safari app, you must force quit the browser, end suspicious activity using Activity Monitor, uninstall the unknown extension, and clear browsing data for a complete cleanup.
In this guide, we have shared the steps to remove the Search Marquis malware from the Safari browser.
On this page, you can find and jump to:
Step 1: Force Quit the Safari app
If your Safari browser is already running, the first thing you need to do is quit it. If you usually have trouble closing it, you must force quit the browser.
- Click on the Apple
logo for options. - From the options list, click on Force Quit… (another way is to press the + + key).
- Force Quit Applications window will pop up.
- Then select the Safari app within the window.
- Hit on button and close the window.
It will close the Safari browser from the background and terminate all running process threads.
Step 2: Find and Delete Malicious Files
Open Activity Monitor by launching it from the Finder. Navigate to Application > Utilities > Activity Monitor.
You can also use the Spotlight Search to find it.
Within the Activity Monitor window, analyze all the unknown processes. Do this for all processes you think are part of hijacking and quit the malicious process.
Step 3: Check Browser and Prevent Hijacking
Now that we have cleared the closed the browser and hijacked processes, we will check if everything works.
- Press the key while relaunching Safari.
Pressing the shift key will prevent the previously opened pages from relaunching in Safari. - You can release the shift key once Safari is safely launched.
If you still need help, you must take additional steps.
- Force quit Safari again.
- Turn off the WiFi connection from the Mac’s menu.
- Disconnect the ethernet cable if you use an ethernet connection.
It will kill the connection between the malware software and the browser.
Step 4: Delete Marquis Search Extensions
There is a high chance that an unknown browser extension replaced the default search engine. You should identify and delete the extensions from the Safari browser.
You could find an extension named ‘Search Marquis,’ which you should uninstall.
- Launch the Apple Safari app on your Mac computer.
- Click on the Safari menu from the menu bar at the top, and select Settings… sub-menu.
It will open the Safari Settings window. - Switch to the Extensions tab in the Settings window.
It will display the list of all the Safari extensions installed. - Uncheck the checkbox in the left pane to Disable the extension.
- Click the button.
It will remove the extension and also delete all malicious activity.
However, if you are unsure which extension to remove, you can disable the checkbox for all extensions until the issue is resolved.
Step 5: Clean up Browser Settings and Data
Now that we have rectified the issue that caused it, it is important to clear and remove any unwanted scripts left in browser storage that caused the malware injection in the first place.
Clear Website Data from the Safari app
The first thing we need to do is delete all browsing data so that no traces are left in the browser. Clearing the website data will also delete all the storage, cookies, and cache.
- Launch the Safari app on your Mac computer.
- Click on the Safari menu from the menu bar and select the Settings… sub-menu.It will open the Safari Settings window.
- Switch to the Privacy tab and click to open the button.
It will load the list of websites currently storing the cache and cookies in the browser. - Hit on the command and then the button.
It will flush the cookies and cache for all sites.
Reset the Default Homepage
Next, we will ensure the default Homepage is set correctly on the Safari browser. We just wanted to ensure the Marquis search differs from the browser’s homepage.
- Launch the Safari app.
- Click on the Safari menu and select the Settings… sub-menu.
- Select the General tab in the Settings window.
- Check if your Homepage field is the same as you have entered.
If something else, change it to whatever you want to see first when you open the Safari app—preferably a search engine like Google or Bing. You can also leave it as Safari’s default start page.
Clear Browsing History
Lastly, we will delete all the browsing history so you won’t accidentally open a problematic web page again.
- Go to the History from the menubar within the Safari app.
- Click on the Clear History menu at the bottom.
- Choose the Time range from the drop-down.
- Hit the command button.
It will delete the browsing history.
Select the most extended date range from the drop-down, probably before the Search Marquis takeover.
Bottom Line
The Safari browser is set to its default start page. However, malware can modify and replace settings within the app. We have to delete the unwanted extensions and clear the data that contains the injected scripts.
Similarly, there has been an issue with Yahoo, and Bing redirects in the Safari app, which follows a similar pattern to Search Marquis malware.
Lastly, if you've any thoughts or feedback, then feel free to drop in below comment box. You can also report the outdated information.
How do I know what I should stop in my activity monitor?
I tried all of these steps and they didn’t work because it said I had no extensions. I found an application online called CleanMyMacX, downloaded the free trial, they scanned my Mac and detected potentially malicious viruses, and gave me the option to remove them. Now search marquis is gone. Hope that helps.
Thanks for the recommendation, James! Do this free trial requires registering an account?
This is how i got rid of this menace.
check if you see this process in your Activity Monitor : LearningNumbers-GamesforKids2
When i tried to kill using kill -9 it just came back up.
Next, go to the folder : /Users/Library/Application Support/ :
Do you see any folder CarbonCopyCloner5 ? If you do, move it to the Trash.
Try to fore quit any LearningNumbers-GamesforKids2 processes. This procedure helped me get rid of searchMarquis on my iMac.
All the best
i have tried every thing suggested…and open empty pages and black histories…but it is like the cat that keeps coming back…i am going to quit using mac…go with samsung
Helped me a lot brother. Thanks a lot…
I don’t understand what I am looking for I. Activity monitor. I’m not sure what looks suspicious and what doesn’t.
You can check for the app or program running in the Activity Monitor that you’ve not installed or readily available with macOS.
This instruction helped me get rid of Marquis when nothing else I’ve seen worked! Thank you!
All these steps don’t work. I created a new user and transfered all my data from the infected user and deleted it. Thank me later when u try this
Perfect, that should be the last attempt to get rid of Search Marquis in Macbook. I would also suggest trying Safari browser alternatives.
what do you you mean by “new user”? thank u in advance.
Hi Nada, the “new user” means the new user login on MacBook. You can create new users under the Users and Group settings page.
everything I try doesn’t seem to work. I’m so frustrated.
I tried everything.then as a last resort I upgraded to Catalina os from Sierra now no problems. but download from app store. the first time i tried it was from apple link didn’t complete .
I’ve gone through this and other tutorials. Nothing seems to work. What am I looking for in the activity monitor? Can’t seem to find anything sticking out as malicious?
Hello Lesham, If there is nothing suspicious in the Activity monitor, then skip the last steps where you need to clean up the browser data and set a default home page. Also, make sure to have the right search engine setup in the Safari browser.