Skip to content

Remove Search Marquis from Safari app on Mac

The Search Marquis is a browser hijacker that automatically changes the default search engine to a malicious search site.

To remove it from the Safari app, you must force quit the browser, end suspicious activity using Activity Monitor, uninstall the unknown extension, and clear browsing data for a complete cleanup.

searchmarquis homepage

Step 1: Force Quit the Safari app

If your Safari browser is already running, the first thing you need to do is quit it. If you usually have trouble closing it, you must force quit the browser.

  1. Click on the Apple apple logo logo for options.
  2. From the options list, click on Force Quit… (another way is to press the Cmd + Option + Esc key).
    Apple macOS System Preferences
  3. Force Quit Applications window will pop up.
  4. Then select the Safari app within the window.
  5. Hit on Force Quit button and close the window.

It will close the Safari browser from the background and terminate all running process threads.

Step 2: Find and Delete Malicious Files

Open Activity Monitor by launching it from the Finder. Navigate to Application > Utilities > Activity Monitor.

Activity Monitor Location

You can also use the Spotlight Search to find it.

Activity Monitor in Spotlight Search on Mac

Within the Activity Monitor window, analyze all the unknown processes. Do this for all processes you think are part of hijacking and quit the malicious process.

info icon
Note: Be extremely careful while deleting files or quitting the process. You may damage your system if you delete the wrong file.

Step 3: Check Browser and Prevent Hijacking

Now that we have cleared the closed the browser and hijacked processes, we will check if everything works.

  1. Press the shift key while relaunching Safari.
    Pressing the shift key will prevent the previously opened pages from relaunching in Safari.
  2. You can release the shift key once Safari is safely launched.

If you still need help, you must take additional steps.

  1. Force quit Safari again.
  2. Turn off the WiFi connection from the Mac’s menu.
  3. Disconnect the ethernet cable if you use an ethernet connection.

It will kill the connection between the malware software and the browser.

Step 4: Delete Marquis Search Extensions

There is a high chance that an unknown browser extension replaced the default search engine. You should identify and delete the extensions from the Safari browser.

You could find an extension named ‘Search Marquis,’ which you should uninstall.

  1. Launch the Apple Safari app on your Mac computer.
  2. Click on the Safari menu from the menu bar at the top, and select Settings… sub-menu.
    Apple Safari Settings menuIt will open the Safari Settings window.
  3. Switch to the Extensions tab in the Settings window.
    It will display the list of all the Safari extensions installed.
  4. Uncheck the checkbox in the left pane to Disable the extension.Uncheck Safari Extension to Disable in Safari browser
  5. Click the Uninstall button.

It will remove the extension and also delete all malicious activity.

However, if you are unsure which extension to remove, you can disable the checkbox for all extensions until the issue is resolved.

Step 5: Clean up Browser Settings and Data

Now that we have rectified the issue that caused it, it is important to clear and remove any unwanted scripts left in browser storage that caused the malware injection in the first place.

Clear Website Data from the Safari app

The first thing we need to do is delete all browsing data so that no traces are left in the browser. Clearing the website data will also delete all the storage, cookies, and cache.

  1. Launch the Safari app on your Mac computer.
  2. Click on the Safari menu from the menu bar and select the Settings… sub-menu.Apple Safari Settings menuIt will open the Safari Settings window.
  3. Switch to the Privacy tab and click to open the Manage Website Data… button.Manage Website Data button on Privacy tab in Safari macOS SettingsIt will load the list of websites currently storing the cache and cookies in the browser.
  4. Hit on the Remove All command and then the Done button.Remove All cache and cookies data stored in Safari MacIt will flush the cookies and cache for all sites.
info icon
Note: Clearing the cookies will log out of the online signed-in account, and you need to log in again.

Reset the Default Homepage

Next, we will ensure the default Homepage is set correctly on the Safari browser. We just wanted to ensure the Marquis search differs from the browser’s homepage.

  1. Launch the Safari app.
  2. Click on the Safari menu and select the Settings… sub-menu.Apple Safari Settings menu
  3. Select the General tab in the Settings window.
  4. Check if your Homepage field is the same as you have entered.
    General Settings Homepage URL in Safari

If something else, change it to whatever you want to see first when you open the Safari app—preferably a search engine like Google or Bing. You can also leave it as Safari’s default start page.

Clear Browsing History

Lastly, we will delete all the browsing history so you won’t accidentally open a problematic web page again.

  1. Go to the History from the menubar within the Safari app.
  2. Click on the Clear History menu at the bottom.
  3. Choose the Time range from the drop-down.
  4. Hit the Clear History command button.
    Clear History from Safari MacOS computerIt will delete the browsing history.

Select the most extended date range from the drop-down, probably before the Search Marquis takeover.

Bottom Line

The Safari browser is set to its default start page. However, malware can modify and replace settings within the app. We have to delete the unwanted extensions and clear the data that contains the injected scripts.

Similarly, there has been an issue with Yahoo, and Bing redirects in the Safari app, which follows a similar pattern to Search Marquis malware.

Please share the article if you find it helpful:

Disclosure: This page may contain affiliate links, which means we may receive compensation for your purchases; of course at no extra cost to you (indeed, you may get special discounts).
Kushal Azza

Kushal Azza

Kushal Azza is a Google Certified Analytics & IT Professional, Digital Content Creator, and Go-To Digital Marketer with an Engineering Degree. He has over a decade of experience solving tech problems, troubleshooting, and innovating digital solutions. Follow him on Twitter and LinkedIn.

17 comments and feedback

  1. I tried all of these steps and they didn’t work because it said I had no extensions. I found an application online called CleanMyMacX, downloaded the free trial, they scanned my Mac and detected potentially malicious viruses, and gave me the option to remove them. Now search marquis is gone. Hope that helps.

  2. This is how i got rid of this menace.

    check if you see this process in your Activity Monitor : LearningNumbers-GamesforKids2

    When i tried to kill using kill -9 it just came back up.

    Next, go to the folder : /Users/Library/Application Support/ :

    Do you see any folder CarbonCopyCloner5 ? If you do, move it to the Trash.

    Try to fore quit any LearningNumbers-GamesforKids2 processes. This procedure helped me get rid of searchMarquis on my iMac.

    All the best

  3. i have tried every thing suggested…and open empty pages and black histories…but it is like the cat that keeps coming back…i am going to quit using mac…go with samsung

    1. You can check for the app or program running in the Activity Monitor that you’ve not installed or readily available with macOS.

  4. All these steps don’t work. I created a new user and transfered all my data from the infected user and deleted it. Thank me later when u try this

      1. Hi Nada, the “new user” means the new user login on MacBook. You can create new users under the Users and Group settings page.

    1. I tried everything.then as a last resort I upgraded to Catalina os from Sierra now no problems. but download from app store. the first time i tried it was from apple link didn’t complete .

  5. I’ve gone through this and other tutorials. Nothing seems to work. What am I looking for in the activity monitor? Can’t seem to find anything sticking out as malicious?

Leave a thought or feedback

Please leave a descriptive comment or feedback with your real name. Our human moderator vets every comment, and it may take 24 to 48 hours to get published or rejected.
Your email address will not be published, and we will never spam your inbox. Required fields are marked *