Search Marquis is a macOS browser hijacker that changes your search engine and new tab settings without permission. It often bundles with free software and can redirect searches to advertising domains, making your browsing slower and less secure.
This guide walks you through identifying, removing, and preventing Search Marquis on your Mac. The steps focus on manual cleanup and verified tools to restore your default browser behavior.
| Component | Role in macOS | Impact if Infected | Common Signs |
|---|---|---|---|
| Browser Extensions | Add functionality to Safari, Chrome, and Firefox | Can inject ads and hijack search settings | New unknown extensions appear |
| Login Items | Launch apps automatically on user login | Unwanted apps start with your session | Longer login time, unfamiliar apps running |
| Configuration Profiles | Manage device settings and policies | Forced browser changes and restrictions | Profiles installed with unknown names |
| Launch Agents | Run scripts or processes in background | Persistent hijacker processes | Unexpected background activity |
| System Preferences | Control core macOS behavior | Rarely modified by hijackers | Unusual permission changes |
Identifying Search Marquis in Applications
Search Marquis often installs itself as a seemingly legitimate app like "Helper.app" or "MediaPlugin.app" inside the Applications folder. These apps rarely open directly but run background processes that alter browser settings.
Check suspicious app details
Right-click any questionable app, choose Open, and review permissions. If the app requests accessibility or browser access without clear reason, it is likely part of the hijacker chain.
Removing Search Marquis Extensions
Browser extensions are a primary way Search Marquis modifies your search and new tab pages. Removing them stops redirects and restores normal navigation.
Safari
Open Safari Preferences, go to Extensions, and disable or remove any unknown extensions. Confirm removal and reset your default search engine in Preferences > Search.
Google Chrome
Type chrome://extensions in the address bar, locate suspicious entries, and click Remove. Also check Settings > Search engine to reset your provider to a trusted option.
Mozilla Firefox
In Firefox, open Add-ons > Extensions, remove unknown add-ons, and reset your homepage and search under Preferences. Restart Firefox to ensure changes take effect.
Cleaning Login Items and Launch Agents
Login items and launch agents can restart the hijacker each time you log in. Disabling these entries prevents automatic reinfection.
Login Items
Go to System Settings > Users & Groups, select Login Items, and remove any unfamiliar applications. For hidden entries, open Terminal and run commands to list current items.
Launch Agents and Launch Daemons
Check ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons for unknown plist files. Move suspicious files to quarantine instead of deleting them immediately, in case you need to review them later.
Checking Configuration Profiles and Certificates
Configuration profiles can enforce browser settings and block normal changes. Removing them restores full control over your macOS browser configuration.
Profiles
Open System Settings > Privacy & Security > Profiles, select any unknown profile, and remove it. If no profile appears, your device is likely unaffected.
Certificates
Access System Settings > Privacy & Security > Certificates, and delete any untrusted root certificates. Confirm removal and restart browsers to clear cached security policies.
Securing Your Mac After Search Marquis Removal
Ongoing vigilance reduces the chance of reinfection and keeps your browsing fast and trustworthy.
- Only install apps from the Mac App Store or verified developers
- Decline optional offers during software installation to avoid bundled components
- Review Login Items and Profiles regularly in System Settings
- Keep macOS and browsers updated to patch security vulnerabilities
- Use reputable security software for real-time scanning and alerts
FAQ
Reader questions
Why does my search engine keep reverting after manual removal?
A remaining launch agent or configuration profile is likely restoring the hijacker settings. Re-run the full removal checklist and verify that all suspicious entries are cleared.
Can Search Marquis damage my Mac or steal data?
It usually does not destroy files, but it can expose you to tracking, unwanted redirects, and potentially bundled adware that collects browsing habits and personal details.
Should I delete app files manually after moving them to quarantine?
Once you confirm the app is not required, securely empty the quarantine folder and check associated plist files in Library folders to ensure complete removal.
Is it safe to reset all browser settings to default?
Yes, resetting clears extensions, search engines, and startup pages, which is safe if you back up important site preferences. It is the quickest way to eliminate leftover hijacker code.