Content:
Since searchmarquis.com is a component of a wide-sweeping Bing redirect campaign targeting Mac computers, the browser hijack should be addressed immediately.
| Virus Summary | |
|---|---|
| Name | Search Marquis (searchmarquis.com) |
| Species | Mac redirect virus / adware / PUA |
| IP Address | 13.224.11.6 |
| Impact | Redirects Safari, Google Chrome, and Mozilla Firefox to Bing.com; displays “Your computer is low on memory” fake alerts |
| Spreading Methods | App bundles, tech support scams |
| Risk Level | Moderate |
| Persistence | High |
| Removal Tool | Download Now |
Macs were a nearly malware-free territory a decade ago. There were hardly any threats potent enough to get around the user authorization barriers and the built-in protection mechanisms. Fast forward to present day, and the big picture has changed dramatically. Machines running macOS are being constantly shelled by adware, fake optimization utilities, and even relatively exotic pests such as coin miners and ransomware. The former two categories prevail over the rest in this landscape. Search Marquis is a demonstrative example of this trend, acting as a browser hijacker that intercepts and reroutes a victim’s web traffic in a forcible way. Similarly to another redirect nasty from the same lineage called Search Baron, it imposes rogue browsing preferences to fling a victim’s Internet activities to searchmarquis.com first, then through a series of URLs, including searchbaron.com and us-west.2.elb.amazonaws.com, all to the way to the final-stage landing page.
Counterintuitively, the resulting site isn’t a malicious resource with exploits or suchlike sneaky entities onboard. Instead, it’s a legitimate page whose good reputation is out of the question. Believe it or not, the Search Marquis virus redirects to bing.com custom results whenever the victim enters keyword requests in the address bar. Incidentally, the infection manifests itself in an identical way on Safari, Google Chrome, and Mozilla Firefox. The involvement of reputable services in clearly malicious traffic reorganization schemes is a long-running cybercrime tendency. Another wave of that kind is the Yahoo redirect hoax, which has also been wreaking havoc in the Apple ecosystem for years. What’s the whole point? One of the reasons why crooks add big names from the online search industry to their genre is that the attack then looks less unsettling. Another theory is that driving traffic to a hosted search service allows the malefactors to rake in some sort of an affiliate profit.
With that said, the pivot of the Search Marquis attack is all about redistributing Mac users’ web navigation vectors in a specific manner. The bulk of its operators’ interest lies in the realm of the transitional domains that are briefly displayed in the status bar of an affected browser during every single redirect instance. These pages are most likely integrated with monetization networks that reward all unique visits, especially ones emanating from Mac computers that are traditionally deemed high-end. To recap, the attack entails an annoying scenario where one’s preferred web browser is incessantly forwarded to searchmarquis.com and subsequently to bing.com via a number of interim sites.
Although the browser redirect activity is the most prominent facet of the Search Marquis raid, the breadth and depth of this exploitation goes somewhat further. In order to persist inside macOS, the culprit creates what’s called a configuration profile, or device profile, under System Preferences. This random-named entry is intended to control the web surfing side of computing by ensuring that the wrong search preferences persist even if the victim tries to edit them manually.
An extra flavor of the attack is the emergence of popup alerts that say, “Your computer is low on memory. To free up some memory, please close a few applications”. This is part of a brainwashing plan aimed at cross-promoting additional malware. In particular, the dubious applications being pushed through such a guileful trick are scareware utilities – moreover, these popups could be a clue that one of such nuisances is already up and running. It might have crept into the Mac along with the Search Marquis threat. A few examples of such pseudo-optimizers are Advanced Mac Tuneup, Mac Cleanup Pro, and Mac Auto Fixer. The low memory warnings are used to create an illusion that the system performance needs a boost, and the “cure” recommended by follow-up alerts is a fake.
The criminals behind this browser hijacker stick with a tried-and-tested distribution technique. The most common source of the contamination is a bundle of several applications that infiltrate systems alongside legit-looking software. The accompanying parasites aren’t mentioned in the installation client’s screens, and therefore users unknowingly agree to install the whole package while thinking that the only program they’re getting is a harmless one showcased in the default setup mode.
A stratagem that dominates these dirty spreading practices is the infamous fake Adobe Flash Player update campaign. It piggybacks on the general product awareness and the tactic it is normally employing to serve regular updates – that is to say, popup dialogs offering the new version. The perpetrators have learnt to mimic such popup recommendations. They appear on websites, either compromised or specially crafted malicious ones, and spread the likes of Search Marquis under the guise of must-install Flash Player updates. The next thing you know, the potentially unwanted application (PUA) gives the browsing settings an overhaul without permission and causes the redirect frenzy.
Although this threat manifests itself in the web browser only, it actually leaves a footprint across the system to maintain persistence. The subsection below will help you find and remove all the components of searchmarquis.com virus manually. Keep in mind that some of its files are a no-brainer to spot, while a few may be hidden so that the cleanup is harder to complete than in a typical software uninstall situation.
Uninstalling the harmful application is half the battle. It is a way to make sure that the symptoms won’t reappear after you implement the browser-level part of the repair. In the meanwhile, the searchmarquis.com redirect nasty continues to affect your preferred web browser and therefore you need to revert to the correct Internet surfing settings. Read the subsection below to find out how.
Thankfully, you needn’t reinvent the wheel in terms of invalidating the adverse tweaks caused by the Search Marquis virus in your browser. A tried-and-true technique is to reset the affected browser to its original defaults. On a side note, Apple has removed the “Reset Safari” button since the release of the Mac native browser’s version 9 back in 2015, so the procedure is now a bit more complex than a one-click experience (see below). Anyway, here’s a simple way to purge the most popular web browsers of the malicious influence:
Symptoms isolated to the browser are the tip of the iceberg. Search Marquis redirect virus and its associated malware can gain a foothold in the Mac beyond redirect activity alone. The drawback of manual removal is that there might be hidden leftovers of the threat that will reinstall it after what seems to be a successful cleanup. This isn’t necessarily the case, but you may want to double-check if you are in the clear.
Consider scanning your Mac with Combo Cleaner, an optimization and security app with a decent track record. It’s lightweight, and it can detect all prevalent forms of Mac malware in a snap. Here’s the how-to:
By downloading any software provided on this website you consent to the provisions listed in our Privacy Policy and Terms of Use. Be advised that Combo Cleaner scan is free, but you will have to buy its full (Premium) version to enable the virus removal feature.
Exposure management is changing the way we assess risk, but not everyone is out in… Read More
Introduction: Navigating the SOCaaS Revolution In today's hyperconnected digital landscape, where cyber threats evolve faster… Read More
The Middle East and Asia are fast-growing hubs for both digital innovation and cyber threats,… Read More
In Europe, digital forensics and incident response firms operate within a complex landscape shaped by… Read More
The United States is home to many of the world’s leading digital forensics and incident… Read More
Third-party vendors have transformed operations for many entities. Tasks like payroll, shipping logistics, and IT… Read More
