DuckDuckGo has changed to bing and won't change back!

[Jonzjob]

Hi folks. The Boss, SWMBO, was using our old late 2009 21 ½ iMac running 10.13.6 High Sierra. Safari 13.1.2. She did a search and noticed that the search engine has changed from DDGo to bing! She doesn't think she has done owt to change it and when I go into Safari Preferences, Search and change it back to DDGo it just comes back with bing!

We have never used bing and don't want to start now, so please can someone tell me what I'm doing wrong?

Edit : - Just to say that I have now also down a restart and it still will not change from bing.

 

[ferrarr]

Empty Safari cache and Quit out of Safari. Then hold Shift down then click on the Safari icon in your Dock.

 

[IWT]

Great advice from Bob.

I have an old iMac running High Sierra. Open Safari, then use the Keyboard shortcut - Command plus comma, to enter Safari Preferences.

Now Click on Search engine. From the dropdown, choose DDG.

The options are:

Google
Yahoo
Bing
DuckDuckGo

Problem solved?

Ian

 

[Jonzjob]

Cache cleared and instructions followed Bob, but sorry mate it's still coming up with bing on an attempted change. It stays on bing which ever of the other selections tried.

It's time for my beauty sleep (lots needed!) so I will see what I can do on the morrow. Meanwhile SWMBO is going to be reet chuffed with me after loosing the tabs she had open

 

[IWT]

Have you tried what I suggested in Post #3?

Ian

 

[Randy B. Singer]

Hi folks. The Boss, SWMBO, was using our old late 2009 21 ½ iMac running 10.13.6 High Sierra. Safari 13.1.2. She did a search and noticed that the search engine has changed from DDGo to bing! She doesn't think she has done owt to change it and when I go into Safari Preferences, Search and change it back to DDGo it just comes back with bing!

You almost certainly are infected with Search Marquis adware. Unfortunately, to the best of my knowledge, no anti-virus or anti-adware utilities (e.g. VirusBarrier, Malwarebytes, etc.) will fix this problem. You need to fix it manually.

You need to delete any and all browser extensions related to Search Marquis and reset your browser settings.

In Safari --> Safari menu --> Preferences --> Extensions tab --> remove any extensions that you aren't 100% sure that you installed volitionally

In addition, you need to clear out all entries in ~/Library/Saved Application State
I have found this is a constant source of recurring and returning issues you though were mitigated.
To get to the User Library go into the Finder, hold down the Option key, and open the Go menu.

Reset your preferred search engine and home page in Safari.

You may also need to check for Profiles and Proxies and Launch Daemons and Launch Agents and Login items in System Preferences.

It might be worthwhile to run objective-see.com’s Knock-Knock (free) app to find things lurking in persistent places.
https://objective-see.org/products/knockknock.html

There are several Web sites that detail how to deal with Search Marquis. Unfortunately they are all shill sites that want to sell you anti-virus products that you don't need and which won't help you in this instance. However, if you can keep from being scammed into buying something, they all have helpful information on how to remove Search Marquis manually:

https://cybernews.com/malware/how-to-remove-search-marquis-on-mac/

https://macpaw.com/how-to/remove-search-marquis-from-mac
This is, unfortunately, a shill site for CleanMyMac, which you should NOT download or purchase

https://www.safetydetectives.com/blog/how-to-remove-search-marquis/

 

[Jonzjob]

Have you tried what I suggested in Post #3?

Ian

Sorry Ian, I was ½ asleep and forgot to put in that I had tried your suggestions but it didn't make any difference. That's a handy shortcut to get to Safari settings and I had no idea it existed. Thank you for that.

At least it's a known problem Randy and ta for posting it. I have printed your reply so I can work my way through it.

Is there any known reason how it infects? And are there other drawbacks from it being on the system other than bing probably passing on info on us that it probably shouldn't have in the first place?

We had planed to get rid of the old machine over a year ago, but somehow haven't got around to it

Our M1 iMac is fine by the way.

 

[Randy B. Singer]

Sorry Ian, I was ½ asleep and forgot to put in that I had tried your suggestions but it didn't make any difference.

Search Marquis installs components that make it persistent, even if you attempt to change your search engine preferences.

Is there any known reason how it infects? And are there other drawbacks from it being on the system other than bing probably passing on info on us that it probably shouldn't have in the first place

It usually shows up bundled with software that you download from third party software downloading sites such as MacDownload. It is highly recommended that you only download software either from Apple's App Store or directly from the developer of your software.

It's adware, it doesn't do anything overtly malicious. The bad guys designed it so that they get paid for visits to pay-per-view Web sites that Search Marquis routs your searches through.

What is Search Marquis? - Mac Research

Search Marquis Removal from Mac (Safari/Chrome)

Search Marquis is a fake, rogue search engine site that takes over Mac browsers with the help of a browser-hijacking component.

macresearch.org

 

[Jonzjob]

Thank you for the explanation Randy. I can't remember any software being downloaded to our old iMac? So if that is how it got there then it must have been there for a while un-noticed for quite a while?

I don't normally use the old iMac, just the new one, except if/when SWMBO has any problems with it and I will do my best not to get our new Mac into this situation.

Until I can get time to sort this would it be better for us to use Firefox or Waterfox? We are familiar with both and used them both until we got our new Mac. I suppose that what I am asking is has it only infected Safari or will it have got into Firefox and Waterfox at the same time?

 

[Randy B. Singer]

I suppose that what I am asking is has it only infected Safari or will it have got into Firefox and Waterfox at the same time?

Some of the links that I gave you describe how to remove Search Marquis from browsers other than Safari. So I'm guessing that they suspect that it can infect other browsers than Safari. However, I've never heard from anyone who was infected with Search Marquis that wasn't using Safari. You can reach your own conclusions.

Whichever browser you go with, it would be a good idea to check what extensions are installed in it periodically, and if you find any that you didn't put there yourself, you should immediately delete them.

 

[Jonzjob]

I have just opened Firefox and that has come up clear of Search Marquis. So that's being used until I can get rid of SM.

I'll let you know how I get on and once again, thank you all for being such stars!

 

[pm-r]

I have just opened Firefox and that has come up clear of Search Marquis. So that's being used until I can get rid of SM.

Here's a link to some hits for suggestions to delete "Search Marquis" stuff if you need some help:

Google Search

Also, Integro says they're free VirusBarrier can remove the Search Marquis redirect stuff:

https://support.intego.com/hc/en-us/articles/6014348598418-How-to-Remove-SearchMarquis-for-Mac#:~:text=First%2C%20open%20System%20Preferences%20and,options%20checked%20within%20the%20list.

Their VirusBarrier should be available in the Apple Store with a free download.

And another removal method:

https://malwaretips.com/blogs/remove-search-marquis-mac/#mac

- Patrick
=======