angloargie
Level 1 (8 points)
Desktops

Q: Trovi unwanted adds and heuristics phishing

Can someone please advise me ?I noticed today that i have been getting lots iof adds sliding in from bothe sides and the bottom of each web page I open.I alsonoticed a new search engine caled Trovi appeared despite the default being set on Google.I then used ClamXav to scan for virus and the only one that came up was this heuristics phishing, the path associated with it is- Users/my name/Library/Thunderrbird?Profiles/99lyvfqs.default/ImapMail/imap.talktalk.net? INBOX.sbd/Sent .I ahve no idea what i shopuld do nexct to rectify the situation so could you please advise me .Thanks

AppleTV 2, Mac OS X (10.7.4)

Posted on May 4, 2014 11:38 AM

by MadMacs0,Solvedanswer
MadMacs0 MadMacs0
Level 5 (4,791 points)
A:

Great!

Posted on May 6, 2014 11:01 PM

Close
angloargie

Q: Trovi unwanted adds and heuristics phishing

  • All replies
  • Helpful answers

Previous Page 2 of 3 last Next

  • by angloargie,

    angloargie angloargie May 6, 2014 12:37 AM in response to angloargie
    Level 1 (8 points)
    Desktops
    May 6, 2014 12:37 AM in response to angloargie

    if i open a new window Trovi appears but if a highlight some text in an existing window amd  right click , then the default search engine appears. Seems odd to me

  • by MadMacs0,

    MadMacs0 MadMacs0 May 6, 2014 12:55 AM in response to andyBall_uk
    Level 5 (4,791 points)
    May 6, 2014 12:55 AM in response to andyBall_uk

    andyBall_uk wrote:

     

    I would also remove the ... amazon wishlist Safari extensions

    That would appear to be legit. The Spigot one is called "amazon shopping assistant".

  • by MadMacs0,

    MadMacs0 MadMacs0 May 6, 2014 1:18 AM in response to angloargie
    Level 5 (4,791 points)
    May 6, 2014 1:18 AM in response to angloargie

    This one seems to still be a mystery. It poped up about a month ago. This page indicates that it's distributed by their partner sofware distributers.

     

    Try selecting "Reset Safari" from the Safari menu.

     

    Do you recognize all the Extensions you have installed? That's at least one way of overriding the search engine.

     

    TuneUpMyMac has a really bad reputation with a lot of negative comments here on WOT.

     

    Uninstall instruction from the site say to

    • Launch TuneupMyMac and click on Help > Uninstall TuneupMyMac option.

    Uninstall_1.jpg

    • A dialog box will appear asking your confirmation. Click on 'Yes' button to uninstall TuneupMyMac.Uninstall_2.jpg
    • For security reasons, you will be asked to enter your Mac user password. Enter your Mac user password and click on the OK button.Uninstall_3.jpg
    • This will uninstall TuneupMyMac from your Mac.

     

    but note that users reported that it was difficult to uninstall, so that might not get everything.

  • by andyBall_uk,

    andyBall_uk andyBall_uk May 6, 2014 3:22 AM in response to angloargie
    Level 7 (20,495 points)
    May 6, 2014 3:22 AM in response to angloargie

    Set the Safari - Preferences - Extensions switch to off. Then restart Safari.

    If that helps, switch them back on & disable them all via the checkboxes, re-enabling until you find the culprit.

  • by angloargie,

    angloargie angloargie May 6, 2014 6:33 AM in response to andyBall_uk
    Level 1 (8 points)
    Desktops
    May 6, 2014 6:33 AM in response to andyBall_uk

    unfortunately switching Extensions to off  and restarting safari

    doesnt get rid of Trovi either

  • by angloargie,

    angloargie angloargie May 6, 2014 6:41 AM in response to MadMacs0
    Level 1 (8 points)
    Desktops
    May 6, 2014 6:41 AM in response to MadMacs0

    I got rid of TuneupMyMac last night but i think I must have  dragged into trash rather than uninstalling.Should I reinstall it then uninstall it as you have shown?

  • by andyBall_uk,

    andyBall_uk andyBall_uk May 6, 2014 6:41 AM in response to angloargie
    Level 7 (20,495 points)
    May 6, 2014 6:41 AM in response to angloargie

    You removed tuneupmymac ?.

     

    Exactly when do you see trovi ? : only when opening a new window/tab ?.

    If so, is it set as a homepage in safari - Preferences - General ?.

     

    Is trovi shown at Safari - Preferences - General - Default search engine ?.

     

    Look at System Preferences - Network - Advanced - DNS - DNS servers  & report the numbers that are there.

  • by angloargie,

    angloargie angloargie May 6, 2014 11:23 AM in response to andyBall_uk
    Level 1 (8 points)
    Desktops
    May 6, 2014 11:23 AM in response to andyBall_uk

    I did remove TuneUpMymac from the applications list but I see its still there on the second Etrecheck I made after the alterations suggested to me, so i am not sure How i cam get rid of it all together

     

    I see trovi every time i open a new window and not when i highlight some text on a  web page and right click on it.When i do that I get the default searh engine, which is Google

     

    DNS servers are -192.168.1.1

                                  0.0.0.0

  • by Old Toad,

    Old Toad Old Toad May 6, 2014 12:02 PM in response to angloargie
    Level 10 (141,223 points)
    Mac OS X
    May 6, 2014 12:02 PM in response to angloargie

    Download and run Find Any File to search for any file with "Trovi" in it's name.

     

    FAF can search areas that Spotlight can't like invisible folders, system folders and packages. If there's a file hiding somewhere on your hard drive with Trovi in the file name FAF will find it.

     

    If you find any that shouldn't be there you can drag it from the search results window to the Desktop.

     

    OT

  • by MadMacs0,

    MadMacs0 MadMacs0 May 6, 2014 12:12 PM in response to angloargie
    Level 5 (4,791 points)
    May 6, 2014 12:12 PM in response to angloargie

    angloargie wrote:

     

    I did remove TuneUpMymac from the applications list but I see its still there on the second Etrecheck I made after the alterations suggested to me, so i am not sure How i cam get rid of it all together

    I'm not sure either, but re-install, un-install IAW the instructions they provide would be my first suggestion. We can easily get rid of that one item that EtreCheck shows, but there may well be more. I analyzed the installer, but there's obviously more to it than that.

    DNS servers are -192.168.1.1

                                  0.0.0.0

    Not sure why there's a 0.0.0.0 as I think that's meaningless, but the 192.168.1.1 looks to correctly be your router.

     

    One possibility is that your router has been compromised and is no long pointing to your ISP's DNS server. I don't really see how that would cause what you are seeing, but read through How to manage a hacked wireless router.

  • by angloargie,

    angloargie angloargie May 6, 2014 12:51 PM in response to Old Toad
    Level 1 (8 points)
    Desktops
    May 6, 2014 12:51 PM in response to Old Toad

    I have list of 15

     

    file:///private/var/db/BootCaches/A9E21FB9-1783-4E29-81E1-E44F038C4604/app.com.t uneupmymac.TuneupMyMac.playlist

    file:///private/var/db/BootCaches/C72DD9A9-62D8-49E8-BDDD-078EC1B799B9/app.com.t uneupmymac.TuneupMyMac.playlist

    file:///private/var/db/receipts/com.tuneupmymac.TuneupMyMac.pkg.bom

    file:///private/var/db/receipts/com.tuneupmymac.TuneupMyMac.pkg.plist

    file:///Users/michaeldennis/Library/Saved%20Application%20State/com.tuneupmymac. TuneupMyMac.savedState/

    file:///Users/michaeldennis/Library/Caches/Metadata/Safari/History/http:%252F%25 2Fwww.tuneupmymac.com%252F.webhistory

    file:///Users/michaeldennis/Library/Caches/Metadata/Safari/History/http:%252F%25 2Fwww.tuneupmymac.com%252Fafterinstall%252F%3Futm_source=macsite&utm_content=&ut m_term=&utm_campaign=macsite&utm_medium=&affiliateid=&x-at=.webhistory

    file:///Users/michaeldennis/Library/.Caches%20-%20TTS%20DEACTIVATED/Metadata/Saf ari/History/http:%252F%252Fwww.tuneupmymac.com%252Fafterinstall%252F%3Futm_sourc e=mm&utm_content=&utm_term=&utm_campaign=mm&utm_medium=&affiliateid=&x-at=.webhi story

    file:///Users/michaeldennis/Library/Caches/Metadata/Safari/History/http:%252F%25 2Fwww.tuneupmymac.com%252FDownloadNow.asp.webhistory

    file:///Users/michaeldennis/Library/.Caches%20-%20TTS%20DEACTIVATED/Metadata/Saf ari/History/http:%252F%252Fwww.tuneupmymac.com%252FDownloadNow.asp%3Futm_source= mm&utm_campaign=mm&utm_medium=.webhistory

    file:///Users/michaeldennis/Library/.Caches%20-%20TTS%20DEACTIVATED/Metadata/Saf ari/History/http:%252F%252Fwww.tuneupmymac.com%252Fmm%252F%3Futm_source=mm&utm_c ampaign=mm&ce_cid=20u.XH0F1pV9ftPJ1t2OxG1wD4tk000..webhistory

    file:///Users/michaeldennis/Library/.Caches%20-%20TTS%20DEACTIVATED/Metadata/Saf ari/History/http:%252F%252Fwww.tuneupmymac.com%252Fmm%252F%3Futm_source=mm&utm_c ampaign=mm&ce_cid=20u.XH0F1pV9ftPJ1t2OxG1wD5JH000..webhistory

    file:///Users/michaeldennis/Library/Caches/Metadata/Safari/History/https:%252F%2 52Fwww.google.co.uk%252Fsearch%3Fclient=safari&rls=en&q=TuneUpMymac&ie=UTF-8&oe= UTF-8&gfe_rd=cr&ei=4jlpU9TsB8vR8gf684BQ.webhistory

    file:///Users/michaeldennis/Library/Application%20Support/CrashReporter/TuneupMy Mac_D9219809-2369-5890-A771-1CD9D76AE730.plist

  • by angloargie,

    angloargie angloargie May 6, 2014 12:55 PM in response to angloargie
    Level 1 (8 points)
    Desktops
    May 6, 2014 12:55 PM in response to angloargie

    that looks a mess. The FAF result looks much simpler than that 5 documents , one folder and hte rest safari history items.Woulcmnt the simplets thing to do be to delete the whole list?

  • by MadMacs0,

    MadMacs0 MadMacs0 May 6, 2014 1:02 PM in response to angloargie
    Level 5 (4,791 points)
    May 6, 2014 1:02 PM in response to angloargie

    I thought you were looking for Trovi.

     

    The TuneUpMyMac files you found are all "cache" and one crash report, so of no consequence.

     

    The entry in Login Items can easily be cleared by opening System Preferences->Users & Groups->Login Items tab for your username. Highlight TuneUpMyMac (which should now have a yellow ▲ next to it) and click the minus "-" button at the bottom to delete it.

     

    Do one more search with Find Any File, but this time hold the opetion key down and click the "Find All" button then enter your admin password. This will seach folders you would not normally have access to.

  • by angloargie,

    angloargie angloargie May 6, 2014 2:25 PM in response to MadMacs0
    Level 1 (8 points)
    Desktops
    May 6, 2014 2:25 PM in response to MadMacs0

    no I was just trying it .I shall attempt to  remove Trovi now This is the result Now I tried to Move to trash but the list is still there

     

    file:///Users/michaeldennis/.Trash/http:%252F%252Finfo.trovi.com%252F.webhistory

    file:///Users/michaeldennis/.Trash/http:%252F%252Fwww.bing.com%252Fsearch%3Fq=ho w%252520can%252520i%252520remove%252520trovi%252520from%252520my%252520computer& pc=conduit&ptag=AE2E3E1771C47462C9DF&form=CONMHP&conlogo=CT3210127.webhistory

    file:///Users/michaeldennis/.Trash/http:%252F%252Fwww.bing.com%252Fsearch%3Fq=ho w+can+%252560i+remove+trovi+virus+from+iMac&go=Submit&qs=n&form=QBRE&pq=how+can+ %252560i+remove+trovi+virus+from+imac&sc=0-21&sp=-1&sk=&cvid=1e329ec568d046acb87 c3b3959ddb467.webhistory

    file:///Users/michaeldennis/.Trash/http:%252F%252Fwww.bing.com%252Fsearch%3Fq=ho w+can+i+remove+trovi+from+my+Mac&go=Submit&qs=n&form=QBRE&pq=how+can+i+remove+tr ovi+from+my+mac&sc=0-31&sp=-1&sk=&cvid=67f0ec4022514dbf9124ed4a0be068ed.webhisto ry

    file:///Users/michaeldennis/.Trash/http:%252F%252Fwww.bing.com%252Fsearch%3Fq=tr ovi&pc=conduit&ptag=AE2E3E1771C47462C9DF&form=CONMHP&conlogo=CT3210127.webhistor y

    file:///Users/michaeldennis/.Trash/http:%252F%252Fwww.bing.com%252Fsearch%3Fq=Tr ovi+Virus&FORM=QSRE4.webhistory

    file:///Users/michaeldennis/.Trash/http:%252F%252Fwww.trojan-killer.co.uk%252Fin structions-to-remove-trovi-com-malware%252F.webhistory

    file:///Users/michaeldennis/.Trash/https:%252F%252Fdiscussions.apple.com%252F%25 2Fterms-and-conditions!input.jspa%3Furl=https%2525253A%2525252F%2525252Fdiscussi ons.apple.com%2525252Fquestion-choose%25252521input.jspa%2525253FcontentType%252 5253D1%25252526question%2525253Dtrovi%2525252520virus.webhistory

    file:///Users/michaeldennis/.Trash/https:%252F%252Fdiscussions.apple.com%252Find ex.jspa%2523%252Fask%252Ftrovi%252520virus.webhistory

    file:///Users/michaeldennis/.Trash/https:%252F%252Fdiscussions.apple.com%252Fmes sage%252F25658987%3FsearchText=trovi%252520virus%252325658987.webhistory

    file:///Users/michaeldennis/.Trash/https:%252F%252Fdiscussions.apple.com%252Fpos t!input.jspa%3Fcontainer=2034&containerType=14&question=trovi+virus.webhistory

    file:///Users/michaeldennis/.Trash/https:%252F%252Fdiscussions.apple.com%252Fque stion-choose!input.jspa%3FcontentType=1&question=trovi%252520virus.webhistory

    file:///Users/michaeldennis/.Trash/https:%252F%252Fdiscussions.apple.com%252Fsea rch.jspa%3FpeopleEnabled=true&userID=&containerType=&container=&spotlight=false& showOnlyAnswered=true&q=trovi.webhistory

    file:///Users/michaeldennis/.Trash/https:%252F%252Fwww.google.co.uk%252F%2523q=h ow+can+i+remove+trovi+from+my+Mac.webhistory

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-570.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-708.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-716.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-718.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-735.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-756.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-758.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-759.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-764.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-766.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-767.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-769.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-771.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-779.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-782.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-783.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-785.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-786.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController%2022-22-48-787.nib

    file:///Users/michaeldennis/.Trash/SWiFiIntroViewController.nib

     

    although I see the word trash appears as well

  • by angloargie,

    angloargie angloargie May 6, 2014 2:27 PM in response to angloargie
    Level 1 (8 points)
    Desktops
    May 6, 2014 2:27 PM in response to angloargie

    just opened a new window and trovi is still there.thius is very puzzling.Maybe as you suggested its a router issue

Previous Page 2 of 3 last Next