wclodius
Level 1 (8 points)
Mac OS X

Q: How do I remove Trovi after doing the obvious

I acquired Trovi about a week ago. It quickly infected Firefox, Chrome, and Safari. I ran Adware Medic which claimed to move the files to Trash and emptied the Trash. Still present. I then got Adware Doctor and MalwareBytes Anti-Malware, ran them with no fix. I went to Linc Davis's site and followed his advice, found no extensions in any of the browsers, found no obvious files in /Library/LaunchAgents, /Library/LaunchDaemons, or ~/Library/LaunchAgents. I did find one file installed as root and removed it. The file was

~/Library/Application\ Support/Firefox/Profiles/15den4ak.default-1450036030435/searchplugins/

with contents

 

<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
<ShortName>Trovi</ShortName>
<Description>Trovi</Description>
<InputEncoding>UTF-8</InputEncoding>
<Image width="16" height="16">data:x-icon;base64,AAABAAEAEBAAAAAAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEA IAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAD///8B////Af///wH///8B////Af///wH///8B////Af// /wH///8B////Af///wH///8B////Af///wH///8B////Af///wH///8B////Af///wH///8B////Af// /wH///8B////Af///wH///8B////Af///wH///8B////Af///wH///8B////AbuEtUWcTpWfjjWGu55U mI/Bj7wD////AapnpHuON4exqGOiieTO4Sf///8B////Af///wH///8B////AbN1rHmEKHvrgx94/5Eq gv+EGHj/rm6pa7V6r1eGHnz/jCeA/38adf+VQYzNv4q5Tf///wH///8BwIu6V4stgNNuAGP/fxRw/5wn g/+hMYP/njiA/69po/usZKD5mS58/6EuhP+aJ4P/dQNn/2wAYf+vbaefzaTIG61rpqdhAFT/gBh1/6Er h/+bLXn/lEtr/6FffP+pYpj/qWKX/6FffP+VSG3/miN3/6Axif98FnL/WgBM/6NXmrP///8BsXSrYZ41 ifuaH3r/k0pr/5ZTb/+aTYT/dwht/3sQcf+dVYb/kk5p/5ZIb/+eIX//kyqB+axxqZe9ibgp////Adai yCmWFHf/lSd1/5JNaf+lZYb/jDF9/3IAaf95C3H/jzZ9/55ae/+VT2z/lSF1/5sigPP///8B////Af// /wGxVJrVigBr/5w3fP+UTmr/nlh9/5I+f/93BnD/fA50/5RCfv+bVHn/lU9t/5Mgc/95AFT/u2qno/// /wH///8BwHeuW7NPn22rXI+tkEhk/5VIcv+TQnT/jjOB/481gP+WSHj/lUtz/4xAYP+uWpXLt2CjpcqM u33///8B////Af///wH///8Bsn6VQX0kS/+NPWb/k0R0/5VHdv+URnX/jjxt/4MsVv+DL1X/4svZKf// /wH///8B////Af///wH///8B////AbySo1OdWXnnuIece6Rhis2FK2H/gyde/72Lqausc4yvmVJ0/f7/ /Q3///8B////Af///wH///8B////Af///wHWuMYN07XDDf///wHPq8Ezhy5l/5NDdPX///8B////Acml tjHHo7QH////Af///wH///8B////Af///wH///8B////Af///wH///8B////AbF3mpnYvM5d////Af// /wH///8B////Af///wH///8B////Af///wH///8B////Af///wH///8B////Af///wH///8B////Af// /wH///8B////Af///wH///8B////Af///wH///8B////Af///wH///8B////Af///wH///8B////Af// /wH///8B////Af///wH///8B////Af///wH///8BAAD//wAA//8AAP//AAD//wAA//8AAP//AAD//wAA //8AAP//AAD//wAA//8AAP//AAD//wAA//8AAP//AAD//w==</Image>
<Url type="application/x-suggestions+json" method="GET" template="http://suggestqueries.google.com/complete/search?output=firefox&amp;client=firef ox&amp;qu={searchTerms}" />
<Url type="text/html" method="GET" template="http://www.trovi.com/">
<Param name="q" value="{searchTerms}" />
</Url>
<SearchForm>http%3A%2F%2Fwww.trovi.com%2FResults.aspx%3Fn%3DDP2791%26searchsource%3D58%26UM%3D8%26gd%3DSY1000250/</Sea rchForm>
</SearchPlugin>

Trove was still active. I remove Player x, Trovi was still active. Removed Firefox and Chrome in the hope that their infection was causing problems for Safari. Safari still has Trovi.

 

Symptoms in Safari. Trying to show extensions in the browser window yields an empty list. Setting the homepage to something other than trovi temporarily works, but after one or two restarts trovi reappear as the home page, If I set it so that the startup and new tab pages are empty after a bit the window will close and then reappear with trovi set as the home page and start and new tabs set to display the homepage. Turning off Javascript blocks its ads, but makes other things of course impossible and does nothing to avoid trovi becoming the home page.

 

I have also been having request on startup for the login keychain by

  • Identityservicesd
  • comm.apple.icloudHelper.xpc
  • AddressBookSourceSync
  • accountsd
  • MessagesAgent
  • and CommCenter

 

FWIW I have OS X El Capitain 10.11.4

 

EtreCheck reports

EtreCheck version: 2.9.12 (265)

Report generated 2016-05-13 22:29:08

Download EtreCheck from https://etrecheck.com

Runtime 1:33

Performance: Excellent

 

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

 

Check Apple signatures: Enabled

 

Problem: Other problem

 

Hardware Information: ⓘ

    MacBook Pro (Retina, 15-inch, Early 2013)

    [Technical Specifications] - [User Guide] - [Warranty & Service]

    MacBook Pro - model: MacBookPro10,1

    1 2.4 GHz Intel Core i7 CPU: 4-core

    8 GB RAM Not upgradeable

        BANK 0/DIMM0

            4 GB DDR3 1600 MHz ok

        BANK 1/DIMM0

            4 GB DDR3 1600 MHz ok

    Bluetooth: Good - Handoff/Airdrop2 supported

    Wireless:  en0: 802.11 a/b/g/n

    Battery: Health = Normal - Cycle count = 137

 

Video Information: ⓘ

    Intel HD Graphics 4000

        Color LCD 2880 x 1800

    NVIDIA GeForce GT 650M - VRAM: 1024 MB

 

System Software: ⓘ

    OS X El Capitan 10.11.4 (15E65) - Time since boot: about one hour

 

Disk Information: ⓘ

    APPLE SSD SD256E disk0 : (251 GB) (Solid State - TRIM: Yes)

        EFI (disk0s1) <not mounted> : 210 MB

        Recovery HD (disk0s3) <not mounted>  [Recovery]: 650 MB

        Macintosh HD (disk1) / : 249.77 GB (29.73 GB free)

            Core Storage: disk0s2 250.14 GB Online

 

USB Information: ⓘ

    Apple Inc. FaceTime HD Camera (Built-in)

    Apple Inc. Apple Internal Keyboard / Trackpad

    Apple Inc. BRCM20702 Hub

        Apple Inc. Bluetooth USB Host Controller

 

Thunderbolt Information: ⓘ

    Apple Inc. thunderbolt_bus

 

Gatekeeper: ⓘ

    Mac App Store and identified developers

 

Kernel Extensions: ⓘ

        /Library/Extensions

    [not loaded]    com.BlackBerry.driver.USBCDCNCM (1.0.6 - SDK 10.7 - 2016-04-05) [Support]

    [loaded]    com.rim.driver.BlackBerryUSBDriverInt (2.2.7 - SDK 10.7 - 2016-04-05) [Support]

    [loaded]    com.rim.driver.BlackBerryVirtualPrivateNetwork (1.0.18 - SDK 10.8 - 2016-04-05) [Support]

 

Startup Items: ⓘ

    daemonic-dbus: Path: /Library/StartupItems/daemonic-dbus

    Startup items are obsolete in OS X Yosemite

 

System Launch Agents: ⓘ

    [not loaded]    8 Apple tasks

    [loaded]    154 Apple tasks

    [running]    76 Apple tasks

 

System Launch Daemons: ⓘ

    [not loaded]    44 Apple tasks

    [loaded]    158 Apple tasks

    [running]    88 Apple tasks

 

Launch Agents: ⓘ

    [running]    com.mozy.status.plist (2016-03-13) [Support]

    [loaded]    com.oracle.java.Java-Updater.plist (2014-01-01) [Support]

    [running]    com.rim.BBLaunchAgent.plist (2013-11-08) [Support]

    [running]    com.rim.PeerManager.plist (2013-11-08) [Support]

    [running]    com.rim.blackberrylink.BlackBerry-Link-Helper-Agent.plist (2013-11-08) [Support]

    [loaded]    org.macosforge.xquartz.startx.plist (2015-10-16) [Support]

 

Launch Daemons: ⓘ

    [failed]    com.adobe.fpsaud.plist (2016-04-15) [Support]

    [not loaded]    com.apple.nysgar.plist (2016-05-08) - Executable not found!

    [loaded]    com.barebones.authd.plist (2012-11-22) [Support]

    [loaded]    com.barebones.textwrangler.plist (2010-01-30) [Support]

    [loaded]    com.github.GitHub.GHInstallCLI.plist (2013-04-06) [Support]

    [loaded]    com.malwarebytes.MBAMHelperTool.plist (2016-05-09) [Support]

    [loaded]    com.microsoft.office.licensing.helper.plist (2012-04-02) [Support]

    [running]    com.mozy.backup.plist (2016-03-13) [Support]

    [loaded]    com.oracle.java.Helper-Tool.plist (2014-01-01) [Support]

    [running]    com.rim.BBDaemon.plist (2013-11-08) [Support]

    [not loaded]    com.rim.nkehelper.plist (2013-11-08) [Support]

    [running]    com.rim.tunmgr.plist (2013-11-08) [Support]

    [loaded]    org.macosforge.xquartz.privileged_startx.plist (2015-10-16) [Support]

 

User Launch Agents: ⓘ

    [failed]    com.adobe.ARM.[...].plist (2009-10-22) [Support]

    [loaded]    com.google.keystone.agent.plist (2016-05-11) [Support]

 

User Login Items: ⓘ

    iSyncr    Application  (/Applications/iSyncr.app)

    Skype    Application  (/Applications/Skype.app)

 

Other Apps: ⓘ

    [running]    com.JRTStudio.iSyncrWiFi.58272

    [running]    com.apple.nysgar

    [running]    com.etresoft.EtreCheck.268512

    [loaded]    com.excitedpixel.breaktimelauncher

    [running]    com.skype.skype.224352

    [loaded]    org.finkproject.dbus-session

    [loaded]    410 Apple tasks

    [running]    191 Apple tasks

 

Internet Plug-ins: ⓘ

    Default Browser: 601 - SDK 10.11 (2016-03-22)

    Flip4Mac WMV Plugin: 3.1.0.24   - SDK 10.8 (2013-04-06) [Support]

    OfficeLiveBrowserPlugin: 12.3.6 (2013-03-20) [Support]

    Silverlight: 5.1.10411.0 - SDK 10.6 (2013-04-06) [Support]

    FlashPlayer-10.6: 21.0.0.226 - SDK 10.6 (2016-05-03) [Support]

    QuickTime Plugin: 7.7.3 (2016-03-22)

    Flash Player: 21.0.0.226 - SDK 10.6 (2016-05-03) Outdated! Update

    Veoh Plugin: 3.0 (2008-04-15) [Support]

    SharePointBrowserPlugin: 14.5.5 - SDK 10.6 (2015-09-12) [Support]

    AdobePDFViewer: 9.5.4 (2013-02-22) [Support]

    iPhotoPhotocast: 7.0 (2008-07-14)

    JavaAppletPlugin: Java 8 Update 73 build 02 (2016-02-14) Check version

 

3rd Party Preference Panes: ⓘ

    Flash Player (2016-04-15) [Support]

    Flip4Mac WMV (2013-01-09) [Support]

    Java (2016-02-14) [Support]

    MozyHome (2016-05-12) [Support]

    Perian (2011-07-23) [Support]

    Spelling (2015-12-06) [Support]

    TeXDistPrefPane (2015-12-06) [Support]

    TotalAccess (2005-02-25) [Support]

    Tuxera NTFS (2012-08-30) [Support]

 

Time Machine: ⓘ

    Skip System Files: NO

    Auto backup: YES

    Volumes being backed up:

        Macintosh HD: Disk size: 249.77 GB Disk used: 220.04 GB

    Destinations:

        Toshiba Mac+ [Local]

        Total size: 999.86 GB

        Total number of backups: 3

        Oldest backup: 3/20/13, 11:47 PM

        Last backup: 5/12/16, 9:44 PM

        Size of backup disk: Excellent

            Backup size 999.86 GB > (Disk size 249.77 GB X 3)

 

Top Processes by CPU: ⓘ

         6%    WindowServer

         5%    kernel_task

         3%    hidd

         2%    fontd

         0%    com.apple.WebKit.WebContent(4)

 

Top Processes by Memory: ⓘ

    816 MB    kernel_task

    492 MB    com.apple.WebKit.WebContent(4)

    377 MB    mds_stores

    319 MB    Finder

    303 MB    WindowServer

 

Virtual Memory Information: ⓘ

    589 MB    Free RAM

    7.42 GB    Used RAM (3.15 GB Cached)

    0 B    Swap Used

 

Diagnostics Information: ⓘ

    May 13, 2016, 08:40:13 PM    Self test - passed

    May 13, 2016, 08:21:50 PM    /Library/Logs/DiagnosticReports/MozyHomeBackup_2016-05-13-202150_[redacted].cpu _resource.diag [Details]

        /Library/PreferencePanes/MozyHome.prefPane/Contents/Resources/MozyHomeBackup

    May 13, 2016, 07:56:46 PM    /Library/Logs/DiagnosticReports/MozyHomeBackup_2016-05-13-195646_[redacted].cpu _resource.diag [Details]

    May 12, 2016, 11:35:57 PM    /Library/Logs/DiagnosticReports/MozyHomeBackup_2016-05-12-233557_[redacted].cpu _resource.diag [Details]

    May 12, 2016, 10:03:31 PM    /Library/Logs/DiagnosticReports/MozyHomeBackup_2016-05-12-220331_[redacted].cra sh

    May 12, 2016, 08:40:18 PM    /Library/Logs/DiagnosticReports/backupd_2016-05-12-204018_[redacted].cpu_resour ce.diag [Details]

        /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd

    May 10, 2016, 11:36:03 PM    ~/Library/Logs/DiagnosticReports/Finder_2016-05-10-233603_[redacted].crash

        com.apple.finder - /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

    May 10, 2016, 10:28:35 PM    /Library/Logs/DiagnosticReports/BitMedic_2016-05-10-222835_[redacted].hang

        /Applications/BitMedic.app/Contents/MacOS/BitMedic

Posted on May 13, 2016 9:34 PM

Close
wclodius

Q: How do I remove Trovi after doing the obvious

  • All replies
  • Helpful answers

first Previous Page 3 of 3

  • by Lexiepex,

    Lexiepex Lexiepex May 16, 2016 1:04 AM in response to appreciate
    Level 6 (10,477 points)
    Mac OS X
    May 16, 2016 1:04 AM in response to appreciate

    You should stop. Don't experiment and then post gibberish or false solutions. If you want to participate read a lot of threads here, read, and learn, before you start posting and distorting the threads.

  • by thomas_r.,

    thomas_r. thomas_r. May 16, 2016 6:01 AM in response to wclodius
    Level 7 (30,889 points)
    Mac OS X
    May 16, 2016 6:01 AM in response to wclodius

    wclodius wrote:

     

    As near as I can tell from the behavior I observed you now have to remove the second file as well.

     

    Yes, this particular malware will re-generate the launch daemon file if it gets removed. You need to remove the nysgar file from the /Library/ folder first, then restart. After restarting, the launch daemon will still be there, but it will be unable to launch the nysgar process, since it will have been removed. At that point, remove the com.apple.nysgar.plist file and restart again. That should get rid of it.

     

    This is a recent variant of the VSearch malware. We're still working on improving our detection of this threat, which as you can see, is using some malware-like tricks to prevent removal.

     

    Thomas Reed

    Director of Mac Offerings, Malwarebytes

  • by wclodius,

    wclodius wclodius May 16, 2016 8:21 PM in response to appreciate
    Level 1 (8 points)
    Mac OS X
    May 16, 2016 8:21 PM in response to appreciate

    Appreciate:

     

    At this point I don't particularly appreciate your attempts to "help". For your posts to be useful you need to take some care in reading the posts you respond to, focus on a limited set of solutions, present your suggestions clearly, and not assume that an offense is always the best defense.

     

    You are not reading carefully. At various stages you have assumed that I have not stated the OS, when I had stated I was using El Capitan, that I was only posting screen shots for one of the two Library directories of interest, when I prefixed the screen shots with labels clearly identifying the subdirectories, that I was still in need of advice, for many posts after I had clearly indicated that I thought the problem was solved.

     

    You are not focussing your advice. You suggest subdirectories well outside the ones normally the source of the problem, all files of those directories as likely to be a problem, and don't distinguish between similarly named directories. All of this can cause the reader to make mistakes.

     

    You are not presenting your advice clearly. Your inconsistent capitalization is a distraction. You seem to frequently drop words or transpose words in your writing.

     

    You are too aggressive in your response to criticism. If you refuse to recognize your mistakes you will continue to make them.

  • by Lexiepex,

    Lexiepex Lexiepex May 17, 2016 7:06 AM in response to wclodius
    Level 6 (10,477 points)
    Mac OS X
    May 17, 2016 7:06 AM in response to wclodius

    Good conclusion. Everybody here and in other threads are not able to stop him/here.

    If you have not been completely satisfied with the results of this thread: Post a new one (nobody will study this one with all the gibberish in it), and put a post here with the link, and mark that this "invitation" is not for appreciate...

  • by san francisco g,

    san francisco g san francisco g May 22, 2016 1:24 AM in response to Linc Davis
    Level 1 (4 points)
    May 22, 2016 1:24 AM in response to Linc Davis

    Linc Davis,

     

    thank you for pointing out nysgar and

    "Move the file I indicated to the Trash, then restart and empty the Trash. As for the "nysgar" file, it's part of the malware, and you can of course remove it, but that step is optional. There are always more files, but trying to track them all down is more trouble than it's worth."

     

    In Macintosh HD/Library

    I actualy found - besides <nysgar> - 3 other files of similar type: <elmeld>, <riarat> and <sideb> They have all been created around the same time (and around the same time as on wclodius computer). The all also have <com.apple.*.plist> in LaunchDeamons directory.

     

    These files are all binary, but I opened them with vi and found that they all have the following in the code: <http://t.trkitok.com/track/>. You can google <http://t.trkitok.com/track/> and you'll get a bunch of not very reputable links. This study here however explains a bit more what is happening behind Trovi's facade and how it is connected with <http://t.trkitok.com/track/>

  • by san francisco g,

    san francisco g san francisco g May 22, 2016 1:26 AM in response to san francisco g
    Level 1 (4 points)
    May 22, 2016 1:26 AM in response to san francisco g

    https://objective-see.com/blog/blog_0x0E.html

     

    this is the article I was talking about

  • by Delisa1027,

    Delisa1027 Delisa1027 Jun 19, 2016 12:48 PM in response to wclodius
    Level 1 (4 points)
    Jun 19, 2016 12:48 PM in response to wclodius

    Working on removing this from my sister's laptop. Thought I removed it, but still looks like it's there. Will update this post in the future.

  • by evillageprowler,

    evillageprowler evillageprowler Jul 22, 2016 11:06 AM in response to wclodius
    Level 1 (4 points)
    Mac OS X
    Jul 22, 2016 11:06 AM in response to wclodius

    I have the same issue too, and need help removing a persistent Trovi annoyance. In addition to messing with my browsers, it also causes my Parallels app (and a Windows guest host) to launch. It also will make my browsers exit and re-launch from time to time. This started happening maybe less than one month ago, but I forget (been dealing with other more pressing issues).

     

    Here are my screen shots:

     

    In ~/Library/LaunchAgents, nothing jumps out at me to delete.

    Screen Shot 1.png

    In /Library/LaunchDaemons, I guess I get rid of com.apple.builing.plist and com.envelopUpd.plist? (Yes, I will delete Malwarebytes too, but that's not the cause of my issues.)

    Screen Shot 2.png

    Everything looks ok in /Library/LaunchAgents.

    Screen Shot 3.png

  • by Linc Davis,

    Linc Davis Linc Davis Jul 22, 2016 12:12 PM in response to evillageprowler
    Level 10 (207,936 points)
    Applications
    Jul 22, 2016 12:12 PM in response to evillageprowler

    That's right. You must start up in safe mode to delete the files.

  • by evillageprowler,

    evillageprowler evillageprowler Jul 22, 2016 2:00 PM in response to Linc Davis
    Level 1 (4 points)
    Mac OS X
    Jul 22, 2016 2:00 PM in response to Linc Davis

    Thanks! I think I finally purged my system of it. It's very persistent!!!

  • by kklivin,

    kklivin kklivin Sep 7, 2016 2:19 AM in response to Linc Davis
    Level 1 (4 points)
    Sep 7, 2016 2:19 AM in response to Linc Davis

    I'm having similar problems with Trovi. I've had it for almost a year (I think?) It started with Safari, and from what I can remember, Chrome as well. I had uninstalled Chrome and am strictly using Firefox as it doesn't seem to have affected it. Lately Firefox has been crashing and Safari will automatically launch at the same time. Yesterday I reinstalled and updated Yosemite. Everything is backed up so I'm willing to do anything at this point.

     

    ~/Library/LaunchAgents

    Screen Shot 2016-09-07 at 4.29.15 AM.png

    /Library/LaunchAgents

    Screen Shot 2016-09-07 at 4.29.49 AM.png

    /Library/LaunchDaemons (1/2)

    Screen Shot 2016-09-07 at 4.30.31 AM.png

    /Library/LaunchDaemons (2/2)

    Screen Shot 2016-09-07 at 4.30.46 AM.png

    Safari Extensions

    Screen Shot 2016-09-07 at 4.21.31 AM.png

  • by etresoft,

    etresoft etresoft Sep 7, 2016 8:11 AM in response to kklivin
    Level 7 (29,101 points)
    Sep 7, 2016 8:11 AM in response to kklivin

    Hello kklivin,

    This thread is several months old. ******* You should start your own question.

     

    However, I can see that you have quite a bit of adware and malware installed. The two most-recommended methods for dealing with adware and malware are MalwareBytes for Mac (https://www.malwarebytes.com/antimalware/mac/) and my own tool EtreCheck.

     

    Naturally, I would prefer that you download and run EtreCheck. But you have so much adware and malware installed that I would appreciate it if you could help out the community by running a test.

     

    MalwareBytes is very good at removing malware, but it is a black box. No one knows how good it really performs because it doesn't have a report like EtreCheck does.

     

    It would be nice if you could download and run MalwareBytes first and let it remove your adware and malware. Then download and run EtreCheck and post the report that it generates. If there is any brand new adware left from MalwareBytes, EtreCheck will give you an opportunity to remove it. That will help me, the developers of MalwareBytes, and the whole community. And it will also get rid of your adware and malware problem!

     

    Disclaimer: Although EtreCheck is free, there are other links on my site that could give me some form of compensation, financial or otherwise.

     

    <Edited by Host>

  • by kklivin,

    kklivin kklivin Sep 7, 2016 7:58 AM in response to etresoft
    Level 1 (4 points)
    Sep 7, 2016 7:58 AM in response to etresoft

    Thanks very much for your prompt reply. I will work on this, and start my own question. ^^

  • by etresoft,

    etresoft etresoft Sep 7, 2016 8:26 AM in response to kklivin
    Level 7 (29,101 points)
    Sep 7, 2016 8:26 AM in response to kklivin

    kklivin wrote:

     

    Thanks very much for your prompt reply. I will work on this, and start my own question. ^^

    Thank you! Your reply has already helped to solve a mystery.

  • by juanmgonzalez,

    juanmgonzalez juanmgonzalez Sep 9, 2016 6:42 AM in response to Linc Davis
    Level 1 (4 points)
    Sep 9, 2016 6:42 AM in response to Linc Davis

    Linc Davis wrote:

     

    That's right. You must start up in safe mode to delete the files.

     

    Yes, this is it! I was trying all kind of possible solutions, with Malwarebytes, browser settings, also many suggestions from this thread and others (removing some files and other related ones after analyzing their content, etc.).

     

    At first those methods seemed to work, however after a while Trovi was coming back again and again.

     

    Then I repeated all those multiple cleaning operations, but this time after starting the affected iMac in SAFE MODE. This was the key for a permanent solution.

first Previous Page 3 of 3