Trovi Virus Removal Needed

hi if you open chrome>preferences>settings>on start up> set pages> then change to your preferred search engine and save trove now gone the sneaky little git as it stays there even if you move it from the extensions

Hi all,

I had the evil Trovi malware in my Chrome browser and tried what vfrawley suggested, but didn't work.

Then I followed thomas_r.'s suggestion (used Adware Medic), and it got rid of Trovi, as well as Genio (another malware that was on my Safari browser). Thank you so much!

TL;DR - www.adwaremedic.com solved my problem. I had Trovi, but also other programs that Adware Medic cleaned out.

Just wanted to let you know that I recently ran across this Trovi / Conduit adware BS and was totally dumbfounded. It was just like be teleported over to a Windows system ... pretty sad day that this stuff weasels its way onto OS X. Long story short: I tried all of the things in the post before turning to your suggestion as I'm usually very reluctant to use an unknown program to uninstall another unknown program/plugin. HOWEVER - thomas - Your suggestion Adware Medic did the trick and then some. Thank you very much! I'll send a small donation along shortly.

UGH UGH UGH UGH UGH I hate this kind of stuff. I do really appreciate those that take the time to post in this forum and create excellent software to help out people like us. Thanks again!

Just putting this here in case anyone stumbles upon this post in search of an easy fix.

This adware creates a folder in your Applications folder called "SafeSearch" or something very similar. Inside this folder is an uninstaller which will completely remove all existence of this adware.

The only additional step you need to do is switch back your homepage on each browser and you are good to go. Hope this helps!

It is NEVER a good idea to rely on the uninstaller for adware. In the only case I can think of where current adware includes an uninstaller, that uninstaller doesn't actually work properly, leaving all kinds of stuff still installed and active in the background.

Littles.kim wrote:

Thank you I totally found like 4 files ugh!

As has been said here multiple times, vfrawley's instructions are completely inadequate for removing Trovi. See some of the other responses for further instructions.

Update on my situation if anyone has a problem. I couldn't find any specific instructions relating to a mac so I went it on my own. First, TROVI is not a virus but may be an adware and is something known as a Browser Hijacker. It hijacks your browser settings and MAY take your search information and save it and send it to third parties who can use it to direct ads to you or even steal information.

I found where I got it. I downloaded a program from the internet. As I learned from a mac service professional, you need to be very careful with downloading software from the internet. Especially FreeWare. Make Sure you are downloading directly from the developers site and not a third party "Bundler". The program I downloaded was FLVTO which downloads videos from Youtube. It is, I understand, a legitimate program but I may have downloaded it from a site that BUNDLES software and promotes and distributes it along with other FreeWare Programs and Adware.

In my case, as I downloaded FLVTO, the menu that guided me had dialogue boxes that asked my permissions for certain things. In a hurry, I just assumed that they were legitimate things till I noticed, during a re-install of the program that there was one asking to download TROVI. It also had one for Yahoo and one for Some Cloud Service as well as a couple others. By clicking YES to the boxes, I was giving TROVI and other programs permission to change my registrations and preferences in ALL MY BROWSERS, to become my preferred browser or to install on my computer. After noticing TROVI and declining it, I noticed Yahoo and it slipped past me as I thought it was legit, as Yahoo is. However, Surprise, Now YAHOO was my default browser on my Safari and Google Chrome. I also learned that TROVI had installed other adware programs onto my system. Not only did my browser change but I also noticed that AD popups would come up every time I rebooted my computer.

First, I went into FINDER and did a search for TROVI and deleted all related files. Then, I found some for the cloud serivice and deleted those, I deleted the FLVTO files as well. There were a couple other ads that came up and I deleted files for those as well. While researching, things came up relating to developer names etc. I kept note of all the associated names that came up while I was researching and ran those through FINDER to find that many also had files saved on my computer. Of course, I deleted all those. Safari was easy to change the preferences and registrations so I left that. However, Google was more difficult and I was not able to, immediately remove TROVI. So, I also removed GOOGLE from my computer. I found that even though I uninstalled Google Chrome 2 times, things came back every time I re-installed it. I found that I also had to remove and delete the GOOGLE file under Library Application Support. Now, after re-installing Google Chrome, it seemed clean.

Lastly, so far, after talking to my Mac Service Professional, he said that I may want to remove everything from my computer and re-install the OS and everything. Stating that these programs can hide things all over your computer in places where you may not ever find them. Even through a normal FINDER Search. He then recommended Adware Medic but stated again that the only way to be sure the adware is all gone is to scrub the entire OS etc., I ran AdwareMedic and was stunned to find a whole page and a half of other files. Most if not all were related to those programs that I had originally searched for ad thought I had removed. Right now, I am not noticing any issues and think I have my system clean. I don't know though, for sure.

My next step is to work toward making a list of all the stuff that I have on my computer. Save all my data files and photos etc.... Then, I guess, reinstall everything. My advice from the Service Guy is to then put the OS on a jump drive and keep that, in case I ever have a problem again. Then, after I have everything re-installed and setup the way I need it, Before I do anything else, he suggested making a clone of my Hard Drive using Carbon Copy Cloner and keep that in a safe place, in case this ever happens again. He also reminded me the importance of Time Machine and keeping backups of data. All stuff that I now need to work on .

NOTE: I originally posted that iCloud was pushed through the download which it was NOT. I don't recall the name of the cloud service that tried to install.

I just removed it from Firefox 35.0.1 on my MacBook Pro by searching for "trovi" in the finder. Deleted both plugin and trovi folder. Quit and then restarted Firefox and then you will need to reset your homepage in Preferences>General back to your preferred home page.

werdup wrote:

I just removed it from Firefox 35.0.1 on my MacBook Pro by searching for "trovi" in the finder.

As has been said here repeatedly, that is not adequate for removing Trovi. You need to see some of the other advice on this topic.

werdup wrote:

What if I upgrade my system from Mavericks to Yosemite, would that remove it?

No, that would not do anything to help this particular problem.

In addition I just found this removal method by Lync Davis

Linc's instructions on that page are outdated, and I never thought they were particularly complete anyway.

For up-to-date removal instructions, see my Adware Removal Guide.

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

Hi Thomas,

Actually I did go to your Adware Removal Guide after my post and followed the manual removal instructions. Since I use Firefox I went to

~/Library/Application Support/Firefox/Profiles/ and found the “.default” folder.

Some of the items posted there could not be found and I found something not mentioned. In case this is useful to you my results are below.

abstraction.js NOT FOUND

takeOverNewTab.txt FOUND AND REMOVED

searchplugins/[any file with "Conduit" in the name].xml NO SUCH FILE NAME BUT FOUND A FILE CALLED trovi.xml AND REMOVED IT.

searchplugins/MyBrand.xml NOT FOUND

Thanks

So I was having the same exact trouble of deleting everything but not getting rid of it. I went into my extensions in my Google chrome settings and disabled something called "Safe Search". That got rid of it immediately. So I deleted it and it hasn't been a problem. Hope that's helpful!

I have gathered information on the Trovi issue and have removed it from my Mac. There are three ways of getting ride of Trovi.

1) If Trovi is on your Chrome, even if you delete it from your chrome extension list, it can come back or won't leave at all. Best case scenario is to just uninstall chrome and reinstall it. Its the best way to get ride of it.

2) If Trovi is on your safari, delete it from your extensions and change your homepage and tab settings. Check both.

3) Find Trovi on your computer, trash any traces of it from your computer, then empty the trash.

I hope this helps.

I have gathered information on the Trovi issue and have removed it from my Mac. There are three ways of getting ride of Trovi.

1) If Trovi is on your Chrome, even if you delete it from your chrome extension list, it can come back or won't leave at all. Best case scenario is to just uninstall chrome and reinstall it. Its the best way to get ride of it.

2) If Trovi is on your safari, delete it from your extensions and change your homepage and tab settings. Check both.

3) Find Trovi on your computer, trash any traces of it from your computer, then empty the trash.

I hope this helps.

jjmarre wrote:

1) If Trovi is on your Chrome, even if you delete it from your chrome extension list, it can come back or won't leave at all. Best case scenario is to just uninstall chrome and reinstall it. Its the best way to get ride of it.

2) If Trovi is on your safari, delete it from your extensions and change your homepage and tab settings. Check both.

3) Find Trovi on your computer, trash any traces of it from your computer, then empty the trash.

As has been repeatedly said on this topic, such techniques are not remotely adequate to remove Trovi. Any browser extensions that it installs are the smallest part of the installation. Many installed files won't have the word "Trovi" in their names anywhere, and won't be easy to find regardless of their names. You need to follow some of the more specific and detailed removal instructions that have already been posted on this topic previously.