Trovi Malware and Adware

What is Trovi?

Trovi is a browser hijacker, search engine and adware that can be found when installing or when downloading applications from certain freeware sites, such as Softonic.com or Download.com. The first Trovi hijacking ever recorded was on January 11, 2014 with no specified logo with only a search icon, much like Conduit Search and Search Protect in which is teamed and sometimes bundled with the Trovi Software. Trovi is reported to serve many ads, and hijacks the most common browser homepages and new tab pages, causing Trovi to be considered a PUP (Potentially Unwanted Program). Trovi can not harm the user's PC in any way but can alter the browsing experience, the only things it can do is change the home and new tab page. 

Symptoms

This variant changes the homepage and new tab of the browser being used. It also hijacks the homepage and new tab page settings to where they can not be changed back to the original settings. Depending on what browser the user is using, they might see ads on the page.

Removal

Trovi can be uninstalled from info.trovi.com/Uninstall in a couple of steps, or you can also remove it by booting into Safe Mode, deleting the Trovi files, and then restoring your browser to its default settings. It can also be removed via Malwarebytes, McAfee, or almost any other antivirus tool. 

Trovi Removal Procedures

To be used when Trovi will not be removed by Antivirus software and must be dealt with manually.

1. Open all installed browsers on the device. Do not skip any.

2. Check which browsers have Trovi coming up as homepage.

   • Internet Explorer

     1. Check homepage, bookmarks and extensions, back them up.

     2. Reset IE (check the box for personal settings).

     3. Put back the homepage, bookmarks and extensions.

     4. If still unresolved, use HijackThis and search for the Trovi entry, remove it.

     5. Confirm resolution.

   • Mozilla Firefox

     1. Reset Firefox.

     2. Confirm resolution.

   • Google Chrome

     1. Run: %localappdata%\Google\Chrome\User Data\

     2. Rename the Default folder to Default2.

     3. Launch Chrome and confirm resolution.

     4. If it works, delete the new Default folder and rename Default2 back to Default.

     5. Check homepage, bookmarks and extensions, back them up.

     6. Delete the Default folder.

     7. Launch Chrome to create a new Default folder.

     8. Put back the homepage, bookmarks and extensions.

3. Check the properties for each browser shortcut and remove Trovi from it if there is one.

4. Confirm resolution.