Circumventing user authorization while making changes to the way a computer system is configured is a feature that makes apps like Trovi Search an unwanted entity. Falling victim to this adware is a matter of installing a third-party program and paying little or no attention to the details of the setup procedure. For instance, some inconspicuous checkmark on one of setup wizard screens can get you infected unless you opt out of the ‘special terms’, which not many users pay attention to. Utilities that are known to be involved in spreading Trovi are Search Protect by Conduit, Yontoo, SearchNewTab, and BookmarkTube. Although seldom, this threat may also be downloaded directly as Trovi Toolbar or Trovi Search, but in that case the user is way off the track in terms of the anticipations for what this app is going to do.
Intrusion being committed, the malicious code gets down to reconfiguring the web browsers running on the now compromised computer. Since Trovi is a cross-browser infection, its impact applies to Firefox, Chrome and IE similarly: the homepage and default search engine are subject to an unapproved modification, starting to return trovi.com instead of the values previously set by the victim.
From this very moment on, a big portion of the Internet decision-making is taken away from the user. Even if the above-mentioned custom settings are manually altered back to where they were before the hijack, trovi.com will be back the next time the browser gets opened. Is this landing page a threat as such? Not really, unlike the app that causes the redirects. The site is essentially an under-the-table search provider making use of other resources’ keyword lookup algorithms. To understand what the point of this entire browser hack is, one should carefully examine the structure of trovi.com and its search results pages – they all either contain big ol’ advertisement banners or sponsored links in a quantity exceeding the limits of common sense. Consequently, the more people visit that page the greater financial gain for the authors of the adware under consideration.
Whereas Trovi Search is quite a complex infection sample, the only simple thing about it is the absolute need for removal. Unless cleaned up through strict security effort, this pest will keep on messing up your cyber environment and definitely won’t go away. The fix highlighted here has got proven efficiency in this regard.
CCleaner by Piriform is an efficient solution designed to automatically uninstall persistent malware such as the unwanted browser extensions related to Trovi Search hijacker and cease the browser redirect activity.
System Requirements: Runs on Microsoft Windows XP, Vista, 7, 8 and 8.1. Including both 32-bit and 64-bit versions.
2. Click on the Cleaner button in the left-hand navigation menu, select Windows and Applications tabs in turn, and click Analyze option for each. Once the analysis has been completed, click Run Cleaner.
3. Go to Tools in the navigation menu and select the Startup option. Search entries under all available tabs (‘’Windows‘ through ‘Context Menu‘) for dubious items that might be related to the Trovi adware (Trovi Search, Trovi Toolbar, Search Protect by Conduit, Conduit Search, Yontoo, BookmarkTube, SearchNewTab, etc.) and choose Disable and Delete for each one.
4. You can also use the Uninstall functionality under Tools to completely get rid of browser add-ons / toolbars that cannot be deleted manually.
5. Uninstall malicious extension(s) from Control Panel:
• On Windows XP: go to Start –> Control Panel –> Add/Remove Programs
• On Windows Vista / 7: go to Start –> Control Panel –> Uninstall a Program
• On Windows 8: click on Search icon –> type in ‘add or remove‘ (this will suffice) –> select Add or remove programs
When the screen for program removal appears, look for the following items:
– Trovi Search
– Trovi Toolbar
– Search Protect by Conduit
– Conduit Search
Source: Trovi Search removal
If located on the list, these should be uninstalled immediately as they are known to cause trovi.com to show up in one’s web browser without user consent.
• Go to Tools and select Add-ons in the drop-down list
• Choose Extensions in the left-hand navigation pane and examine the list for entries associated with Trovi Search (see previous section). When found, click the Remove button
• Proceed to Options under Tools menu
• Hit the General tab and select Restore to Default as shown on the image below
• In the search box to the right of the URL field, click on the arrow pointing downwards
• Click on the Manage Search Engines option in the drop-down menu that appears
• Click on the Trovi Search entry and select Remove
• In the top right of your Chrome window, click on the Chrome menu icon
• Select Tools in the drop-down menu and choose Extensions
• Under Extensions, find the add-on related to Trovi Search (possibly BookmarkTube) and click on the trash bin next to it
• Go to Settings under Chrome menu
• Under Settings, Locate the On startup section and click Set pages
• On the list of startup pages, find the one related to Trovi and click the X button to its right
• Go to Appearance section under Settings. Select Show Home button option and click Change
• Activate Use the New Tab page radio button and click OK
• Proceed to the Search section under Settings and select Manage search engines
• Pick your default search engine other than Trovi Search. Also, be sure to click on the X button next to Trovi Search in order to remove it from the list
• Go to Tools and choose Manage Add-ons
• Select Toolbars and Extensions and locate Trovi on the list. Highlight it and click the Remove button
• Click on Search Providers in the left-hand section of the Manage add-ons window. Highlight Trovi on the list of search providers and click Remove at the bottom of the interface
• Choose your preferred search provider from the list and click Set as default
• Now proceed to Tools –> Internet Options, and select General tab. Set a preferred value of your homepage and OK to save the changes