Browser hijackers come in a variety of forms. But they all have one trick or tactic in common — they hijack your Safari, Chrome, or Firefox settings and set your homepage to redirect you to the place they want you to go. When it comes to Trovi — or TroviSearch — it would be the website www.trovi.com. Then, it starts to intercept your web searches to collect data and display adverts.

Everything you need to know about the Trovi virus

Firstly, Trovi is not a virus, as it doesn’t self-replicate and copy itself from computer to computer. Instead, it comes bundled with other applications or tools you download from the web. Here’s how it works.

Once downloaded, Trovi installs itself and then sets your browser homepage to trovi.com. Next, you land on that site and see a search engine. However, instead of displaying the results for your search queries, it intercepts them, collects data on you and your Mac, and displays adverts. If you click on an advert, the cybercriminals behind Trovi get paid. You also land on a website that might be infected and get malware.

Other ways Trovi malware can infect your Mac

In addition to hiding inside other applications and tools, a Trovi browser hijack can also arrive on your Mac via other methods:

  • Clicking links: Whether it’s a link inside an email or chat message or a link embedded in a malicious popup, clicking it can lead to a Trovi download onto your computer. Unless you know and trust the sender, err on the side of caution and do not open it. You can also scan the link using VirusTotal.
  • Visiting an infected website: Your browser can also be affected by a visit to a compromised site housing the malware. This can be avoided by increasing your browser security settings and heeding any warnings about potentially unsafe websites.
  • Unpatched, outdated software: We’ve mentioned how Trovi malware on a Mac can arrive with other apps and tools. It can also take advantage of security vulnerabilities in software that you haven’t updated in quite some time. Of course, the solution here is to keep patching your software and apps on a regular basis.
  • Opening email attachments: Opening email attachments can be rather risky if you don’t know the sender or if you don’t know them very well. Only open email attachments if you know and trust the sender. Major email platforms like Gmail scan email attachments as they arrive in your inbox. Nevertheless, always exercise caution — not all malware is known to your email provider.
  • Using unprotected public Wi-Fi: Browsing the web via a Wi-Fi network that’s open to all makes it simple for a hacker to intercept your traffic and put malware on your device. If you must use public Wi-Fi, use a VPN such as ClearVPN to encrypt your web browsing.

How dangerous is the Trovi browser hijacker?

The word “dangerous” is very subjective. Trovi is a browser hijacker and potentially unwanted program (PUP). This means it could change your settings, collect your data, send you other more dangerous malware, and generally be an inconvenience.

Here are a few symptoms of the Trovi browser hijacker:

  • Browser settings: Expect the homepage and default search engine to be changed. The security settings may also be downgraded, and unwanted extensions may be installed.
  • Unwanted popup ads: This is the main money generator of the Trovi malware. Trovi will send all your search queries to its website, where your web browsing habits will be analyzed in order to send you more ads. Your IP address will also be logged. Your data could be sold to third-party data brokers, raising the specter of further privacy violations.
  • Your computer’s performance takes a hit: Malware often heavily taxes an infected device’s motherboard, battery, and CPU. Expect your CPU to exceed 90%. Your laptop’s battery may overheat, and your browser and operating system could crash, along with the Wi-Fi network.
  • More dangerous malware could arrive: Malware spawns more malware. Trovi could open the door to other threats that could arrive on your machine.

How to remove Trovi from your Mac

There are several steps to removing Trovi, including quitting running processes, removing the app, and changing the settings in all the browsers you use.

Step 1: Quit the process

  1. Open Activity Monitor from the Finder > Applications > Utilities.
  2. Locate the process containing Trovi or TroviSearch in its name in the list of functions on the left side and click on it. 
  3. Press the Quit Process (looks like an ‘x’) button in the toolbar.

    Step 2: Get rid of the app

    1. Go to your Applications folder and look for any suspicious applications you haven’t chosen to download.
    2. Drag them to the Trash and empty it.

      Step 3: Change settings in Safari

      1. Open Safari and click on the Safari menu, then choose Settings.

      2. Select the General tab and, next to Homepage, type the URL of the site you want to use as your homepage.

      3. Choose the Search tab and if it doesn’t display your preferred search engine, change it to the one you want.

      Step 4: Remove Trovi from Chrome

      1. Open Chrome.
      2. Press the More button at the right of the toolbar (it looks like three dots stacked on top of each other), and scroll down to Settings. Alternatively, type or paste the following into the address bar: chrome://settings and press Return. 
      3. Scroll down to “On startup” and check the box next to “Open a specific page or set of pages.” Then type or paste the URL of the page you want to use as your homepage.
      4. Look at the section just above that is called “Default browser,” and make sure it’s set to your preferred search engine.

        Step 5: Remove Trovi from Firefox

        1. Click on the three horizontal lines on the right in the toolbar.
        2. Choose Settings. Then, in the window that opens, click Home.
        3. Set “Homepage and new windows” to your preferred homepage.
        4. Then choose Search in the sidebar and change “Default Search Engine” to the one you like.
          is megabackup a virus

          How to remove Trovi virus with CleanMyMac

          If all that sounds like a lot of work, don’t worry. There is a more effortless way: CleanMyMac. This app has a Malware Removal module that detects Trovi and lots of other malware and removes it with a couple of clicks. CleanMyMac’s malware database is updated regularly to spot thousands of threats, including adware, spyware, viruses, worms, and more, on your Mac.

          Here’s how to use it:

          1. Download CleanMyMac, then open it from your Applications folder.
          2. Choose the Protection module in the left sidebar.
          3. Click Scan.
          4. When it’s finished, it will either give you a clean bill of health or tell you that there is malware on your Mac. Press Remove to get rid of the malware.

          Why does Trovi keep coming back after removal on a Mac?

          A browser hijacker can sometimes be very difficult to remove. Even if you use the anti-malware tool CleanMyMac, powered by Moonlock Engine, some parts of the threat can be missed the first time around. It’s also possible that the vehicle responsible for Trovi’s arrival — such as an infected app — could still be on your device.

          Here’s how to completely remove Troji:

          1. Start CleanMyMac again and configure it for a deep scan to detect any remaining traces.
          2. Check your browser settings and put everything back the way it was.
          3. Check your Applications folder to uninstall anything you don’t recognize or anything you suspect to be the Trovi carrier.
          4. Temporarily stop any browser sync settings and check your other devices. Trovi may have synced to those other devices and then synced back again afterward.
          5. Reset your browser. Another option is to reset your browser back to its original settings.

          Fortunately, you usually don’t need to do anything as drastic as wiping and resetting your Mac to get rid of Trovi.

          To avoid being attacked by Trovi, make sure that you only download applications you know are safe. Apple’s Gatekeeper tool only allows you to download apps from developers Apple has approved. If it throws up a warning forcing you to visit System Settings to enable an app to be downloaded manually, you should think very carefully. Proceed only if you’re sure the app is safe.

          Fortunately, Trovi isn’t too difficult to remove. However, this can be a lengthy process that takes a while to complete. Thankfully, you have tools like CleanMyMac that recognize and remove Trovi from your Mac with no extra effort.