How to remove Trovi malware from Safari?

Question

I am pretty much 100% certain that I have somehow gotten a virus installed into my Safari.

My homepage and default search engine changes to "Trovi" every time I restart Safari no matter how many times I reset it.

My first thought was to remove all extensions but there weren't any in the extensions folder! However, when I opened the Extensions.plist file, it shows over 368 extensions under Apple-hosted Updates List. Does anybody know where I can find these extensions and delete them? Here are some example extensions in that list:

• RedMorph-Browser-Controller.safariextz
• pogo_1.0.safariextz
• IsItWorthMyTime.safariextz
• siulykantraste_1.0.3_6.safariextz

I can't seem to locate these files on my Mac. Any help is appreciated.

ALSO: I would like input on this. While the virus was infecting my computer, I noticed that I thought the dot characters that hide the password I type in to unlock my computer looked bigger than normal. Then after the restore to Time Machine backup, I can confirm that the dots that hide my password to login to my computer are smaller again. Could it be that whatever kind of virus that I stupidly got on my computer was monitoring my login password???

Answer 1

Before killing false culprits at random with a great chance to damage your working environment, I suggest you to first attack your original problem.

Download a correct malware hunter: Malwarebytes.

Disclaimer: I don't work for them, they have a free version.

I tested it on many versions of OSX (Mavericks, Yosemite...) and found and fixed some well hidden crapwares left undetected by leader commercial anti-virus.

Warning: There are a lot of bad and good methods to get rid of Trovi found on the web. Avoid to download from unchecked sources, as you wouldn't drink from any found bottle.

I didn't test the following, but trust its author since many years. I advise you to apply the receipe from Linc Davis:

How to remove Trovi from Safari

Answer 2

Safari extensions will be in ~/Library/Safari/Extensions/ or possibly /Library/Safari/Extensions/ for global extensions.

Spotlight won't search in 'system' locations, so for this type of search I always use EasyFind (freeware) which will search anywhere, for visible or hidden files/folders, file contents etc. It doesn't index, so is slower than Spotlight, but much more thorough.

I'm uncertain as to whether a referenced, yet missing, extension could cause any issues. Normally, the .plist will tidy itself up to just show the currently installed ones; I've not seen any that I didn't specifically put there, but it might be worth making a copy of the .plist & simply erasing the unknown/unwanted listings.

Answer 3

First I tried Tetsujin's answer: I looked in ~/Library/Safari/Extensions to check but it was an empty folder besides Extensions.plist and also /Library/Safari/Extensions did not exist.

Next I downloaded Malwarebytes by recommendation of daniel Azuelos, and when I ran the scan it said my computer was clean.

This virus I think is very advanced, for it would change the homepage and search engine of all of my browsers no matter how many times I changed it back. Ultimately, I restored to a Time Machine backup that was made the day before the infected package was installed.

Answer 4

It is usually bundled with adware.

Download and run Malwarebytes and see if it catches anything. Try downloading AppCleaner as well, and manually drag potentially unwanted programs to AppCleaner. Programs like MPlayerX, MacKeeper, CleanMyMac, MacOptimizer, TuneMyMac, etc. As far as Trovi goes, simply open Safari and navigate to a different webpage (google.com or something similar). Reset your homepage. Clear your history and cache. Check your extensions. And delete any you see. Last resort...hold Shift + Click Safari and it will reset it for you. Clear out everything.

That should clear you up pretty well.