How-To Geek
How to Remove Trovi / Conduit / Search Protect Browser Hijack Malware

If your computer has been hijacked with an obnoxious malware that won’t let you change your home page, there’s a strong chance you’ve been infected with the Trovi Search Protect malware, which used to be known as Conduit. Here’s how to remove it.
How do you know this is malware? Instead of installing like it should, as a Google Chrome Extension, you’ll probably see that your extensions list doesn’t mention Trovi or Conduit at all. Instead, they are hijacking the browser process using Windows API techniques that no legitimate application should be using. For more details on that, you can read our series on using Process Explorer to troubleshoot Windows.
How Did You Get Infected?
Usually at some point you made the huge mistake of trusting a site like Download.com, which bundled it into an installer for a completely different application. This is why you should be really careful when downloading freeware on the Internet.

They get around the legality issue with their long terms of service that nobody reads and by making sure there’s actually a way to uninstall the thing. But as far as we’re concerned, anything that installs in a sneaky fashion and hijacks your other running processes is malware.
Removing the Trovi Search Protect Malware
This is really sad to say, but it’s actually important to use the Search Protect panel to turn off the bad settings first before uninstalling it. You can find the Search Protect icon in the system tray and then double-click on it to open up the panel.

In here, change your Home Page back to Google or whatever you want.

Now change your New Tab page back to Browser Default.

Change your Default Search back to “Browser default search engine.”

And then uncheck the “Enhance my search experience,” which is a lie, because it doesn’t enhance it at all.

Now head to Control Panel, find the Uninstall Programs section, and then find Search Protect and click the Uninstall button. While you are in here, you might want to uninstall anything else that says anything similar to “Search Protect.” If you see SaveSense, remove that too.

At this point your browser should be back to normal… but we aren’t done quite yet. There are still a lot of traces of this thing that we need to clean up.
Use the Google Chrome Software Removal Tool
If you are using Google Chrome, you are in luck because Google provides their own Software Removal Tool to make sure that all of these things are removed. Just head to the Google SRT page, download and run it, and it will automatically detect and remove everything.

Once you start up your browser again, it will ask if you want to reset your browser settings. This will reset everything to defaults, including removing all troublesome extensions. It’s probably a good idea, although note that you’ll have to login to all of your sites again.

Download the Software Removal Tool from google.com
Clean Up IE Settings
If you are using Internet Explorer, you should go to the Tools menu and find the Manage Add-ons item. In here, you can click on Search Providers and change your search back to what it should be. If you see Trovi in the list, click on it and then click Remove.

Use Malwarebytes to Scan Your PC
All of the above techniques will get your computer back to normal — at least as far as Trovi is concerned. But there’s a very strong chance that you’ve got other things hijacking your browser and spying on you.
The best bet for cleaning up spyware and malware is Malwarebytes. You might ask yourself why you wouldn’t just use your regular antivirus product, but the fact is that antivirus just doesn’t detect spyware very often. It’s only useful for viruses that try to destroy your PC, which are few and far between at this point. Almost all of the malware out there is trying to spy on you, redirect your browsing, and insert more ads into pages that you’re viewing. It’s all about the money.
So the only really good product on the market that will find and remove spyware, adware, and other malware is Malwarebytes. Luckily they have a free version that will let you clean up and remove everything — if you want to pay for the full version that has active protection to prevent these things from happening, that’s fine too.
Once you’ve downloaded and installed it, you’ll be prompted to run a scan, so click that big green Scan Now button.

After it completes scanning, it’ll find a big huge list of things to remove. Click the Apply Actions button to actually remove all the malware.

You’ll want to reboot your computer to make sure that everything is fully cleaned up. If anything seems to come back, run Malwarebytes again, remove anything found, and then reboot again.
I use Malwarebytes (free version) proactively. I scan my computer once a week. If I find anything, I scan again in safe mode.
Malwarebytes fixed everything for me except Chrome. For that I had to use the SRT. Firefox incidentally seems to have its own type of SRT built into it.
Somebody needs to sue these low lifes out of existence - How do Google and the real search providers NOT prosecute these criminals.
I had to figure out how to kill Trovi on one of my computers not too long ago - not fun. This article is definitely being bookmarked for possible future use. Hopefully an unnecessary move. TIA!
I have to say this is the longest most effort filled way to get rid of it.
Plenty of tools that will eradicate it with a couple of clicks.
daglesj "Plenty of tools that will eradicate it with a couple of clicks."
I doubt that strongly, but if it's correct, could you please include references?
"So the only really good product on the market that will find and remove spyware, adware, and other malware is Malwarebytes."
Lowell, you consistently write wonderful articles. And Malwarebytes is obviously awesome, it's my number 2 "goto" tool. But the above statement is a tad overboard. There are MANY great sources of free or paid tools in the malware wars, many people out there fighting the good fight. Superantipsyware makes a great tool, it has my highest "run-once" success rate. And CCleaner, Spybot, AdAware, and Avira still all have their adherents, and for good reasons. It is also worth mentioning that all of these and more can be found and safely installed at ninite.com. Ninite is nearly a free computer consulting/repair business in a box, it amazes me you haven't done a piece on them.
Having done a bunch of testing with Superantispyware, and it's a decent tool, but it just didn't work as well in my testing. A few years ago, it was something that we recommended a lot. Now it just seems to do a good job removing advertising cookies, which aren't a big deal in the first place.
CCleaner (which we do recommend for cleanup as opposed to speedup) doesn't remove malware, Spybot and AdAware were pretty clunky and outdated until just recently, and Avira not only doesn't remove most of the spyware type of malware, but it allows them to install in the first place. It's more about being trustworthy, which Malwarebytes has always been (to the best of my knowledge, at least).
There are some alternative tools that do a good job, like Adwcleaner, but I have a hard time recommending them to regular non-technical users because they are made for experts.
Malwarebytes, on the other hand, is 100% free for scanning and removal purposes, has the added benefit of being really user friendly... and in our testing, it is really great at removing spyware and nonsense.
We've talked about it a few times, but you're right, we should definitely do a piece on this. As far as I'm concerned, if freeware isn't on Ninite it should be treated with skepticism.
/agree 100% on Ninite, and I forgot to mention that I agreed 200% that someone at Download.com should be punished. I remember when you could actually trust that site. And now they promote and distribute such odious dreck! Your little graphic made me
Thanks much for the mention of AdwCleaner, I think I vaguely remember it from a couple of years ago, but I had forgotten it! Looks nicer than I remember, clean and means business. And any tool written as a stand-alone exe, that does it's job without installation, registration, and unwanted boot processes... Thumbs up! Some good stuff there at Bleeping Computer.
My personal experience with using SuperAntiSpyware to clean gunk for my clients is apparently better than yours. For a couple years now I have found it on par with, and occasionally more successful than Malwarebytes. But no tool is perfect. In our ever-changing battle, all of them fail to eradicate some kind of creeping evil now and then. I keep all of the ordnance mentioned (and several others) in my arsenal, and recommend/use/install different combinations for different infections and types of client.
My only real point was; I'm grateful for ALL of the peeps who write and distribute these lovely weapons to us. For myself, if I had to attempt to remove all the creeping crud I find on client machines every day using just the built-in Windows tools... Gah! I'm sure I'd be a better tech, but I'd also likely go postal. 8)
Keep writing, I read all your stuff, and often learn (or re-learn) something useful.
I recently needed to remove Trovi from our church's computer. It apparently got installed while our preacher install VLC player. The first thing I did was run Malwarebytes. I just love this program and use it a lot. Unfortunately, it didn't completely remove Trovi. I also tried Spybot and adaware to no avail. I searched and found an article that suggested using ADWcleaner. I hadn't used it before but I tried it and Trovi was gone. Infections vary and sometimes the old tried and true methods don't work. I will continue using Malwarebytes and now also Adwcleaner.thanks for the article.