How to Remove Trovi / Conduit / Search Protect Browser Hijack Malware

If your computer has been hijacked with an obnoxious malware that won’t let you change your home page, there’s a strong chance you’ve been infected with the Trovi Search Protect malware, which used to be known as Conduit. Here’s how to remove it.


How do you know this is malware? Instead of installing like it should, as a Google Chrome Extension, you’ll probably see that your extensions list doesn’t mention Trovi or Conduit at all. Instead, they are hijacking the browser process using Windows API techniques that no legitimate application should be using. For more details on that, you can read our series on using Process Explorer to troubleshoot Windows.


Removing the Trovi Search Protect Malware
This is really sad to say, but it’s actually important to use the Search Protect panel to turn off the bad settings first before uninstalling it. You can find the Search Protect icon in the system tray and then double-click on it to open up the panel.