How annoying! Just following having dealt with removing MacKeeper, Firefox went CRAZY! Links were going to the wrong places - and NOT pages me or anyone else would ever want to visit. An adware monster had obviously made it's way onto my Mac. Arrrrrr. This wasn't what I sat down to do.
Take a deep breath. I'm sure this is also due to using that online file-migration tool that also seemed responsible for MacKeeper. Ah. OK. What's happening here? OK. Confession, it's been like two or three weeks since the intrusion occurred and I don't remember exactly how I realized that Trovi was the name to search for. But as Trovi basically hijacks your browsers search mechanism, I think (after looking through the Activity Monitor with no luck) I actually noticed the name in the search field at the top of Firefox.
Apparently there are variations of the virus for PC as well as Mac and if you're on a PC, this is a method from MalWareTips.
First I read through a bunch of the long, detailed and tech-heavy posts on the Apple Forums. Without success there, I want for the less interesting or informative tried and true Malware Tips Approach using the Malwarebytes Anti-Malware for Mac (formerly AdwareMedic), then manually removing Trovi from Firefox (and Safari, which had also been affected (and infected).
I then installed a free version of Sophos. I have also read good reviews of AVG Antivirus. I found a side by side review of the two here, that also includes a feature to compare each versus a dozen or more other antivirus options.
If this happens or has happened to you, try to enjoy it. Why not? Deep breaths and a soul-fulfilled sense of humor.
(Trojan Horse photo taken by Deror Avi, July 2005)