声明：
Declaration：
由于网络中的病毒virus/malware等存在随时变异或者对应多种感染方式等情况，本文所针对的处理方法仅针对本次样本负责，个人如有误操作，后果自负。如需帮助，可以扫我头像加我微信（KingisOK）或者邮件（julius.luck001#mail.com 请将#换成@）联系我！
Because the virus/malware in the network is mutated at any time or corresponds to multiple infection methods, the processing method targeted in this paper is only responsible for this sample. If the individual has misoperation, the consequences are at your own risk. If you need help, you can scan my picture plus my WeChat (KingisOK) or email (julius.luck001#mail.com please #change to @) contact me!
现象
Phenomenon：
前段时间收到远在英国的网友加微信，感染了malware，浏览器被劫持，希望能提供帮助进行移除，大致的表现情况是：使用Google搜索内容时，跳转的页面会闪一下后马上跳转到trovi搜索，反馈回来的网址是www.trovi.com，很明显搜索引擎发生了被修改和劫持，向对方获取了一些基本的文件和浏览器信息，发给解决问题的脚本，对方答复运行两次后解决了这个问题，现将这个问题的相关可疑文件和路径公布出来，以给有同样问题的读者参考。由于双方互加了微信，所以解决问题时沟通也比较方便！经过一些详细了解，发现其主要从事设计工作，因为安装了很多Adobe的产品，怀疑是恶意网站仿冒Adobe产品的更新，让该网友安装了恶意插件。
Some time ago, I received a friend who was far away in the UK and added WeChat. I was infected with malware. The browser was hijacked. I hope you can help to remove it. The general performance is: when using Google to search for content, the page that jumps will flash immediately. Jump to trovi search, the feedback back to the website is www.trovi.com, it is obvious that the search engine has been modified and hijacked, obtained some basic files and browser information to the other party, sent to the script to solve the problem, the other party replies After solving the problem twice, the suspicious files and paths related to the problem are published for reference to readers with the same problem. Since both parties have added WeChat, communication is easier when solving problems! After some detailed understanding, it was found that it was mainly engaged in design work, because many Adobe products were installed, and it was suspected that the malicious website had an update of the fake Adobe product, and the user installed a malicious plug-in.
分析
Analysis：
根据用户反馈提供的信息，收集如下：
Based on the information provided by user feedback, the collection is as follows:
经过对上述文件的分析，初步怀疑跟下述路径及其关联的程序有关：
After analysis of the above documents, initial doubts are related to the following paths and their associated procedures:
~/Library/Application\\ Support/.spotlight
~/Library/Safari/Extensions/AnySearch.safariextz
~/Library/LaunchAgents/com.vladalexa.MagicPrefs.plist
~/Library/LaunchAgents/com.xyz.*
~/Library/LaunchAgents/com.xyz.abc.Finder.plist*
/Library/LaunchAgents/com.wacom.wacomtablet.plist
~/Library/Application\\ Support/.rwt3
~/Library/Application\\ Support/.3bed
/Library/Application\\ Support/Macromedia如果你有发现近期出现问题前后才生成的上述文件，请将其通过terminal终端运行进行移除。
If you have found the above files that were generated before and after the recent problem, please remove them through the terminal .
处理方法：
Approach:
移除上述路径下的配置文件，如果有。检查是否还存在相关的其他配置文件，杀掉该进程，再重启电脑。
实际上，上述文件对当前Mac系统的影响微乎其微，即使有误删，后期根据需要可以重新安装，所以删除不会影响系统的正常运行。
可疑文件全部移除完成后，最好重置浏览器，或者移除之前保存的状态数据
Remove the configuration file under the above path, if any. Check if there are other related configuration files, kill the process, and restart the computer.
In fact, the above files have little impact on the current Mac system. Even if it is deleted by mistake, it can be reinstalled as needed later, so the deletion will not affect the normal operation of the system.
After all the suspicious files have been removed, it is best to reset the browser or remove the previously saved state data.
~/Library/Saved\\ Application\\ State/com.apple.Safari.savedState
~/Library/Saved\\ Application\\ State/com.google.Chrome.savedState再启动查看是否恢复正常。
Restart to see if it returns to normal.
忠告：
Advice：
1，苹果电脑要更新和下载软件尽量去App Store，其他浏览器突然弹出的说电脑有问题或者软件需要更新，都尽量不要点！！！！
2，电脑设置中安全设置，选项选择只安装认证过的软件！！！
1, Apple computer to update and download software as far as possible to the App Store, other browsers suddenly pop up saying that the computer has a problem or the software needs to be updated, try not to point! ! ! !
2, the security settings in the computer settings, the option to choose only installed certified software! ! !
如果觉得本文对你有帮助，那就赞一个或者评论一个吧！
If you feel that this article is helpful to you, then praise or comment one!
