Member Avatar for DaniWeb4Jim

I have tried everything to get rid of a Tuvaro page that keeps coming up everytime I select a new tab in Chrome. I have it in internet explorer, sometimes. Has anyone gotten rid of that virus lately? Any ideas? I used ADWcleaner, Combofix, Malwarebyte's AntiMalware and Spyhunter. I use Avast Free AntiVirus.

Edited by DaniWeb4Jim
  • 3 Contributors
  • 2 Replies
  • 219 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by think618

Dani AI

Generated

Short summary and why this keeps happening: already ran several scanners, and and pointed to removal guides — those are good first steps. Tuvaro behaves like a browser hijacker/adware and often survives scanners because it attaches itself in any of several places (Chrome extensions or policies, a modified shortcut, a scheduled task or startup entry, or a stubborn profile). The removal approach below is ordered from least-destructive to most, so that a working browser and bookmarks are preserved whenever possible.

Action checklist (in order)

  1. Turn off Chrome sync before removing extensions. If sync is on, a removed extension can be reinstalled from Google’s servers.
  2. Remove suspicious extensions at chrome://extensions and remove Tuvaro from search engines at chrome://settings/searchEngines. Check On startup at chrome://settings/onStartup for unwanted pages.
  3. Inspect every Chrome shortcut (desktop, taskbar, start menu): Right-click → Properties → Target. Remove any URL after the chrome.exe reference.
  4. Uninstall unknown programs from Control Panel → Programs and Features.
  5. Check proxy and LAN settings (Internet Options → Connections → LAN settings) and clear any proxy.
  6. Use Autoruns (Sysinternals) run as Administrator and Task Scheduler to find and disable program entries that re-launch installers or extensions. Be cautious and back up before changing entries.

Where to look (copy these paths to check)

Hosts file: C:\Windows\System32\drivers\etc\hosts
Chrome extensions folder: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions
Chrome policies (Registry): HKCU\Software\Policies\Google\Chrome
                           HKLM\Software\Policies\Google\Chrome
Startup Run keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Run

If it still returns: create a fresh Chrome profile (export bookmarks first), delete the old profile folder, then start Chrome clean. For persistent, stealthy cases consider an offline rescue scan (bootable rescue media) or a clean Windows reinstall as last resort. Always back up bookmarks/passwords, and create a system restore point before manual registry edits.

Prevention notes: use custom install for free software to uncheck bundled offers, keep Chrome and Windows updated, and disable sync while cleaning so a compromised profile can’t reapply the hijack. This sequence complements the guides linked earlier and targets the common persistence points scanners miss.

Recommended Answers

All 2 Replies

Member Avatar for think618

also includes step by step tuvaro removal.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.