How To Remove The MyStart By Incredibar Browser Search Redirection Virus (

What Is The MyStart Incredibar Virus (Incredibar Virus)?

MyStart Virus

Mystart Search Bar Virus

MyStart, often refereed to as Search Incredibar (, Mystart, Mystart search bar, Incredibar, Incredibar Search Tool, Mystart Incredimail, Incredimail., or MyStart Search Tool, is a very dangerous internet browser hijacker which uses browser helper objects (BHOs) and configures host settings in order to redirect infected victims using the internet to their websites. In particular: (not a malicious website)
Many internet users suspect this Mystart as being a mild, common, or realistic search tool. It is not, but user’s infected by MyStart can experience symptoms which range from simple CPU usage drains (unnoticed) to complete system crashes. The MyStart search tool is definitely a virus. Mystart is utilized by the use of backdoor processes or Trojans.

McAfee detects Incredibar installer as Heuristic.LooksLike.Win32.Suspicious.B., TrendMicro detects it as TROJ_ENCPK_0000009.TOMA and ESET also sees it as a threat Win32/ImInstaller potentially unwanted application.
Potential Threat Detected

If MyStart is not removed from your computer:
  • Your computer can become malformed and operate improperly.
  • Your browser settings become corrupted and internet usage is taken hostage by a constant redirection setting to drive-by-download websites which can open the door for more infections, and over-all cause a wide range of operating system related issues associated with Trojans (Privacy threat).
  • Computer accesses may become blocked or locked if not MyStart is not addressed, similar to ransomware.

What Are Symptoms Of The MyStart Virus?

Symptoms for the MyStart virus range. Some infected users may notice only a few symptoms, some may have severe issues, and some infected computer users may never detect any symptoms. All symptoms listed below occur without consent of the computer user.

  • MyStart uses browser helper objects (in this case search tools) and infects some users by installing Mystart.incredibar search toolbar into their internet browser (most vulnerable: Mozilla FireFox) which redirects internet users to MyStart’s websites. Some internet users are redirected for every search or webpage they visit.


  • User initiated browsing and search is redirected to while using the internet.
Mystart by incredibar
  • High levels of CPU usage is used due to MyStart processes, which can cause systems to crash or become malformed.

How To Remove The MyStart Browser Search Virus

There are many ways to remove the MyStart for different victims. After removal it is recommended to change the preference settings in each internet browser installed on your system which have been altered by MyStart (such as home page settings).

  1. Malware Removal Sofware
  2. Disable Add-ons And Extensions
  3. Manually Kill Processes, Delete Files, And Delete Values
  4. Restore Computer To Date And Time Before Infection

1. Malware Removal Software

The easiest way to remove MyStart.Incredibar is by utilizing the free version of Malwarebytes. Malwarebytes is proven to remove the MyStart Virus.

  • Try Malwarebytes, the Leader in Malware Removal
  • malwarebytes removes mystart search virus

    2. Disable Malicious Add-ons And Extensions

    If MyStart is infecting your search tools by use of Browser Helper Objects, there is most likely an add-on or extension in your internet browser which must be disabled and removed. We will detail instructions for Mozilla Firefox first since FireFox is the most common browser infected by MyStart, then we will proceed to Google Chrome, Microsoft Internet Explorer, and Apple Safari.

    Mozilla Firefox

    Step 1: Open Firefox and navigate to Tools > Add-ons (or Ctrl+Shift+A)
    Tools Addons
    Step 2: Select Extensions, find the MyStart extension (MyStart, MyStart.Incredibar, or any other suspicious plugin) and click disable, then remove.
    Remove Incredibar Firefox
    Step 3: Click on the magnifying glass search icon as shown in the image below and select Manage Search Engines…
    Mystart Search Engine
    Step 4: Choose the MyStart Search from the list of search engine, click Remove to succesfully remove it. Proceed to click OK to save changes.
    Mystart search engine list Firefox
    Step 5: Navigate to Tools > Options. Under the General tab reset the startup homepage or change it to your preferred search engine (ie:, etc).
    Change Mystart Search Engine Firefox
    Step 6: In the URL address bar on Firefox, type: about:config and hit Enter.
    Firefox Config
    Step 7: Finally click I’ll be careful, I promise! to continue.
    Ill be careful I promise
    Step 8: In the search filter at the top of Firefox, type: mystart
    Step 9: You should see all the preferences that were changed by IncrediBar toolbar. To complete the Mystart removal, right-click on the preference and select Reset to restore default value and continue to reset all found preferences!
    Reset Preferences Mystart Hijack

    Optional: Block MyStart Cookie (Firefox)
    1. From the Tools menu, select Options
    2. In the upper section of the Options window, click Privacy
    3. In the Cookies tab, click Exceptions
    4. In the new Exceptions – Cookies window, enter

    Google Chrome

    Step 1: Open Chrome, click on the Settings Icon (wrench), and navigate to Tools > Extensions.
    Chrome Extensions
    Step 2: Select the MyStart plugin from the list (MyStart, MyStart.Incredibar, or any other suspicious plugin) and click disable, then remove.
    Incedibar Extension Google Chrome
    Step 3: Click on the wrench icon once again and select Settings.
    Chrome Settings To Remove Incredibar by Mystart
    Step 4: Click the Manage search engines… button.
    Manage Search Engines Chrome
    Step 5: Select your preferred search engine from the list and make it your default search engine (ie: Google).
    Google Chrome Mystart Search Engine Removal
    Step 6: Select MyStart Search from the list and remove it by clicking the “X” mark as shown in the image below to finish the removal process.
    Default Search Engine Settings Mystart

    • Please note: To search which extensions are currently running on Chrome navigate to Tools > Task Manager

    Microsoft Internet Explorer

    Step 1: Open IE, click the Tools button and then select Manage Add-ons.
    Manage Add Ons IE
    Step 2: Select Search Providers. Choose Bing or Live Search search engine and make it your default web search provider (Set as default).
    Live Search Internet Explorer
    Step 3: Remove MyStart Search and Incredibar Customized Web Search engine providers and close the window.
    Mystart Search Remove
    Step 4: Finally navigate to Tools > Internet Options. Select the General tab and click the “use default” button or enter your preferred homepage, such as instead of Click OK to save the final changes.
    Internet Explorer Change Mystart Search Engine

    Optional: Block MyStart Cookie (IE)
    1. From the Tools menu of Internet Explorer, select Internet Options
    2. Select the Privacy tab, and then click Sites. The Per site privacy actions window will be displayed
    3. In the Per site privacy actions window, enter in the Address of Web site field.
    4. Click Block
    Optional: Restricted site option (IE)
    1. Access: Tools(Alt-x) > Internet OptionsSecurity > Restricted sites
    2. Click the “Sites” button and enter:

    Apple Safari

    Step 1: Open Safari, go to Preferences and click Extensions.

    Step 2: Remove/Disable the MyStart extension.
    OS Mountain Lion Mystart

    3. Manual Removal Instructions To Remove

    There are separate ways to manually remove MyStart. First of all, check your Window’s uninstaller and uninstall any MyStart programs:

    • Navigate to Control Panel > Add or Remove Programs ( or Uninstall a program)
    • Uninstall MyStart associated programs

    Uninstall Incredibar-Games EN Toolbar

    1. Kill the processes
    • Open Window’s task manager (Ctrl+Alt+Delete > Task Manager)
    • Click the “Processes” tab, browse for the MyStart virus processes (below), right-click each and select “End Process”. (random characters: unknown letter and or number sequences)
    (random characters).exe of
    Fake svchost.exe system process
    2. Delete the associated files
    %Windows%\system32\fake consrv.dll
    %Windows%\system32\fake svchost.exe
    3. Remove related MyStart registry values
    • Click the “Start” menu and  type “regedit” in the search field, then press Enter to access Window’s registry editor.
    • While the Registry Editor is open, search and delete the following registry entries listed below by right clicking them and selecting delete.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch=(site address)

    4. Restore Computer To Date And Time Before Infection

    Restoring your Window’s computer to a date and time before you computer was infected by the MyStart viruses will ensure the safety of your internet browser if orchestrated correctly. We have provided instructions for a simple restore for victims who are able to access their desktops correctly, as well as instructions to restore for victims who can not access their operating systems.

    Start Menu Restore

    Start Menu System RestoreStandard directions to quickly access Window’s System Restore Wizard.
    1. Access windows Start menu and click All Programs.
    2. Click and open Accessories, click System Tools, and then click System Restore.‌
    If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
    3. Restore your computer to a date and time before infection.

    Safe Mode With Command Prompt Restore

    If you can not access your operating system, this is the suggested step.
    1. Restart/reboot your computer system. Unplug if necessary.
    2. Enter your computer in “safe mode with command prompt”. To properly enter safe mode,repeatedly pressF8 upon the opening of the boot menu.

    Safe mode with command prompt

    3. Once the Command Prompt appears type “explorer” .

    Comand Prompt Type Explorer

    4. Once Windows Explorer shows up browse to:

    • Win XP: C:\windows\system32\restore\rstrui.exe and press Enter
    • Win Vista/Seven: C:\windows\system32\rstrui.exe and press Enter

    System32 rstrui
    5. Follow all steps to restore or recover your computer system to an earlier time and date, before infection to complete.
    Restore system files and settings
    More information on Window’s system restore:

    Sean Doyle

    Jacob is a tech author and engineer with over 20 years of experience in cybersecurity, privacy, malware, Google Analytics, online marketing, and other topics. Jacob's content has been featured in numerous publications.

    30 Responses

    1. Anonymous says:

      thank you!

    2. bacn123 says:

      it downloaded automatically
      and usually when this happens
      i don’t click anything with something i haven’t seen
      so i looked up how to get rid of this
      found this site
      got rid of it

    3. angel says:

      Ive been so pissed off, for so many days. Thank you sooooo freaking much. I could do flips right now if my body was capable. Woo

    4. Zeus says:

      It worked and the process was easy to follow.

    5. Anu says:

      Thank you very much .. its really useful 🙂

    6. S. Diana S. says:

      This isn’t exaqctly what I need, but it is close. My other computer’s address bar searches are hijacked to a search engine called “Bearshare,” not
      “Mystart,” so I might need something a little different. The computer also runs incredibly slowly, and until I read this, I didn’t connect its loss of speed with the browser hijacking – now I see the same virus could be responsible for both of them. I would appreciate any suggestions of how to remove the “Bearshare” search. (I have my searches set to Google, but they switch to Bearshare.) The computer has XP and Internet Explorer – I think IE8. Thanks!

      • Anonymous says:

        instead of typing in mystart try typing bearshare. I had one called gadgetbox and when I typed that in the preferences came right up.

    7. Anonymous says:

      Thanks! solution really works.

    8. Chuck says:

      Fantastic article. Spot on, worked great. Easy to follow

    9. Abbie says:

      I followed each step and it seems to be gone, is there any way of checking for sure?

    10. Anonymous says:

      Just used your methodology to remove MyStart from Firefox. Other than some differences in my Firefox version – it WORKED!!! Much appreciated. Thanks.

    11. Anonymous says:

      thank you!!!

    12. Anonymous says:

      Excellent clear instructions that work. Thankyou!

    13. Sudeshna says:

      Thank you so much. totally worked 🙂

    14. Ahmed says:

      Works great, thank you.

    15. Alejandra González Ortega says:

      Muchas, muchas gracias. Excelente tutorial. Solucioné mi problema. Logré quitar el mystart que ocupaba el lugar de mi página principal. Todo lo había intentado y ustedes me dieron la solución. Mil besos y bendiciones por su generosidad.

    16. Bybe says:

      Nice clean rightup, thanks a lot 😉

    17. Anonymous says:

      great tutorial

    18. nipoco says:

      The best tutorial I’ve seen. Totally recommend it.

    19. kanadol says:

      when I click on your sugestion links,I get the MyStart page,??? maby you redirect it showing this links?

    20. kanadol says:

      I try everything I red about and find only one which help me with google chrome,
      click wrench or three lines in top right corner ,setting and at the top is onstartup
      third line is Open a specific page or set of pages click blue set pages and remowe this shit from your pc

    21. Sean Doyle says:

      Kanadol, I have no idea what point you are trying to convey.
      I would never place any links to Mystart.Incredibar, you are infected, therefore your web browser is redirecting.
      Follow the directions and you’ll be fine.

    22. kanadol says:


    23. loretta says:

      Thank You so much @kanadol….I just removed it following your instruction..

    24. loretta says:

      WTF!! I’m sure I typed Thanks You so much @kanadol. I removed the damn thing from my chrome following kanadol’s instruction. Thanks to @sean as well coz i removed it from FF using urs..

    25. loretta says:

      I did everything but I still have it on google chrome. Its frustrating. I did fixed firefox but chrome is still mystart with that stupid iphone image

    26. anil says:

      the best way is to uninstall the browser and install it again……this is much easier than other ways

    1. September 18, 2012

      […] here u can find information to removed mystart incredibar removed from Mozilla Firefox-Google Chrome -Safari Check this Video and more information about is check this Post […]

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    This site uses Akismet to reduce spam. Learn how your comment data is processed.