I’ve been unable to remove the MyStart by Incredibar from Firefox. It doesn’t show up as an add-on (I think it once did, but I removed several things recently), nor under programs to be removed. It hijacks my searches, but has no other apparent symptoms.
What I’ve done:
Manually removed any clearly related registry entry.
Removed a few files I managed to track down.
Reset all related entries in Firefox’s config file. These keep getting restored, somehow.
I’ve scanned with Avast (full, paid version of Avast’s internet security suite), IObit ASC’s malware removal tool, and Malwarebytes (free version). I’ve also used some of the recommended tools for producing logs, and I’ll attach those logs in subsequent posts.
I didn’t load this software in reaction to this threat - I’ve been using IObit for a couple of years. I’ve seen the recent allegations (none of which are yet of threat to consumers), and if they hold up, I won’t be buying any future versions. However, the product I already paid for is still part of my toolkit. I’ve seen nothing to indicate the software is harmful - just that the company is not entirely ethical and doesn’t deserve my further business.
I’ve gone and notified a malware expert to have a look at your logs.
So help is forthcoming soon.
Please do not take any offense at the posts re IObit software. They are only for your information. Last link from Pondus shows IObit detection rate is 20%, so whether you keep it on your system is up to you.
I don’t really use it for the detection. It’s primarily there for defragging and that sort of thing. It was inexpensive and helps me clean up a few things my other utilities don’t. Avast is my primary anti-malware software, and I break out MBAM when I run into a problem Avast doesn’t clean. I was surprised when neither of them saw the MyStart script as malware, since it’s cloaked and self-reinstalling.
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
I went in and checked the about:config file in Firefox. Incredibar once again has about 25 entries there. I’m going to reset all of those and see if they reappear.
Okay, I reset all of those entries, but as soon as I restart Firefox, they are returned to their prior state. Something is still out there keeping these active. Should I run the cleanup at this point, anyway?