how do I stop mystart.incredibar.com from hijacking a websites on my computer?

Question

I'm not sure how this happened but I did have dogpile.com as my homepage but for some reason yesterday I was redirected to mystart. incredibar. com/MB179?a=6OyMkPxv8x (I don't advise going to this link I'm just and I've added spaces so I hope it won't be clickable). Whenever I clicked on the button to go to the homepage or whenever I opened a new tab the mystart incredibar page would open. I was able to change what site came up when I opened a new tab and change my homepage to a different site but whenever I try to go to dogpile.com I still get redirected to mystart.

I've never typed mystart or incredibar into my address bar or any search engine. I've never clicked on the site in a search engine or on a webpage to go there. So I have no idea how this happened.
My mother has a linux computer she uses for the internet and has not had this problem.

I've looked up websites that explain how to get rid of mystart but they didn't seem to work.

I've run a spyware program and a virus removal program the spyware program found something and removed it the virus program didn't find anything. I ran both programs a second time and neither found anything else.

As far as I can tell I don't have mystart installed on my computer.

One website explained how to get rid of it using the about:config method, here's what they said to do:

Open the about:config page via the location bar and do a search for mystart via the Filter at the top of the about:config page.
Reset all mystart related prefs that appear bold (user set) via the right-click context menu to their default values.

To open the about:config page, type about:config in the location (address) bar and press the "Enter" key, just like you type the url of a website to open a website.
If you see a warning then you can confirm that you want to access that page.

Use the Filter bar at to top of the about:config page to locate a preference more easily.
Preferences that have been modified show as bold (user set).
Preferences can be reset to the default via the right-click context menu if they are user set
Preferences can be changed via the right-click context menu: Modify (String or Integer) or Toggle (Boolean)

I tried this but I still get redirected to mystart. I noticed right clicking gives the option to change the value. If I type in or paste in dogpile.com will that stop mystart from hijacking it?

Has anyone else had this problem. Has anyone else had dogpile.com or any other site hijacked by mystart?

I have windows xp professional service pack 3 and I'm using firefox. Do I need to completely remove firefox from my computer and reinstall it?

Can anyone give me easy to follow directions on how to solve this problem?

So for being so wordy and thanks in advance for anyone who can help me.

Answer 1

first check for tdss rootkit:



http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller



If no rootkit, try:



Start Menu. Select Control Panel> Add/Remove Programs look for IncrediBar* toolbar and Web Assistant in the list. Select the program and click Remove > button. Remove both components!



Open Internet Explorer. Go to Tools > Manage Add-ons>Search Providers> make it bing say>MyStart Search and Incredibar Customized Web Search remove.



Open Internet Explorer>Go to Tools> Internet Options. Select General tab>& check what your home page is

Answer 2

Try this:



Firstly, boot your computer to the Safe Mode menu screen. You do this by repeatedly pressing F8 as soon as you boot up. Once there, use the arrow keys to highlight Safe Mode with Networking. Continue to boot from there, by pressing Enter. You will now see some drivers being loaded. There will be a pause at some point. This usually lasts for no more than 30 seconds.



Start Internet Explorer, and when the program is open, click on the Tools menu and select Internet Options.



Now click on the Connections tab.



Now click on the Lan settings button.



Where it says Use a proxy server for your Lan, remove the tick in the tick box, then press the OK button to close this screen. Now press the OK button to close the Internet Options screen. You should now have web access.



Copy and paste this link into your browser’s address bar, and press Enter. It's a direct download for RKill. Save it to your desktop, then run it. When it's running, your desktop icons will vanish for a few seconds. When the notepad report is displayed, just close it. You may now delete RKill if you wish:



http://download.bleepingcomputer.com/grinler/rkill.exe



RKill SHOULD HAVE STOPPED THE INFECTION FROM RUNNING, BUT IT WON'T HAVE REMOVED IT.



Now open your browser and copy and paste this link into the address bar, and press Enter. It's a direct download for the free version of Malwarebytes' Anti-Malware (MBAM). Install it, get updates and run a full scan (still in Safe Mode):



http://www.myantispyware.com/mbam



After this, try rebooting normally. If that's successful, I recommend you run another full scan with MBAM. It will detect malware that wasn't running in Safe Mode.



Malwarebytes' Anti-Malware can be easily uninstalled, should you wish to do so, but it may prove to be beneficial in the future.



Hope this helps.

Answer 3

Linda, You are getting that page because the Hilton hotel makes you authorize your internet connection usually to make sure you agree you won't do anything illegal using their internet. They are not Hijacking your computer... they are providing YOU internet. You'll know when you get hijacked because viruses will slow down your computer. So here's the answer: USE A DIFFERENT INTERNET PROVIDER that IS NOT a hotel.