ToolbarUpdaterService: what it is and how to remove it

ToolbarUpdaterService (can also be called as Toolbar Updater Service) is a suspicious component that belongs to StartNow Toolbar. Just like this application, this component can be installed without any permission asked because it has been actively spread in a bundle with freeware and shareware.

Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.

Automatic

Get a free scan and check if your PC is infected.

Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.

If ToolbarUpdaterService keeps coming back after uninstalling, a scan can find what reinstalls it.

Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Do it yourself · free Remove ToolbarUpdaterService yourself 5 steps, about 15 minutes, no software needed.

Start the steps
ToolbarUpdaterService: uninstall from windows 1
ToolbarUpdaterService as our 2015 report showed it.

ToolbarUpdaterService: summary

Detection namesNo Microsoft detection name is known
DistributionNot recorded in the old report
DamageNot recorded in the old report
NameToolbarUpdaterService
TypeSearch hijacker extension
SymptomsAn unknown program in Installed apps
Removal

Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged.

Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.
Show 4 more facts
EvidenceOne write-up by a security site; details still limited
ProgramToolbarUpdaterService
First seen7 May 2015
Facts checked7 October 2026

Is ToolbarUpdaterService dangerous? What it collects

From our report of May 2015 · not reviewed since

What is ToolbarUpdaterService?

ToolbarUpdaterService (can also be called as Toolbar Updater Service) is a suspicious component that belongs to StartNow Toolbar.

Just like this application, this component can be installed without any permission asked because it has been actively spread in a bundle with freeware and shareware. If you don't monitor installation of such programs as download managers, PDF creators, video streaming software and similar programs, you may fall for installing ToolbarUpdaterServicem on your computer.

If you get more information about infiltration methods that are used by browser hijackers, adwares and other potentially unwanted programs, you should check the next paragraph of this article. If ToolbarUpdaterService gets ability to infiltrate its target PC system, it may hijack each of your web browsers (Internet Explorer, Google Chrome, Mozilla Firefox, etc.) and then may start forcing you to use StartNow Toolbar.

You may discover that you can't avoid this program no matter which web browser you decide to use. In addition, you may find out that you can't use your favorite search engine because this toolbar may start blocking Google, Yahoo, Bing and other search engines.

Finally, there are lots of PC users who reported that they can't browse the web because of slow downs and other issues that are usually noticed after infiltration of ToolbarUpdaterService hijacker. That's because this process tends to consume up to 100% of all computer's resources and may even freeze it.

Please, do NOT waste your time with ToolbarUpdaterService and remove this program from the system ASAP. if you want to make sure that each of related programs is gone, you should think about installing or , which is compatible not only with Windows but with Mac OS X as well. After downloading any of these programs, you should run a full system scan.

From our report of May 2015 · not reviewed since

How can ToolbarUpdaterService hijack my computer?

ToolbarUpdaterServic, StartNow Toolbar and other suspicious programs are mostly spread in a bundle with freeware and shareware as optional components.

In order to avoid them, you should start monitoring installation of every freeware. What should you do that for that? This process requires reading Privacy Policy and End User's License Agreement when downloading freeware to the system.

In addition, make sure you uncheck all suspicious check marks that claim that you agree with the installation os such additional components as browser add-ons, extensions, plugins and toolbars. You should also stay away from all offers to modify each of your web browsers and alter the start page or the default search engine.

How to remove ToolbarUpdaterService

How to remove ToolbarUpdaterService and get your search engine back

Remove the extension first.

The search settings only stay fixed once nothing on the PC can change them again.

  1. Step 1: Remove extensions you did not add

    In Chrome open chrome://extensions, in Edge edge://extensions, and in Firefox the menu > Extensions and themes.

    Remove every extension you do not remember adding, especially search, new tab, coupon, PDF, weather or video downloader add-ons. Check every browser and every profile, because each keeps its own list.

    If an extension has no Remove button or comes back, a browser policy holds it (see "Managed by your organization" in the procedure below). The pages are the same on Windows 11 and Windows 10.

    Chrome menu with Extensions and Manage extensions highlighted
    Chrome on Windows 11: More > Extensions > Manage extensions.

    Full procedure with screenshots: Remove a browser extension

  2. Step 2: Put the search engine back

    In Chrome open Settings > Search engine > Manage search engines and site search, make an engine you trust the default, and delete entries you did not add.

    In Edge type search engine into the search box at the top of Settings and open Manage search engines; in Firefox use Settings > Search. Then check the homepage and the new tab page in the same settings, because hijackers change all three.

    If the wrong engine is back after a restart, an extension, a program or a policy still sets it, so finish the other steps and check again. The settings are the same on Windows 11 and Windows 10.

    Chrome Settings with the Search engine and On startup sections
    Chrome on Windows 11: check Search engine and On startup.

    Full procedure with screenshots: Reset a browser and fix a hijacked search engine

  3. Step 3: Uninstall ToolbarUpdaterService

    ToolbarUpdaterService is removed like any other program, from the list of installed apps. In Windows 11 that is Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and in both you can also use Control Panel > Programs and Features.

    Select ToolbarUpdaterService, click Uninstall and follow the uninstaller to the end. Then look at the entries just above and below it when the list is sorted by date: bundled programs install at the same minute.

    Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix

  4. Step 4: Reset the browser

    A reset removes what the steps above could miss:

    • changed start pages
    • site permissions
    • hidden settings

    In Chrome open Settings > Reset settings > Restore settings to their original defaults; in Edge Settings > Reset settings; in Firefox Help > More troubleshooting information > Refresh Firefox.

    Tip: Bookmarks and saved passwords stay, while extensions are turned off and the search engine and start page return to the defaults.

    Reset every browser on the PC, including Edge, which Windows 11 and Windows 10 always have.

    Chrome Settings page with the Reset settings section open
    Chrome on Windows 11: Settings > Reset settings.

    Full procedure with screenshots: Reset a browser and fix a hijacked search engine

  5. Step 5: Scan the PC, then run the offline scan

    A scan finds the parts of ToolbarUpdaterService that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.

    Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.

    It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.

    Windows Security Scan options with Microsoft Defender Antivirus offline scan selected
    Windows 11: Windows Security > Virus & threat protection > Scan options.

    Full procedure with screenshots: Run a Microsoft Defender Offline scan

Instructions for each browser and system

The detailed steps for every browser and system this guide covers. Open the one you use.

Uninstall from Windows

Uninstall from Windows 10/8:

  1. Type Control Panel into the Windows search box and open the result.
  2. Under Programs, select Uninstall a program.Uninstall from Windows 10/8

Uninstall from Windows 7/XP:

  1. Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
  2. In Control Panel, select Programs > Uninstall a program.Uninstall from Windows 7/XP

Remove the unwanted program:

  1. In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
  2. If User Account Control appears, click Yes to confirm, then complete the removal.Uninstall the unwanted program from Windows
Remove from Google Chrome

Delete malicious extensions from Google Chrome:

  1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
  2. In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.Remove extensions from Chrome

Clear cache and web data from Chrome:

  1. Click on Menu and pick Settings.
  2. Under Privacy and security, select Clear browsing data.
  3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
  4. Click Clear data.Clear cache and web data from Chrome

Change your homepage:

  1. Click menu and choose Settings.
  2. Look for a suspicious site in the On startup section.
  3. Click on Open a specific or set of pages and click on three dots to find the Remove option.

Reset Google Chrome:

If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:

  1. Click on Menu and select Settings.
  2. In the Settings, scroll down and click Advanced.
  3. Scroll down and locate Reset and clean up section.
  4. Now click Restore settings to their original defaults.
  5. Confirm with Reset settings.Reset Chrome 2
Remove from Microsoft Edge

Delete unwanted extensions from MS Edge:

  1. Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
  2. From the list, pick the extension and click on the Gear icon.
  3. Click Remove.Remove extensions from Edge

Clear cookies and other browser data:

  1. Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
  2. Under Clear browsing data, pick Choose what to clear.
  3. Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.Clear Edge browsing data

Restore new tab and homepage settings:

  1. Click the menu icon and choose Settings.
  2. Then find On startup section.
  3. Click Remove next to any suspicious startup page.

Reset MS Edge if the above steps did not work:

  1. Press on Ctrl + Shift + Esc to open Task Manager.
  2. Click on More details arrow at the bottom of the window.
  3. Select Details tab.
  4. Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.Reset MS Edge
Instructions for Chromium-based Edge

Delete extensions from MS Edge (Chromium):

  1. Open Edge and click select Settings > Extensions.
  2. Delete unwanted extensions by clicking Remove.Remove extensions from Chromium Edge

Clear cache and site data:

  1. Click on Menu and go to Settings.
  2. Select Privacy, search and services.
  3. Under Clear browsing data, pick Choose what to clear.
  4. Under Time range, pick All time.
  5. Select Clear now.Clear browser data from Chroum Edge

Reset Chromium-based MS Edge:

  1. Click on Menu and select Settings.
  2. On the left side, pick Reset settings.
  3. Select Restore settings to their default values.
  4. Confirm with Reset.
  5. This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.Reset Chromium Edge
Remove from Mozilla Firefox (FF)

Remove dangerous extensions:

  1. Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
  2. Select Add-ons.
  3. In here, select the unwanted extension and click Remove.Remove extensions from Firefox

Reset the homepage:

  1. Click three horizontal lines at the top right corner to open the menu.
  2. Choose Settings.
  3. Under Home, set your preferred homepage and new tab settings.

Clear cookies and site data:

  1. Click Menu and pick Settings.
  2. Go to Privacy & Security section.
  3. Scroll down to locate Cookies and Site Data.
  4. Click on Clear Data...
  5. Select Cookies and Site Data and Temporary cached files and pages, then click Clear.Clear cookies and site data from Firefox

Reset Mozilla Firefox

If clearing the browser as explained above did not help, reset Mozilla Firefox:

  1. Open Mozilla Firefox browser and click the Menu.
  2. Go to Help and then choose Troubleshooting Information.Reset Firefox 1
  3. Under Give Firefox a tune up section, click on Refresh Firefox...
  4. Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.Reset Firefox 2
Delete from Safari

Remove dangerous extensions:

  1. Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
  2. Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.Remove extensions from Safari

Clear history and website data:

  1. Click Safari in the menu and pick Clear History.
  2. Set Clear to all history and confirm with Clear History.Clear history from Safari

Reset Safari:

  1. Click Safari in the menu and select Preferences > Advanced.
  2. Enable Show Develop menu in menu bar.
  3. From the menu bar, click Develop and select Empty Caches.Reset Safari
Delete from macOS

Remove the unwanted application:

  1. From the menu bar, select Go > Applications.
  2. In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).Uninstall from Mac

Delete leftover files and folders:

  1. Select Go > Go to Folder.
  2. Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
  3. Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.Delete leftover files from Mac
  4. Finally, empty the Trash to permanently remove the leftovers.

Do not let government spy on you

The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.

Avoid any unwanted government tracking or spying by going totally anonymous on the internet.

You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.

Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.

Backup files for the later use, in case of the malware attack

Computer users can suffer from data losses due to cyber infections or their own faulty doings.

Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.

From our report of May 2015 · not reviewed since

How to remove ToolbarUpdaterService virus?

ToolbarUpdaterService.exe is capable of hiding itself deep inside the system because the main thing what it seeks is to avoid its removal.

Of course, it also seeks to protect StartNow Toolbar, which is related to it. If you want to make sure that all related programs (adwares and browser hijackers) were eliminated form your computer, you should use automatic removal of this program. However, if you don't want to download any anti-spyware, you can also remove ToolbarUpdaterService with a help of removal guide that is given below.

Questions about ToolbarUpdaterService

What is ToolbarUpdaterService and why is it on my PC?

ToolbarUpdaterService is a program that was installed on the PC, most likely together with something else you downloaded. Free software sites and many installers add extra programs on setup pages with pre-ticked boxes, so the extra install looks like your choice even though nobody read the page.

Check the install date in Settings, Apps, Installed apps: the program you installed that day is the probable carrier. If you do not need ToolbarUpdaterService, uninstall it. If it belongs to your hardware or to a program you use, search its exact name and publisher first, because drivers and their tools can have unfamiliar names.

ToolbarUpdaterService came back after I uninstalled it. Why?

Something else is reinstalling it. Common causes are a second program from the same publisher, a scheduled task that downloads it again, or a browser extension that keeps prompting for it. Sort Installed apps by install date and uninstall each entry from the same day that you did not choose.

Then open Task Scheduler and look in the Task Scheduler Library for tasks with updater-style names that you do not recognise. Check Startup apps in Task Manager too. If ToolbarUpdaterService still returns, start Windows in Safe Mode, uninstall it there and run a Microsoft Defender offline scan, which looks for loaders that ordinary scans can miss.

Why can't I change my search engine back?

Because something keeps setting it. If an extension controls the search engine, Chrome and Edge show a note that an extension is controlling this setting, and your change is reverted. If a policy controls it, the field is greyed out and the browser shows Managed by your organization.

Remove the extension first, then the policies, and only then change the search engine; the change will stay. If it still reverts, look for a program in Installed apps or a scheduled task that reinstalls the extension.

What do I lose if I reset Chrome or Edge?

Less than you might think. A reset turns off all extensions, which you can turn back on one by one, restores the default search engine, home page, new tab and pinned tabs, and clears cookies, so you are signed out of most sites.

Bookmarks, history, saved passwords and autofill data stay. Firefox's equivalent, Refresh Firefox, keeps the same essentials but removes add-ons completely. Before you reset, make sure you know your main passwords or have them saved, since you will need to sign in again.

Is only one browser affected?

Often not. Programs that install hijackers tend to change every browser they find, and sync can carry the extension to other computers signed in to the same browser account. Check Chrome, Edge and Firefox, even the ones you rarely use, and look at the shortcut targets on the desktop and taskbar for each.

If you use sync, remove the extension while signed in so the removal syncs too. Also check the On startup setting and the new tab page, because hijackers change those as well as the search engine.

Is ToolbarUpdaterService a virus?

Not in the strict sense: ToolbarUpdaterService is unwanted software, classed here as a search hijacker extension, not a self-copying virus. Security programs often label such software as adware, a potentially unwanted program or a browser hijacker.

It still needs removal, because it changes browser settings, shows ads and can lead you to unsafe pages. The larger risk is clicking an ad that leads to a fake update or scam page.

How did ToolbarUpdaterService get on my computer?

Just like this application, this component can be installed without any permission asked because it has been actively spread in a bundle with freeware and shareware. Software of this kind often comes bundled with free programs, fake updates or downloads from unofficial sites.

It can also arrive through a browser extension or a notification you allowed on a spam page. Think back to what you installed or allowed just before the first ad or redirect appeared.

Will my antivirus detect ToolbarUpdaterService?

Not always, because our check found no Microsoft Defender detection name for it. Our check found no Microsoft Defender detection name for it, so a scan may not name it. Update the security program first, then run a full scan instead of a quick one.

Also scan with a second on-demand scanner, because one program can miss what another finds. A clean scan does not prove the signs are gone, so check the browser extensions and installed programs by hand too.

Will Fortect remove ToolbarUpdaterService?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For ToolbarUpdaterService, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Sources

More removal guides

Remove Zippyshare virus

Zippyshare - a file sharing site which may cause some problems Zippyshare is a legitimate website that people use to upload files up to 500MB in size and share links.Browser HijackersMedium riskJake Doevan ·

Remove Nebula Search browser hijacker

Nebula Search - a potentially unwanted program that changes your browser settings to serve you sponsored content regularly Nebula Search is yet another browser hijacker that can be downloadedBrowser HijackersMedium riskGabriel E. Hall ·

Remove Is Wave Browser malware? What it is and how to remove it from Windows

Wave Browser (WaveBrowser, from Wavesor Software) is not a classic virus, but Malwarebytes detects it as a potentially unwanted program, PUP.Optional.Wave, and says some copies are installed without the user's...BHMedium riskUgnius Kiguolis ·

Remove Omni-search.net virus

Omni-search.net - a browser hijacker that aims at Chrome and Firefox users Omni-search.net is a domain that leads to BlaSearch. It’s a suspicious search engine that redirects searches to YahooBrowser HijackersHigh riskAlice Woods ·

Questions and experiences: ToolbarUpdaterService

Still seeing it, or found something we did not cover? Ask here: members and our editors answer. Reading is open; writing needs a free account.

0 comments

…

5,539 members already hereReading, writing, commenting and voting. 0 verified · 264 joined this year