How to disable Opera start-up
-
A Former User last edited by 21 Mar 2016, 13:19
If Opera is starting automatically every time Windows starts that sounds like some sort of malware symptom.
If you're sure that there isn't a shortcut to it in the startup folder (if so delete it) it must be running from the registry or from a Windows Scheduled task.
Check the Task Scheduler "library" to see if there's anything there whose "target" points to launcher.exe. If there is, delete it.
Otherwise, run regedit and look atHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and see if Opera is listed there, and also in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Anything there should have shown up in Task Manager though.
-
donq last edited by 21 Mar 2016, 17:09
It looks like not Opera is started, but some html page is launched.
Anyway, start with malware cleaners (ADWCleaner, Malwarebytes MBAM). If this doesn't help, you can download Autoruns from MS technet - it shows every tiniest bit of autoloading software; there you should find offending entry. If you are not sure what to delete, just ask
-
blackbird71 last edited by 21 Mar 2016, 20:23
I'd start by downloading a copy of Sysinternal's Autoruns-for-Windows (and now a Microsoft product) at:
https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
It's a safe, standalone product that doesn't need installation, being run directly from its exe file, though it does need admin privileges.It will show you virtually everything that is set up in a Windows installation for being auto-started, regardless of where it is or what mechanism is being used to force the auto-start. There are more ways to start programs than just via putting them in a Start folder, and you need to find out where this is being triggered from.
-
freedom3401 last edited by 21 Mar 2016, 22:10
Omg thanks so much everyone! That Autoruns program is a legend You guys are awesome x
-
A Former User last edited by 21 Mar 2016, 23:48
So, don't keep us in suspense, where did Autoruns show you that Opera was being run from?!
-
A Former User last edited by 22 Mar 2016, 10:51
I'd start by downloading a copy of Sysinternal's Autoruns-for-Windows (and now a Microsoft product) at: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx It's a safe, standalone product that doesn't need installation, being run directly from its exe file, though it does need admin privileges.
Does it work on XP?
-
freedom3401 last edited by 22 Mar 2016, 11:28
Sorry guys I may have rejoiced too soon. Basically what I did yesterday was there was an opera entry in one of the HKLM checkboxes and as excited as I was, all I did was untick it, and restarted my comp and voila its gone! Sadly, today when I woke up and switched my computer back on there it was again!
Weird thing is, when I went back to autorun, I could not find any entry related to Opera for today's date. However, I did notice a pre-link(?) before the http://www.msn.com/en-gb/ page was brought up. Unfortunately I was not fast enough to note down the pre-link but it looked something like www.go-....? What I did try to do was restart and also did a proper shut down, and on all those occasions Opera did not autostart. So it made me wonder if it could be an entry in 'News' or part of Windows to autostart the MSN homepage once a day?
I think I have only taken more notice of the issue over the last couple of days because the only time I had to restart my computer was a machine check exception BSOD which I think may have resolved now (so maybe that forced/error restart resetted the clock or something?)
Any thoughts would be greatly appreciated else I will review it again tomorrow to see if it happens again because I have not made any changes whatsoever since that last autostart.
Sorry guys I'm really not much of a techie but I do really want to rid this weird issue.
Cheers x
-
blackbird71 last edited by 22 Mar 2016, 12:46
I'd start by downloading a copy of Sysinternal's Autoruns-for-Windows (and now a Microsoft product) at: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx It's a safe, standalone product that doesn't need installation, being run directly from its exe file, though it does need admin privileges.
Does it work on XP?
I believe so. I know that 12.03 did, and the current 13.51 is shown as being XP compatible on most of the freeware sites (in fact, it shows as Win2000 compatible on many of them). The MS sites don't list XP compatibility any more, regardless of whether a program has it because - well, because that's how MS does things regarding their OS versions after end-of-support. Given that the software doesn't actually 'install' but instead runs from the executable, it should be easy enough to try it out to make sure.
-
blackbird71 last edited by 22 Mar 2016, 12:57
...
Weird thing is, when I went back to autorun, I could not find any entry related to Opera for today's date. However, I did notice a pre-link(?) before the http://www.msn.com/en-gb/ page was brought up. Unfortunately I was not fast enough to note down the pre-link but it looked something like www.go-....? What I did try to do was restart and also did a proper shut down, and on all those occasions Opera did not autostart. So it made me wonder if it could be an entry in 'News' or part of Windows to autostart the MSN homepage once a day?
...There shouldn't be any kind of 'pre-linking' in Windows 8.1 unless it's somehow been messed up by one of the Windows 10 pushed-upgrade notification attempts contained in some of the Microsoft updates over the past 6 months. If you can get a better glimpse of what the 'pre-link's' domain name is at some point, it might be helpful. There can be a world of insight contained in the nature of a domain name, particularly if malware is involved.
-
A Former User last edited by 22 Mar 2016, 14:38
@joshl
I can confirm that Autoruns 13.51 works fine on XP.
@freedom3401
I suspect that the "www.go-" link you're seeing very briefly is a "http://go.microsoft.com...." link.
They are usually used to redirect to other Microsoft pages.
-
freedom3401 last edited by 24 Mar 2016, 17:39
I wish I could tell you guys what the problem is but it hasn't been happening since. Hopefully it stays that way. The only thing I can think of which MIGHT have resolved the issue is on the settings in Opera which lets you decide the 'start-up options' and I chose 'previous page' which was essentially nothing rather than the other two.
If I have time I'll test it and let you guys know but otherwise thanks for the help!
-
freedom3401 last edited by 24 Mar 2016, 19:26
Ok I did jinx myself. And I saw the link.
Does it look suspicious to anyone? Or do I just have to live with it?
-
A Former User last edited by 24 Mar 2016, 20:40
No, that's fine. As I said earlier, it's just a forwarding link, although it would normally have something else after the "fwlink".
If you look at your Windows event logs, they all contain a similar link to click on to get further information, e.g. http://go.microsoft.com/fwlink/events.asp.
-
blackbird71 last edited by 24 Mar 2016, 20:56
The go.microsoft.com/fwlink you noted is a Microsoft 'internal redirect' link that, by itself, merely takes one to the www.microsoft.com webpage. Such a link, as @davehawley notes, is normally accompanied with a LinkID number (such as
http://go.microsoft.com/fwlink/p/?LinkID=313611
), which will take one to a specific-purposed MS webpage. The MSN 'start page' for IE, for example, is:http://go.microsoft.com/fwlink/?LinkID=255141
, and is etched into the registry. A question exists whether there is more to the link than just what you provided?The exact link you did provide isn't suspicious by itself. However, the triggering process is not normal for a non-IE browser on Windows 7 or 8.1, and indicates something abnormal has occurred. There are a variety of possible causes, though at this point, there's not enough information details to conclude exactly what. Possibilities: registry corruption, Microsoft update gone haywire, Microsoft Windows 10 "push" update gone haywire, or a Windows internal attempt to bring up a certain Microsoft information/alert page gone haywire.
-
sgunhouse Moderator Volunteer last edited by 24 Mar 2016, 20:57
Hard to consider any legit Microsoft site as dangerous, other than them trying to upgrade you to 10 if you don't want it. That doesn't mean you "just have to live with it", but you may be further ahead searching Google to see how to disable it.
-
A Former User last edited by 25 Mar 2016, 06:43
I'd start by downloading a copy of Sysinternal's Autoruns-for-Windows (and now a Microsoft product) at: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx It's a safe, standalone product that doesn't need installation, being run directly from its exe file, though it does need admin privileges. Does it work on XP?
I believe so. I know that 12.03 did, and the current 13.51 is shown as being XP compatible on most of the freeware sites (in fact, it shows as Win2000 compatible on many of them). The MS sites don't list XP compatibility any more, regardless of whether a program has it because - well, because that's how MS does things regarding their OS versions after end-of-support. Given that the software doesn't actually 'install' but instead runs from the executable, it should be easy enough to try it out to make sure.
Well, it says
Download Autoruns and Autorunsc
- is it right? Like some two things there? It should be? -
A Former User last edited by 25 Mar 2016, 12:05
There are two executables in the zip file that you download.
Autoruns.exe is the Windows GUI version, which is what you want.
Autorunsc.exe is a command line version, which you can use in a command prompt.
-
A Former User last edited by 25 Mar 2016, 15:29
What's the second one for? I didn't get it.
Sorry for hijacking the thread! :troll:
-
leocg Moderator Volunteer last edited by 25 Mar 2016, 20:58
What's the second one for? I didn't get it.
For the same it seems but it runs on command line (like command prompt), without a graphic interface.