Do more on the web, with a fast and secure browser!

Download Opera browser with:

  • built-in ad blocker
  • battery saver
  • free VPN
Download Opera

Get rid of brower hijacker - Istartsurf

  • Through a moment's inattention when downloading some audio converter software I have ended up with this awful browser hijacker on my computer. Have managed to uninstall and get rid of all instances everywhere (that I can see!) including Chrome and IE, but I can't find where it's commanding Opera to reidrect to it's own search engine. I've reset all the preferences and blocked the address at the moment, but the page still tries to load when I open Opera.

    Can anyone please give me an idea where this command might be hiding?

    Thanks very much - it's driving me nuts and I've wasted a good few hours now trying to get rid of it.

  • Moderator: please consider closing this useless thread. Thanks.

  • Please explain why this is useless? I need help.

  • Check that the malware hasn't just added the address to Opera's shortcut as a switch.

  • Thanks people!!

  • Try also checking your system with Malwarebytes.

  • It was in the shortcut switch. The only place I hadn't checked. Malawarebytes and CCleaner had got rid of everything else, plus manual deletes in other browser settings. Really appreciate your help everyone. Problem sorted.

  • leushino ... why is this a "useless" thread?

  • He hadn't got his ☕ , perhaps;)

  • so, did somebody found out how can it be removed from opera browser. because there are guides to remove istartsurf from the other browsers.

  • See the link in the third comment down.

  • I have used adwcleaner, and some other programs but did not help. I successfully removed it manually from ie and firefox according to the instructions found on many websites, but nothing about opera. I'm using Opera 24.0. i tried to delete the files from appdata/local/, I've deleted the cookies .. didn't help.

  • Did you check the command line in Opera's startup shortcut?

  • yes, I did: "C:\Program Files (x86)\Opera". it's ok there.

  • Is that the shortcut you use to start Opera - and that isn't the command line of the shortcut. The command line should be "C:\Program Files (x86)\Opera\launcher.exe" (with nothing after the second quote).

  • i don't understand any of this, anyone pls write in step by step 🙂

    Dave said:
    Did you check the command line in Opera's startup shortcut?

    Did you check the command line in Opera's startup shortcut?

    and sgun:
    Is that the shortcut you use to start Opera - and that isn't the command line of the shortcut. The command line should be "C:\Program Files (x86)\Opera\launcher.exe" (with nothing after the second quote).

    what does that mean, please I can't get rid of this..

  • i'm using Opera beta, I managed to remove it from Chrome and apparently form Opera and looks alike from system..I hope..only for Opera beta I can't find it. I don't understand what are switches or how it can be in command line.

  • Istartsurf is adware that hijacks your browser to force it to use Istartsurf's websites and show their ads. To get rid of it, you have to remove all of its program files from your computer and undo the changes it makes to your system's registry, which removal is what the Malwarebytes and AdwCleaner tools will try to help you do.

    You may also have to manually remove any changes the adware may have made to any of the shortcuts used for starting up your browser... shortcuts are the little icon-buttons on your desktop or your taskbar/toolbars, and they contain commands to the computer to start up the associated program. Adware hijackers can attach special command terminology to what is written within those shortcuts and which may force a browser to go directly to the adware's website upon browser startup... in which case, you have to clear out that added terminology if it exists.

    When you right click a startup icon for Opera, you should see a Properties entry (if the icon is in your Windows taskbar instead of the desktop, you will then need to right click on the software name as well to see the Properties entry); left click on that Properites word to bring up the Properties panel for the shortcut. Under the shortcut tab, you should see a Target: line with a computer command in it. That command should ordinarily read "C:\Program Files (x86)\Opera\launcher.exe" with no other terms or letters behind those words. If something else appears there, copy it and report back here. If it reads as written, then the shortcut is OK.

    Note that if you have other browsers, or browser shortcuts in other user accounts, you should manually check each and every one to assure that all of the adware linkages have been completely cleared out.

  • thanks I like your sharing..

  • THANK YOU blackbird71!
    o man I found it, thank You blackbird71 for that detailed explanation! and so soon!! I was expecting to see the answer in couple of days I manage to remove it from Chrome before and from system it was a pain as it was in lot's of places. Malwarebytes removed some but not all then I started Loaris but ofc it prompted me money at the end but I saw that it has log so I manually removed all suspicious files from that log..and some else lol..but all is ok now apart from Opera beta. I manually removed it from Chrome as well and in restored it to default settings. And is ok now it doesn't appear in Chrome. So as You described I found that, I hope last, peace of it, here is target:

    "C:\Program Files (x86)\Opera beta\launcher.exe" ttp://

    I edited and removed h so address is not clickable..I'm that paranoid 🙂 , I've spent all day dealing with this

    what next?

Log in to reply