Browser Redirect

Offerplaying Removal (June 2018 Update)

Parasite may reinstall itself multiple times if you don't delete its core files. We recommend downloading SpyHunter to scan for malicious programs installed with it. This may save you hours and cut down your time to about 15 minutes. 

Download SpyHunter Anti-Malware

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

How irritating is this problem? (1 votes, average: 5.00)

This page aims to help you remove Offerplaying. Our removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

Most applications that belong to the browser hijacker category are considered unwanted and for a good reason. Apps like Offerplaying (a recently reported hijacker representative) are normally able to impose unwanted changes to the user’s browsers. Such changes include but are not limited to replacement of the starting page and the new-tab page of the browser, changing of the default search engine and addition of a new toolbar. In addition, one could also normally expect generation of intrusive ads and page redirects coming from hijacker apps which is yet another highly unpleasant feature that the representatives of this software category are infamous for. In order to ensure that their products get as much exposure as possible, the hijacker developers normally program their apps to be compatible with most of the popular browsers out there – Chrome, IE, Edge, Firefox, Opera and so one. As you can see, this is a rather irritating type of software and dealing with it might be rather challenging for anyone who doesn’t really know how to locate the hijacker on their PC and delete the data related to it. That is why, in the removal guide down below, we will show you how you ca manually uninstall and fully remove Offerplaying from your machine in case it has managed to get installed on it. In addition to the manual removal instructions, we have also made sure to offer you a software tool that is specialized for detecting and removing unwanted and potentially dangerous software. Use it if you need extra help with the removal process or if you feel like the manual instructions are too advanced for your level of computing skills. 


What you should know about hijacker apps

As you have probably already guessed, software apps the likes of Offerplaying are normally not there to help you or provide you with an improved online experience (although they oftentimes get promoted as being capable of doing exactly that). So what is their real purpose then? Well, it should actually be painfully obvious that it’s all about the ads and the other forms of promotional materials that get displayed on your browsing screen when your browser has been hijacked. Earning revenue for their creators through online marketing is pretty much the primary purpose of most representatives of the browser hijacker software category. Although this could be rather unpleasant for you as the ads can sometimes get really annoying, it’s still not as bad as having some nasty virus in your system that is trying to harm your computer, steal personal information about you or locking your files and demanding a ransom payment from you. The aforementioned issues are typical for real malware threats the likes of Spyware programs, Trojan Horses and Ransomware viruses. Compared to them, a hijacker app is just some annoying software piece that can be taken care of relatively easily. That, of course, is not to suggest that you mustn’t be careful – quite the contrary. You see, even though Offerplaying would typically contain no malicious code, the ads and page redirects displayed by it might link the user to online addresses with obscure and maybe even hazardous contents. What this means is that if you accidentally open a hazardous advert, you might get your PC exposed to viruses like the ones mentioned above. We advise you to keep your distance from whatever the hijacker app is trying to place on your screen in order to decrease the chances of landing some insidious Trojan Horse or Ransomware virus. Also, it’s best if you make sure to get rid of the pesky app ASAP so as to keep your PC as clean and as safe as possible.

Offerplaying Removal

If you have a Windows virus, continue with the guide below.

If you have a Mac virus, please use our How to remove Ads on Mac guide.

If you have an Android virus, please use our Android Malware Removal guide.

If you have an iPhone virus, please use our iPhone Virus Removal guide


Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).



We get asked this a lot, so we are putting it here: Removing parasite manually may take hours and damage your system in the process. We recommend downloading SpyHunter to see if it can detect parasite files for you.

Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab (the “Details” Tab on Win 8 and 10). Try to determine which processes are dangerous. 


Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at:

Scan Results

Virus Scanner Result

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 


Hold together the Start Key and R. Type appwiz.cpl –> OK.


You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:


Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.


Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

  1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
  2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
  3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.



  • After you complete this step, the threat will be gone from your browsers. Finish the next step as well or it may reappear on a system reboot.

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).


Properties —–> Shortcut. In Target, remove everything after .exe.

ie9-10_512x512  Remove Offerplaying from Internet Explorer:

Open IE, click  IE GEAR —–> Manage Add-ons.

pic 3

Find the threat —> Disable. Go to IE GEAR —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

firefox-512 Remove Offerplaying from Firefox:

Open Firefoxclick  mozilla menu  ——-> Add-ons —-> Extensions.

pic 6

Find the adware/malware —> Remove.
chrome-logo-transparent-backgroundRemove Offerplaying from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Rename the Folder to Backup Default

Rename it to Backup Default. Restart Chrome.


To remove parasite on your own, you may have to meddle with system files and registries. If you were to do this, you need to be extremely careful, because you may damage your system.

If you want to avoid the risk, we recommend downloading SpyHunter
a professional malware removal tool.

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!

Distribution methods for hijackers

Spam and malvertising are among the most popular methods for distributing any type of potentially unwanted software as many users tend to fall for them and unknowingly download the unwanted apps on their machines. Therefore, we advise you to be careful and avoid clicking or opening any shady-looking web letters or online ads if you are not certain that their contents are safe. One other really popular and highly-effective model for hijacker distribution is when the unwanted app is put inside the setup file of another program. This is called file-bundling and if you go for the Quick setup option when installing a new program you are likely to automatically allow the installation of any additional apps that might have been bundled with the installer. However, if you opt for the Custom setup menu, you will see the options that allow you to leave out any of the bundled apps in case you thing you might not want them on your machine. Do that every time from now on when you are going to install new software on your machine and remember to opt-out of the installation of any optional app that looks obscure and questionable.


Name Offerplaying
Type  Browser Hijacker
Danger Level Medium (nowhere near threats like Ransomware, but still a security risk)
Symptoms  Replaced search engine and homepage are the two most frequently encountered symptoms.
Distribution Method Usual methods of distribution are spam, malvertising and program bundling.
Detection Tool

Leave a Comment