Opera 73.0.3827.0 developer update

[gmiazga]

gmiazga Opera last edited by

Hey, we are currently looking into the issue with Windows Defender detecting .dll. All our Windows binaries before being published are scanned on VirusTotal. Version 73.0.3827.0 still shows no detections and binaries uploaded there are same like the ones on our autoupdate servers (few CDNs I checked at least) and FTP server.

[andrew84]

andrew84 last edited by

I can confirm the same on Win 8.1x64,
Kaspersksy doesn't detect it, but I turned it off and activated Windows Defender. After running the installer I've got the same result.

[ziegensatan]

ziegensatan @gmiazga last edited by

@gmiazga are there any news? if it is a false positive, it should be reported to microsoft
https://docs.microsoft.com/de-de/windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives

[gmiazga]

gmiazga Opera last edited by

Already reported and waiting for their response. Will update when I get more details.

[kened]

kened Banned @gmiazga last edited by

@gmiazga: The problem is that Opera was trying, insistently, to download these .dll files identified as threats by Windows Defender. In fact, I was prevented from uninstalling Opera by the conventional method.

[AndrewMills]

AndrewMills last edited by

Hi, in my new installation, every time I start Opera developer, Windows antivirus warns of a serious threat and appear this message...
https://ibb.co/zR3V45v

[leocg]

leocg Moderator Volunteer @AndrewMills last edited by

@AndrewMills See https://forums.opera.com/post/227355

[ghirahim]

ghirahim @gmiazga last edited by

@gmiazga: Thank you for your response. Much appreciated.

[burnout426]

burnout426 Volunteer @gmiazga last edited by

@gmiazga FWIW worth, I also submitted the dll for review as a false positive (and explained the situation and linked to threads about it) to Microsoft. See https://www.reddit.com/r/operabrowser/comments/j4ihvn/foxie_malware/g7ubuqi/?utm_source=reddit&utm_medium=web2x&context=3 for their response. Hopefully you have better luck.

[burnout426]

burnout426 Volunteer @kened last edited by

@kened said in Opera 73.0.3827.0 developer update:

In fact, I was prevented from uninstalling Opera by the conventional method.

In https://www.reddit.com/r/operabrowser/comments/j4ihvn/foxie_malware/g7s2mqv/?utm_source=reddit&utm_medium=web2x&context=3, I mentino how I had to kill some Opera processes to do some cleanup to get updating working again. I also had to do that to be able to uninstall Opera.

[kened]

kened Banned @burnout426 last edited by

@burnout426: I think we deserve a full explanation about what is happening. This is not normal.

[burnout426]

burnout426 Volunteer @kened last edited by burnout426

@kened What I know right now is that Windows Defender doesn't think it's malware or a virus. It just tags it as a potentially unwanted program. It's detected as BrowserModifier:Win32/Foxiebro. I can understand that as the Opera installer actions can and do modify Opera. So, it is indeed a "BrowserModifier", technically. The weird thing is it just started happening recently. I'm not sure if it's due to a definition update for Windows Defender where they have stricter rules or just a change (it'd be a safe change) in Opera's installer actions that triggers Defender now. And, remember. No other anti-virus does this.

If you're sure you don't have any real BrowserModifier:Win32/Foxiebro infections on your computer, you can allow the threat in Windows Defender until this gets sorted.

Reading the "Unwanted Software" section at https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/criteria leads me to believe that Defender wants something in Opera's installer to be user-initiated in some way. Opera might just have to change something with one of its installer functions (when checking/doing updates etc.) to work around the detection and make Defender happy. But, we'll have to wait and see what Opera says.

[leocg]

leocg Moderator Volunteer @kened last edited by

@kened What is happening is that this time the antivirus giving, possibly, the false positive is one more widely used.

[kened]

kened Banned @burnout426 last edited by

@burnout426: I hope so.

[kened]

kened Banned @leocg last edited by

@leocg: I think it's a little more complicated than that.
I repeat: I was unable to uninstall Opera Developer. I had to remove all folders related to it. But I really hope it was just a false positive.

[kened]

kened Banned @leocg last edited by

@leocg: Probably, in the next few hours we will have a new build. We'll know better what's happening.

[gmiazga]

gmiazga Opera last edited by

Microsoft removed this detection. Their full reply:

We have removed the detection. Please follow the steps below to clear cached detection and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://www.microsoft.com/en-us/wdsi/definitions

From our side there have been small changes in installer code on developer which probably got detected as malware together with Microsoft definitions update done on 2-3 October.

[kened]

kened Banned @gmiazga last edited by

@gmiazga: It's good to know that.

[kened]

kened Banned @gmiazga last edited by

@gmiazga: The procedure worked here. I'll wait for the next build to see what happens.

[burnout426]

burnout426 Volunteer @gmiazga last edited by

@gmiazga I made sure to remove the threat from "allowed threats" so that I can test if there's still a problem or not. All good so far after doing the commands. Opera Developer isn't trigger Windows Defender anymore.