After last update, Opera isn't standard browser
-
A Former User last edited by
...or try accessing
opera://help.Linux, that's been probably the files, do you think?
(Just reported a weird behaviour with this user's (in particular) postcount - do you, guys, see the "1" too there?) -
linuxmint7 last edited by
As I said, the version number of Opera has not changed.
Yeah sorry, saw that but slipped my mind when I was replying.
This definitely does not sound like activity from Opera or its update process, as there was nothing to update, as you say, you already had the latest version.
Are you sure there is nothing running amok on your computer, or maybe some software that offers the ability to update software for you automatically ?.
Any anti virus software installed, other than PrivateFirewall 7 ?.
-
blackbird71 last edited by...
I was not aware of any malware which could install by mocking itself as an Opera upgrade.While malware still must obey the laws of physics and the protocols of software, never underestimate the cleverness or creativity of hackers... nor the permutations of possible outcomes if a hack "goes bad" in midstream.
I realize memory is not always reliable, but it is important to try to recall exactly (as much as possible) what occurred at the beginning of the whole episode, particularly before memory shifts and/or gets colored by later thoughts and questions. Details of the initial experience of the update splash screen may shed light on where it might have actually come from, which in turn may give light on what it might have later done (and how).
-
upgradevictim last edited by
No AV other that PF 7.
The splash screen was in a frame; there were no navigation buttons available, but there was an address bar. There was no way to move from it. I restarted the browser, thinking the splash screen would disappear, but it didn't, so I browsed to a website using the address bar, and discovered the appearance of the browser had changed completely.
I am quite willing to send the %appdata% files to someone at Opera who can tell me whether they are in right order, or not.
And yes, I note my post count isn't increasing for some reason. (I'm posting with Firefox, not Opera).
-
linuxmint7 last edited by
No AV other that PF 7.
Have you thought about maybe doing a scan for malware or other such dodgy software that maybe lurking on your system that you may not know about ?. Maybe PrivateFirewall 7 may not be enough ?, and it's always good to have a second or even third opinion.
-
upgradevictim last edited by
The upgrade splash was a full screen, probably lightish blue with some graphics in the center. As I have said, I was furious because it gave me no option to postpone or reject the upgrade.
Yes, there are hackers about here who are motivated and talented. But I would certainly not want to be alarmist about this unless I was absolutely sure that those files on my machine did not come from Opera.
-
A Former User last edited by
-break[playing-around] Yes, you're definitely cursed: unnatural happenes on your machine, Operaforums doesn't want to update your postcount.
You're doomed, dude! :cheers: [/playing-around]
/end of-break 
-
blackbird71 last edited by
...
The splash screen was in a frame; there were no navigation buttons available, but there was an address bar. There was no way to move from it. I restarted the browser, thinking the splash screen would disappear, but it didn't, so I browsed to a website using the address bar, and discovered the appearance of the browser had changed completely.
...And:
The upgrade splash was a full screen, probably lightish blue with some graphics in the center.
...That sounds as if it was actually a web-page appearing within a browser, rather than a typical "floating" update pop-up notification. Can you recall what the splash screen actually said? That is, did it tell you an Opera update was required, that an update was in-progress, or that an update had already occurred (like with a "welcome" screen)?
What version of Windows are you using? If you navigate through its control panel to the 'uninstall' programs area that one normally uses to remove a program, how many instances of Opera appear in that listing? Since Opera isn't capable of "updating" a Presto version into a Blink version, I'm trying to figure out if something instead of updating, triggered a normal 'manual,' first-time Blink Opera installation, which would be installed in parallel with the old installation, and send you to a welcome screen. In such a case, that new-install process would create new Opera shortcuts that would direct the user to the new installation, rather than the old Opera installation (which would still live on the system).
-
A Former User last edited by
Black, we've already guessed that's probably not the case. And I'm thinking of a malicious site now... Another question is what pushed it.
If that something was on machine before - to call on that site - ?"Upgradevictim", can you access your browser's history (if you haven't been browsing much since the event)? (You weren't in the private mode, were you?)
And - was your antimalware software up-to-date at the moment? -
blackbird71 last edited by
Black, we've already guessed that's probably not the case. And I'm thinking of a malicious site now... Another question is what pushed it.
...Uhmm... I'm unaware that any conclusions have been reached, other than a recognition that Presto Opera installations cannot currently be updated into Blink Opera installations. What is still conjecture is whether a normal Blink Opera installation was somehow invoked on his system, occurred, and installed its own shortcuts - which, when clicked, the user dutifully thought would activate his old browser, but which instead activated the new install and routed that browser to Opera's "welcome" page upon browser startup. Thus far, I've not seen anything definitive that rules out two Opera versions being on his system - especially if the root (c:) program folders haven't been examined for that possibility.
My own suspicions also lean toward malware involvement, but we need to find out precisely what has actually occurred... and what has not occurred.
-
A Former User last edited by
As I said, the version number of Opera has not changed. I have website logs showing the same version before and after the event, and there has been no change to any of the files in Program Files/Opera (at least according to Windows timestamps). The only change seems to be in the Opera %appdata% files.
Black, the user seems to have checked things...> This is how my Opera now logs, same as before:
Opera/9.80 (Windows NT 5.1) Presto/2.12.388 Version/12.17
Opera.exe and opera.dll both show version 12.17.1863.0. -
blackbird71 last edited by
As I said, the version number of Opera has not changed. I have website logs showing the same version before and after the event, and there has been no change to any of the files in Program Files/Opera (at least according to Windows timestamps). The only change seems to be in the Opera %appdata% files.
Black, the user seems to have checked things...> This is how my Opera now logs, same as before:
Opera/9.80 (Windows NT 5.1) Presto/2.12.388 Version/12.17
Opera.exe and opera.dll both show version 12.17.1863.0.Yes, I understand. But I'm unsure whether or not that means he doesn't have two Opera versions installed (or Opera and who-knows-what)... it shows something being "logged" somewhere, but there's a lot of room for confusion in that. And the versions of the files he's looking at may not be the files actually in use when he activates "Opera"... that would require some deeper examination with a process explorer, etc. when the "Opera" is running to track down where (folder/file/etc) it's actually running from. (As it is, I'm now having to go offline for the next several days, so hopefully others can help track all this down.)
-
leocg Moderator Volunteer last edited by
Here's what my Opera looks like now, when that side panel is showing:
Well, panels have been there since 2001 and it's always been an user's choice to use them or not.
It seems to me that your installation got messed up somehow and it has triggered an update that ended resetting your settings or some of them.
can't go to Help > Opera because it doesn't show.
Click on Alt key to show the menu them click on "show menu bar" to dispplay the menu bar on a permanent way.
The upgrade splash was a full screen, probably lightish blue with some graphics in the center. As I have said, I was furious because it gave me no option to postpone or reject the upgrade.
That's strange. Usually the update notice is a (small to medium) dialog window.
-
-
A Former User last edited by
Black, the user seems to have checked things...
Yes, I understand. But I'm unsure whether or not that means he doesn't have two Opera versions installed (or Opera and who-knows-what)... it shows something being "logged" somewhere, but there's a lot of room for confusion in that. And the versions of the files he's looking at may not be the files actually in use when he activates "Opera"... that would require some deeper examination with a process explorer, etc. when the "Opera" is running to track down where (folder/file/etc) it's actually running from.
Sounds like a horror movie (particularly that in the fore parentheses).
-
upgradevictim last edited by
To bring this to a close:
I have done a thorough search. There's only one Opera version on my system. Nothing has been changed in Program Files/Opera -- I've checked it against an offline system backup I made last month. All the changes are in %appdata%/Opera.
I have copied the old %appdata/Opera folder from the system backup over to my current system, and I now have my old, pre-disaster Opera back (minus very new bookmarks, etc.).
Perhaps that splash screen "upgrade" will come back, in which case I'll do a screen shot and return.
Thank you.
-
A Former User last edited by
So we're to decide that there weren't any actual upgrade?
Take your postcount pills, heed the URLs and, if you haven't deleted/replaced them - you were going to show them files to certain folks, weren't you? Just make sure they're no way executable anywhere.
-
upgradevictim last edited by
As I hope my chain of posts finally made clear, I originally thought that an upgrade had gone through without my consent, but that doesn't seem to be the case. It seems to be the %appdata%/Opera files that have been changed, not the Opera Program Files.
And now that I've remembered that I have a very recent backup of my system files handy, I've been able to go back and see just what was changed in %appdata%/Opera. The biggest change seems to be operaprefs.ini. I had very customised settings and a large operaprefs file before the attack (or whatever). Afterward, operaprefs shrank to about 2kb from 8kb. As I said, Opera seemed to be upended after the "attack" and I assume the re-write or replacement of my operaprefs file caused that.
If anyone wants to see these files, they are available here (I've changed the extension from .ini to .txt, so you simply view the text on Google):
https://drive.google.com/file/d/0BynECQ6zBQFXVHRUUUZlQjNZMHc/view?usp=sharing
https://drive.google.com/file/d/0BynECQ6zBQFXa0dzMmJxdTlOUU0/view?usp=sharing
"OLDprefs" is my operaprefs file a week or two ago. "NEWprefs" is the much shorter file after the "attack." Whatever else happened, it's fairly clear the operaprefs file was somehow replaced. If someone recognizes the possible source of that NEWprefs file, I'd be glad to hear about it.
-
blackbird71 last edited by
One "peculiarity" in the NEWprefs file is that in the "Install" section, the "Newest Used Version" and the "First Used Version" are both 12.17.1863. Also, in the "State" section, there is no "Upgrade Count" nor "Upgrade From Version" entries as there are in the OLDprefs file. This would seem to indicate that for some unknown reason, something attempted to install at least part of a second 12.17 version (of some kind) over top of the original 12.17 user files. It's hard to accurately guess what might have triggered such an event, though the possibilities of "bits gone mad" via some kind of system transient/glitch or a clever malware attack both remain. In the case of a transient-related issue, if key files get corrupted, Opera 12 will automatically copy in a default version of such files to the user folder from the program folder and go on from there. But I'm not sure that such a re-installed version of the operaprefs.ini file would look anything like what appears in your NEWprefs file.
-
upgradevictim last edited by
Given that there now has appeared an announcement on this board that Opera has begun "offering" Presto users an upgrade to Opera 25, I believe it's fair to assume I was in fact a victim of a botched attempt at this "offer."
Listen Opera: If I want an upgrade, I will come to you for one.
