Malware bug?

bbenja13

bbenja13

I keep receiving this site being blocked that I suspect is a malware/ malicious advertising that is trying to cause any clicks on pages to be redirected to ads that I don't want. This has happened for the last few weeks and I have tried removing the file/s that are mentioned in the report that I copied below. This works; however, it does not allow me to reopen Opera if I close out and forces me to reinstall.
-Log Details-
Protection Event Date: 1/8/19
Protection Event Time: 6:28 PM
Log File: 7078f320-13a5-11e9-97f6-ecf4bb706035.json

-Software Information-
Version: 3.6.1.2711
Components Version: 1.0.508
Update Package Version: 1.0.8684
License: Trial

-System Information-
OS: Windows 10 (Build 17134.523)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Malvertising
Domain: [removed]
IP Address: 198.134.112.244
Port: [52136]
Type: Outbound
File: C:\Program Files\Opera\57.0.3098.106_0\opera.exe

(end)

sgunhouse

sgunhouse Moderator Volunteer

When does it happen? When you first start Opera, randomly while Opera is running, or even when Opera is not running (Opera start up without you trying to start it and tries to load that website)?

Some other program (or extension) you installed recently is likely causing it; knowing when it occurs may give a clue as to where to look.

bbenja13

bbenja13 @sgunhouse

@sgunhouse This happens randomly when browsing and no other time. I have not added any new extensions since I first installed opera. This has been happening since a risky connection was blocked by my Internet Security Software. I also notice that I have two folders for 57.0.3098.116. The second one being numbered 57.0.3098.166_0. This is the folder mentioned in the report log. Could that be connected?

sgunhouse

sgunhouse Moderator Volunteer

If you have two folders, try deleting the extra one - but of course, whatever caused the extra one may just create a new one later. At some point you'll need to run a program to look for the cause - whatever malware that did that in the first place.

blackbird71

blackbird71

What anti-malware program(s) are you running, and have you tried running a full system scan with it/them? The flagged site you noted is linked to malicious advertising, as you suspected (but more commonly found on Android systems); and it sounds like you are dealing with an underlying infection. There's a February 2018 thread about this class of adware hitting a Win10 user over at http://www.tomsguide.com/answers/id-3632381/random-webpage-opening-automatically-boot.html that recommends using Malwarebytes to clear it.

In the meantime, you (or a Mod) might want to obfuscate the link listed in your original software information log under "Domain", since it links directly to a malicious website.

bbenja13

bbenja13 @blackbird71

@blackbird71 I currently have MalwareBytes and McAfee internet security and I have tried running a full scan. It came up with nothing for both. When a blocked site comes up it is an outbound connection mentions opera and this specific folder. I removed a duplicate folder before and that did work. Only for it to reappear with the new update. I'll try what is mentioned on that link and see if I have any luck.

blackbird71

blackbird71 @bbenja13

@bbenja13 in the 2 weeks or so prior to the onset of the problem, did you install any kind of software/freeware?