Opera Browser Assistant?

A Former User

Hi, I recently noticed in the Windows task manager, that there is an Opera process running on startup called "Opera Browser Assistant". I would like to know what exactly is its function and if it can be uninstalled if it is not really necessary.

skoy21

skoy21

So, what we know so far is that Opera assistant gets installed with Opera, and not necessarily with a bundled setup as mentioned above, in my case at least it's from the offline installer of version 67.xx which I downloaded 5 days ago from opera.com after installing fresh windows.

It adds a startup entry.
A Registry entry for the startup HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32.
It ads a folder named assistant in the install directory.
It adds a schedule in Task Scheduler, which is probably for updating it self, if I judge from the arguments of the entry.

So, what does it do apart from updating itself? What is it's functionality? As it seems, it's not necessary for Opera to function correctly.

donq

donq @skoy21

@skoy21 said in Opera Browser Assistant?:

So, what does it do apart from updating itself? What is it's functionality? As it seems, it's not necessary for Opera to function correctly.

For sure it is not necessary. What it does - I have seen putting it some big red O into system tray (most likely you could open Opera using that icon) and I have seen it display very ad-like promotion inside (or on top of) Opera window - at first I thought this is some unkillable ad, then I opened task manager and saw opera assistant there and killed it (and all its traces) immediately.

Of course Opera could (and should) explain, what kind of unwanted software it installs. I have not seen any official explanation and thereby consider it pure malware

burnout426

burnout426 Volunteer @skoy21

@skoy21 said in Opera Browser Assistant?:

So, what does it do apart from updating itself? What is it's functionality?

See https://www.opera.com/privacy.

Browser Assistant. Your copy of Opera for computers may include a component that displays desktop notifications promoting the browser’s features. It checks if any notifications are pending on a scheduled basis and may anonymously report occurrence of certain system events (namely low battery, low hard disk space, new Wi-Fi network connected, another browser installed). This information is not collected by us and no personal information is sent.

donq

donq @burnout426

@burnout426

Thank you very much!

Well, even as explained by Opera, it looks and behaves like malware anyway

skoy21

skoy21

Just to help out, here what Opera says about Assistant, copied from https://www.opera.com/privacy that @burnout426 posted above.

Browser Assistant. Your copy of Opera for computers may include a component that displays desktop notifications promoting the browser’s features. It checks if any notifications are pending on a scheduled basis and may anonymously report occurrence of certain system events (namely low battery, low hard disk space, new Wi-Fi network connected, another browser installed). This information is not collected by us and no personal information is sent.

So, yes, it seems to be privacy violation. I always choose to NOT send any data and statistics during Opera installation, but it seems Opera Assistant does not respect this option anyway...
As they say, it reports some system events but information is not collected by Opera? Then who collects this information that Assistant reports?

burnout426

burnout426 Volunteer

I wonder if doing something like https://www.technipages.com/prevent-users-from-running-certain-programs to prevent browser_assistant.exe from running would help. If that doesn't work as-is, you might be able to apply the setting for the System user instead of the current user. See https://support.esri.com/en/technical-article/000010572 to see how to figure out what id in HKEY_USERS is the system user.

Although, it's probably just easier to write a script or batch file to remove the browser assistant and updater schedule task for it that you run each time Opera updates.

kaodome

kaodome

I am amazed it took so long for us to know what the purpose of Opera Browser Assistant is and that nobody from the company actually stepped in to explain what it does. Although since it seems to be related to tracking, surreptitiously installed and there's no switch for it in the browser settings I'm not surprised.

I wonder, what is wrong with giving users a choice and being transparent? I take it they'd want to have more market share, but I bet disregarding users does the opposite. And not only this business of the Browser Assistant, the constant pushing of Opera GX and icons in the sidebar (even though you have chosen not to be shown those messages again) or the removal of privacy oriented features (e.g. Do Not Track) doesn't help either.

Aaaaanyway, I digress, I came to find out what the thing was and now that I know more or less what it's about I decided to block it. I'd rather have a native option to opt-out of the assistant, but there are several options when you want to prevent program executions without 3rd party software:

What @burnout426 said, either via GPOs for those using Windows Pro+ or through that registry key; but that way the blockage applies to programs started from Explorer, I don't know if it'd work for the assistant.
Blocking access to the path where the program is through the permission settings, you could remove the writing or execution permission from "C:\Program Files\Opera\assistant" or the executables that are in there; but if the browser or the installer relies on having access to those locations in this case may through errors.
Use AppLocker or Windows Defender Application Control to define rules to block it, but that's not for everyone.

I will be circumventing its execution more or less (because anything running as admin could deter it) instead of blocking it making use of a mechanism Windows has to debug applications. Knowing the program names all that needs to be done is create a registry entry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options and set a Debugger value pointing somewhere else.

Since we want to block the assistant it should look like this (I'm also adding one for assistant_installer.exe for good measure):

After that it wouldn't matter if the assistant were set to execute on boot, whatever program you put in there would be executed instead. There are a couple of caveats:

The Opera installer, if run with admin privileges, could check that key and delete it...
And if it does, depending on what you choose to run instead, you may not know realize the assistant is running again.
It blocks any program with that name regardless of where it is, so if you had another program with the same name it would also be blocked.
Just like with the option to block access via permissions, if the installer or the browser itself expects the assistant to do something it may throw errors.

I'm uploading a registry file for easy use, along with some instructions and the program I'll be running instead (along with its source). It's a dummy program, it does nothing except returning the value 0 to whomever executed it because it's the usual return value for when things go according to plan, just in case.

Here it is: Dummy exe for Opera Assistant

HTH.

A Former User

Quite a lot of lost freedoms just to register on this forum, Was forced to accept data-mining and spam mails I will de-register soon after this message and kill the mail address but feel that I have a small voice that needs to be herd.

Background. I use Opera on rare occasions when I want to partition the stored cookies from two different users who use my computer when loging into a financial site. I have also occasionally used it to look at offers on MadeInIndia or IndiaMart or some such site that does not render properly on my FireFox configuration (for reasons I cannot fathom as I am reasonably vanilla). As this use is very sporadic and rare I have not updated my Opera since I installed it and use it perhaps 3 times a year. The last time probably 3 to 9 weeks ago by my recollection, a long time in my recollection. It is not my default browser and I would have tried to turn off any auto-update features and probably refused any updates along the way, the version may be 2 years out of date for all I know.

Today as I sat down to my desktop that had been switched on for 8 hours at least I notice a pop-up advert in the bottom right of the screen. It is marketing Instagram features of Opera to me. I do not use Instagram and rarely use Opera and here is an advert of a pop-up type I have never seen before. It is covering the lower right corner of my screen and I have not clicked on it at all. It is still on the TOP while I type this with FireFox browser. Task manager shows two instances of the same Opera Browser Assistant running from directory C:/Program Files/Opera/Assistant with a file name of browser_assistant.exe with a file size of 2.86MB (3,004,440 bytes) created 27 February 2020 and last modified 10 June 2020 11 am (today) last accessed 4pm and I write this at 6pm.

This is obviously a Trojan advertising program that has been sent out to some of the idle users of Opera in the hopes that they may click and install some new features and not notice that they never signed up for it. I am running on Windows 8.1 and have managed to avoid updates to 10. I do not want Instagram and no longer want Opera. I will read a bit to find the most effective ways to remove Opera after manually coping my 2 bookmark entries, I will shut down the Opera Browser Assistant process after disconnecting from the net. I am not a good customer for Opera but I am also not a good advocate if I am treated badly. Never before have I had a virus pop-up on my computer and the fact that this is signed by a 'big' name is pretty pathetic.

Attached is the offending pop-up advert from this virus.

Regards
Opera Browser Asistant.png

A Former User @Guest

@kallthefin I found a Reddit thread that has seen another advert in the wild. Commenters were also thinking that it was only available from 3rd party installs so that bit of misinformation has managed to take root.

Search for "/opera_forcing_alwaysontop_opera_gx_ads_i_havent/"

This I would not sign up for even if it was my main browser.

donq

donq @Guest This post is deleted!

hellopeach

hellopeach @skoy21

@skoy21 said in Opera Browser Assistant?:

Just to help out, here what Opera says about Assistant, copied from https://www.opera.com/privacy that @burnout426 posted above.

Browser Assistant. Your copy of Opera for computers may include a component that displays desktop notifications promoting the browser’s features. It checks if any notifications are pending on a scheduled basis and may anonymously report occurrence of certain system events (namely low battery, low hard disk space, new Wi-Fi network connected, another browser installed). This information is not collected by us and no personal information is sent.

So, yes, it seems to be privacy violation. I always choose to NOT send any data and statistics during Opera installation, but it seems Opera Assistant does not respect this option anyway...
As they say, it reports some system events but information is not collected by Opera? Then who collects this information that Assistant reports?

yup, this part of it "collecting some information but not collected by Opera" is really scary, especially considering that Opera is now owned by a bunch of Chinese companies, which includes Qihoo 360, a Chinese "security" company that has a track recording of producing spywares and malwares. I've been using Opera for a couple decades now, but right now I'm really considering leaving it as I'm afraid it will send some information to some of its Chinese owners...

unl33t

unl33t @hellopeach

@hellopeach Good to know. I've been trying to figure out why this application is running for months. I finally uninstalled and reinstalled today only to see it returned immediately. I'll be uninstalling and not using Opera any longer. Shame since I just switched to it last year. I'll take it off my mobile device, too.

A Former User

In my view Opera is not worth bothering with now , I uninstalled it on my computers a few months ago and havn't looked back. No more updating problems, no more opera assistant, no more links (allegedly) to China. I now use Vivaldi full time..I also occasionally use Firefox as it has a couple of extensions that work better in that browser.