Latest Windows version installing a F*book launcher?

[burnout426]

burnout426 Volunteer last edited by

To me, it sounds like some malware is modifying the shortcuts to Opera's launcher.exe to pass facebook.com to it.

[donq]

donq last edited by

This all would be pretty easy to check - let @hbilke share f-booking Opera installer and we can install it and see what happens.

[hbilke]

hbilke @leocg last edited by

@leocg It's a VM that is reset after each test. I ran the install w/f*book three and the Installer w/o two times. The "f" always Puts the f-shortcut onto my taskbar - the other one not. Neither MS Defender nor Sophos online scan fires an alarm. Sysinternals autochecking autoruns against virustotal gives no suspicous files/processes. To me it Looks Like it's in the Installer I downloaded on 05/09 22:00 from opera.com

Cheers and stay healthy these dass
Harry

[hbilke]

hbilke @donq last edited by

@donq Nice Idea. Am a bit Low in the bandwidth side due to corona-home-office. But If someone wants the file send me a link or PM.
Maybe someone from Opera leser dette og kunne klarer opp forholdet? Dere kan gjerne komme in i diskusjonen.
Harald

[leocg]

leocg Moderator Volunteer @hbilke last edited by

@hbilke It was the online installer or the offline one?

Downloaded from opera.com?

[hbilke]

hbilke @leocg last edited by

@leocg online - it's about 2megs

[leocg]

leocg Moderator Volunteer @hbilke last edited by

@hbilke Just downloaded from opera. com or it was one that you already had?

[hbilke]

hbilke @leocg last edited by

@leocg yep dl/d from opera.com since .no had an expired cert

[hbilke]

hbilke @leocg last edited by

@leocg as I wrote the "Buggy one" ist from May 9th. A downloaded File from 12th seems olrite and boils me down bit.

[opera-user-from-2002]

opera-user-from-2002 @hbilke last edited by

@hbilke Could you share the installer and SHA-512 checksum for it?

[burnout426]

burnout426 Volunteer last edited by burnout426

In the VM, what browser did you use to download the Opera installer from opera.com? Did you type opera.com in the address field or did you click a link to opera.com on some other website to get there? What OS were you running in the VM btw?

I guess some Opera partners have an installer that includes Facebook shortcuts and you somehow got that installer. You shouldn't be served that installer unless you clicked on a special link from a partner website or app/program. However you got it, it was just a mistake and it's not malware or anything like that. If it happens again, try to figure out what triggers the downloading of the wrong installer so the website bug can be fixed.

[hbilke]

hbilke @burnout426 last edited by

@burnout426
The dl was done with firefox and your hint about direct or indirect download made me check:

IT was a redirect from reputable well-known ct-magazine (Germany based)

The downloadlink is
https://net.geo.opera.com/Opera/stable/utm_medium.... (with ref to ct-mag)

So I have to quarry there.

Me thinks I can stay with Opera.

Cheers to all contributers

Stay healthy
Harald