unwanted download and install

  • I'm not an Opera user. So this might be the wrong question to ask here, but I can't seem to find an answer anywhere else. Does anyone know why Opera would download and install automatically? I didn't try to put Opera on my system, but every three days it downloads and installs. I've used Revo uninstaller and the Opera uninstaller. Even did a system search for "Opera" and deleted everything I could find. Thought someone here might know of a hacker doing this.

  • Opera doesn't download and install automatically unless you have installed a previous version and have enabled automatic updates.

  • Well it is on my system. I didn't install it to begin with. I've made extensive attempts to remove it completely, and it keeps coming back.

  • Then you need to do a thorough check of your system for malware.

    Unless someone else is using your machine without you knowing about it ?.

  • Is this a real and usable Opera, with Google as default search engine (or Yandex if you're in CIS or Baidu if you're in China instead of a hideous "competitor"), clean, no extensions installed, etc?

    Are you the administrator of your system or are you on a enterprise-like domain? There's also software to roll back all changes in the computer when you restart it that could be involved here.

    Do you see anything regarding this Opera setup in the Windows' task scheduler, services or start-up items?

    Last question, why not use Opera? 🙂

    What I saw another day was Opera being offered in the PDFCreator setup (it's a very clean and fair bundle i.e. it's not checked as default, it presents an image of Opera, describes what it is and asks if you want it with two buttons: "Accept" and "Decline"), but it surely doesn't install back if you uninstall it via the conventional ways (I did that myself).

  • Rafaelluik,I'm not sure if it's a real Opera. I don't want to use software that magically appears on my system. So far, I delete it as soon as it appears. I am the administrator on my system, and have looked at the registry, scheduler, and all most everywhere else on my drive to find out what's calling for Opera to download and install. I've also been working with Vipre, my virus software people. They aren't having any success either. I thought someone on this forum might have heard of some hacker that thought we all should be using Opera.

    I'd consider using Opera, if it weren't for this intrusion on my system. Actually, I wouldn't have even known about Opera if it wasn't for this. I run Chrome and Firefox right now. When I've solved this problem I'll probably give Opera a try.

    Thanks for the comment Rafaelluik

  • I should mention I've deleted this install at least four times. Every three days it downloads and installs

  • In the week or so BEFORE you saw Opera first appear, did you download/install any software on the system, especially freeware? The behavior is reminiscent of an adware "software auto-updater" that too often users find bundled (sometimes covertly) with other downloads. These malicious programs embed themselves deeply in multiple ways so that they can respawn themselves periodically to do whatever they're trying to do.

    One of the ways to spot these is to look in Task Manager for suspicious processes that magically reappear if killed there, but you do have to have a "feel" for what should ordinarily appear there on your system so as not to kill a key system process.

    Also, take a look at your system using both AdwCleaner and Malwarebytes. They're free, highly reputable, and they can find things a regular antivirus program overlooks.

  • I don't want to use software that magically appears on my system.
    But you said "I'm not sure if it's a real Opera."

    So if it's a fake Opera browser or a highly modified version to get you to use other search engines that pay or promote this kind of distribution, to get you to see different ads and track you via extensions, made by a malicious person, or perhaps a third-party installer or utility pushing it into your system and you're going to blame Opera Software ASA for that and **** on their products?

  • blackbird71,that was my first thought. When the SSL thing hit the news I installed LastPass password generator, but not anything else. I've added Bitmeter since this started. I've searched out malicious software like you mentioned, but this one really has me stumped. Since Vipre hasn't been able to detect this, I agree it's got to be hiding somewhere like you mentioned. I'll give those two programs you gave me a try, thanks.

  • It really does sound like this is malware of some sort.
    Things don't just install themselves without some other agent being involved.
    When and if it happens again, look in Task Manager to see what's actually running.
    If the file opera.exe is listed as running, find it on the system and look at its properties, especially the digital signature.
    I'd be very surprised if it's a genuine opera file.
    🙂

  • Even if it's the genuine Opera, a third-party app may be pushing the installer. Maybe Opera partnered with a third-party to advertise their software and they have no knowledge this third-party is doing things like that perhaps to fool Opera into thinking this company's ad campaign is very successful...

    We just don't know yet.

    Until now we have no info about what's running in your system, no log, no screenshots... I'll remain skeptic. If it's proven Opera is doing that on purpose, I'll be the first to defend you and try to get this practice to shut down.

  • One step might be to disable and delete all MSIE toolbars.

    What's your default browser? IE, Firefox, Chrome, ???

  • Do a scan with Malwarebytes in safe mode.

  • You guys are great!

    As I continue to dig into this I find a record in my Vipre antivirus that shows 22.0.1471.70 as the version of Opera that is being installed. Since July 8, there have been six downloads and installs. I've run both AdwCleaner and Malwarebytes, but not in safe mode. They did pick up a couple of culprits that Vipre has been blocking too. I've made a copy of my processes with no apps running, and will be watching for Opera to sneak in again. I'll be going back into safe mode to see what else I can catch. Vipre scan has been run in safe mode twice now.

    Considering the response here, I really have to consider Opera as one of my browsers when I've solved this problem. What's the opinion here about what would happen, if I had the newest version of Opera already installed? Would I at least get some notice that Opera was already on my computer? Right now the only notice I get is the icon that shows on my desktop. My main browser right now is Firefox, and I rarely use Chrome. Internet Explorer has been deleted since this system was new. I could drop Chrome and add Opera.

    I can't imagine Opera would be trying on its own to install on my system. Like most of you, I believe somehow I let the download/install sneak in with some other program. Until this started I had no connection with Opera.

    I really have to thank all of you. Until I got on this forum it was beginning to look like I'd be formatting my hard drive, and starting over. Of course, I'm still not sure I've got a fix yet.

  • It would be very interesting to see what would happen if you did install Opera "properly"!
    🙂

  • Went to youtube and checked old reviews of Opera from the beginning of the year. All pretty good on ver 19. Since I'm not really using Chrome, I think I'll install a "real" version tonight and see what happens. Might as well turn this lemon into lemonade. 😉

  • You got the right spirit 😉

  • Internet Explorer has been deleted since this system was new.

    Huh?
    Come again?

  • Joshl, I never found IE to be a very good browser. First thing I do is disable or delete it.

Log in to reply
 

Looks like your connection to Opera forums was lost, please wait while we try to reconnect.