After last update, Opera isn't standard browser
-
upgradevictim last edited by
No AV other that PF 7.
The splash screen was in a frame; there were no navigation buttons available, but there was an address bar. There was no way to move from it. I restarted the browser, thinking the splash screen would disappear, but it didn't, so I browsed to a website using the address bar, and discovered the appearance of the browser had changed completely.
I am quite willing to send the %appdata% files to someone at Opera who can tell me whether they are in right order, or not.
And yes, I note my post count isn't increasing for some reason. (I'm posting with Firefox, not Opera).
-
linuxmint7 last edited by
No AV other that PF 7.
Have you thought about maybe doing a scan for malware or other such dodgy software that maybe lurking on your system that you may not know about ?. Maybe PrivateFirewall 7 may not be enough ?, and it's always good to have a second or even third opinion.
-
upgradevictim last edited by
The upgrade splash was a full screen, probably lightish blue with some graphics in the center. As I have said, I was furious because it gave me no option to postpone or reject the upgrade.
Yes, there are hackers about here who are motivated and talented. But I would certainly not want to be alarmist about this unless I was absolutely sure that those files on my machine did not come from Opera.
-
A Former User last edited by
-break[playing-around] Yes, you're definitely cursed: unnatural happenes on your machine, Operaforums doesn't want to update your postcount.
You're doomed, dude! :cheers: [/playing-around]
/end of-break 
-
blackbird71 last edited by...
The splash screen was in a frame; there were no navigation buttons available, but there was an address bar. There was no way to move from it. I restarted the browser, thinking the splash screen would disappear, but it didn't, so I browsed to a website using the address bar, and discovered the appearance of the browser had changed completely.
...And:
The upgrade splash was a full screen, probably lightish blue with some graphics in the center.
...That sounds as if it was actually a web-page appearing within a browser, rather than a typical "floating" update pop-up notification. Can you recall what the splash screen actually said? That is, did it tell you an Opera update was required, that an update was in-progress, or that an update had already occurred (like with a "welcome" screen)?
What version of Windows are you using? If you navigate through its control panel to the 'uninstall' programs area that one normally uses to remove a program, how many instances of Opera appear in that listing? Since Opera isn't capable of "updating" a Presto version into a Blink version, I'm trying to figure out if something instead of updating, triggered a normal 'manual,' first-time Blink Opera installation, which would be installed in parallel with the old installation, and send you to a welcome screen. In such a case, that new-install process would create new Opera shortcuts that would direct the user to the new installation, rather than the old Opera installation (which would still live on the system).
-
A Former User last edited by
Black, we've already guessed that's probably not the case. And I'm thinking of a malicious site now... Another question is what pushed it.
If that something was on machine before - to call on that site - ?"Upgradevictim", can you access your browser's history (if you haven't been browsing much since the event)? (You weren't in the private mode, were you?)
And - was your antimalware software up-to-date at the moment? -
blackbird71 last edited by
Black, we've already guessed that's probably not the case. And I'm thinking of a malicious site now... Another question is what pushed it.
...Uhmm... I'm unaware that any conclusions have been reached, other than a recognition that Presto Opera installations cannot currently be updated into Blink Opera installations. What is still conjecture is whether a normal Blink Opera installation was somehow invoked on his system, occurred, and installed its own shortcuts - which, when clicked, the user dutifully thought would activate his old browser, but which instead activated the new install and routed that browser to Opera's "welcome" page upon browser startup. Thus far, I've not seen anything definitive that rules out two Opera versions being on his system - especially if the root (c:) program folders haven't been examined for that possibility.
My own suspicions also lean toward malware involvement, but we need to find out precisely what has actually occurred... and what has not occurred.
-
A Former User last edited by
As I said, the version number of Opera has not changed. I have website logs showing the same version before and after the event, and there has been no change to any of the files in Program Files/Opera (at least according to Windows timestamps). The only change seems to be in the Opera %appdata% files.
Black, the user seems to have checked things...> This is how my Opera now logs, same as before:
Opera/9.80 (Windows NT 5.1) Presto/2.12.388 Version/12.17
Opera.exe and opera.dll both show version 12.17.1863.0. -
blackbird71 last edited by
As I said, the version number of Opera has not changed. I have website logs showing the same version before and after the event, and there has been no change to any of the files in Program Files/Opera (at least according to Windows timestamps). The only change seems to be in the Opera %appdata% files.
Black, the user seems to have checked things...> This is how my Opera now logs, same as before:
Opera/9.80 (Windows NT 5.1) Presto/2.12.388 Version/12.17
Opera.exe and opera.dll both show version 12.17.1863.0.Yes, I understand. But I'm unsure whether or not that means he doesn't have two Opera versions installed (or Opera and who-knows-what)... it shows something being "logged" somewhere, but there's a lot of room for confusion in that. And the versions of the files he's looking at may not be the files actually in use when he activates "Opera"... that would require some deeper examination with a process explorer, etc. when the "Opera" is running to track down where (folder/file/etc) it's actually running from. (As it is, I'm now having to go offline for the next several days, so hopefully others can help track all this down.)
-
leocg Moderator Volunteer last edited by
Here's what my Opera looks like now, when that side panel is showing:
Well, panels have been there since 2001 and it's always been an user's choice to use them or not.
It seems to me that your installation got messed up somehow and it has triggered an update that ended resetting your settings or some of them.
can't go to Help > Opera because it doesn't show.
Click on Alt key to show the menu them click on "show menu bar" to dispplay the menu bar on a permanent way.
The upgrade splash was a full screen, probably lightish blue with some graphics in the center. As I have said, I was furious because it gave me no option to postpone or reject the upgrade.
That's strange. Usually the update notice is a (small to medium) dialog window.
-
-
A Former User last edited by
Black, the user seems to have checked things...
Yes, I understand. But I'm unsure whether or not that means he doesn't have two Opera versions installed (or Opera and who-knows-what)... it shows something being "logged" somewhere, but there's a lot of room for confusion in that. And the versions of the files he's looking at may not be the files actually in use when he activates "Opera"... that would require some deeper examination with a process explorer, etc. when the "Opera" is running to track down where (folder/file/etc) it's actually running from.
Sounds like a horror movie (particularly that in the fore parentheses).
-
upgradevictim last edited by
To bring this to a close:
I have done a thorough search. There's only one Opera version on my system. Nothing has been changed in Program Files/Opera -- I've checked it against an offline system backup I made last month. All the changes are in %appdata%/Opera.
I have copied the old %appdata/Opera folder from the system backup over to my current system, and I now have my old, pre-disaster Opera back (minus very new bookmarks, etc.).
Perhaps that splash screen "upgrade" will come back, in which case I'll do a screen shot and return.
Thank you.
-
A Former User last edited by
So we're to decide that there weren't any actual upgrade?
Take your postcount pills, heed the URLs and, if you haven't deleted/replaced them - you were going to show them files to certain folks, weren't you? Just make sure they're no way executable anywhere.
-
upgradevictim last edited by
As I hope my chain of posts finally made clear, I originally thought that an upgrade had gone through without my consent, but that doesn't seem to be the case. It seems to be the %appdata%/Opera files that have been changed, not the Opera Program Files.
And now that I've remembered that I have a very recent backup of my system files handy, I've been able to go back and see just what was changed in %appdata%/Opera. The biggest change seems to be operaprefs.ini. I had very customised settings and a large operaprefs file before the attack (or whatever). Afterward, operaprefs shrank to about 2kb from 8kb. As I said, Opera seemed to be upended after the "attack" and I assume the re-write or replacement of my operaprefs file caused that.
If anyone wants to see these files, they are available here (I've changed the extension from .ini to .txt, so you simply view the text on Google):
https://drive.google.com/file/d/0BynECQ6zBQFXVHRUUUZlQjNZMHc/view?usp=sharing
https://drive.google.com/file/d/0BynECQ6zBQFXa0dzMmJxdTlOUU0/view?usp=sharing
"OLDprefs" is my operaprefs file a week or two ago. "NEWprefs" is the much shorter file after the "attack." Whatever else happened, it's fairly clear the operaprefs file was somehow replaced. If someone recognizes the possible source of that NEWprefs file, I'd be glad to hear about it.
-
blackbird71 last edited by
One "peculiarity" in the NEWprefs file is that in the "Install" section, the "Newest Used Version" and the "First Used Version" are both 12.17.1863. Also, in the "State" section, there is no "Upgrade Count" nor "Upgrade From Version" entries as there are in the OLDprefs file. This would seem to indicate that for some unknown reason, something attempted to install at least part of a second 12.17 version (of some kind) over top of the original 12.17 user files. It's hard to accurately guess what might have triggered such an event, though the possibilities of "bits gone mad" via some kind of system transient/glitch or a clever malware attack both remain. In the case of a transient-related issue, if key files get corrupted, Opera 12 will automatically copy in a default version of such files to the user folder from the program folder and go on from there. But I'm not sure that such a re-installed version of the operaprefs.ini file would look anything like what appears in your NEWprefs file.
-
upgradevictim last edited by
Given that there now has appeared an announcement on this board that Opera has begun "offering" Presto users an upgrade to Opera 25, I believe it's fair to assume I was in fact a victim of a botched attempt at this "offer."
Listen Opera: If I want an upgrade, I will come to you for one.
-
blackbird71 last edited by
Be aware that assumptions can be dangerous. I've yet to see evidence that their "offer" of "upgrading" Presto Opera to Opera 25 occurs via the auto-upgrade path rather than being a solicitation to a manual update by a user. I've attempted a number of upgrade checks with several different Opera Presto versions on my systems since the announcement was first made, and all those attempts indicate Opera 12.17 is the 'latest' version. In other words, Opera 25 is not being offered by that method (at least, not here and not now). It is more likely that the 'announcement' in this forum is because Opera 25 contains both a bookmarks manager and the ability to auto-import bookmarks from a user's current default browser, both major complaints by Presto users regarding prior Blink versions.
On the other hand, if the announcement's terminology of the upgrade being offered to "some" Presto users indicates a selective offering to some of those users in some way via Opera's auto-update processes and servers, then your experience might indeed indicate such an auto-update attempt gone awry... particularly if you were not offered an option, which you indicate was your experience. I imagine all this will eventually become clearer within a short time. In the meantime, I continue to choose giving Opera the benefit of the doubt, largely based on their past reputation.
-
blackbird71 last edited by admin
UPDATE - Hmmm. From comments:
https://forums.opera.com/post/54173
and
https://forums.opera.com/post/54279
it would appear that something is indeed going on in the realm of Opera auto-updating Presto Opera versions to (currently) Opera 25. In both above cases, the updates were unsolicited by the user himself; and in the second case, the user states he declined the spontaneously-offered update, but it appeared to have completed anyhow after he restarted his computer. Coupled with the tenor of the announcement about upgrades being offered to "some" Presto users, it appears to me to be likely Opera is selectively using Presto Opera's update query to provide auto-updates to some users, but not necessarily to anyone who simply manually checks his update status from within Presto. (Such selectivity is sometimes used by software providers to keep from overloading the update servers.) That kind of updating, in turn, may well have started at least sporadically/experimentally prior to the announcement made today (15 October). Moreover, it seems that this updating process is not behaving either consistently or appropriately in at least some users' experiences. Both the comments refer to users running Opera in sandboxes.
I'm still awaiting Opera's "official" comments on all this, but that updating process's behavior has clearly been either inadequately tested in the real world or the updating process's design is inappropriately ignoring users' choices and/or Presto browser update settings.
