"Today a popup asked if I wanted to update to the latest version of Opera. I said no. When I next turned on the computer - it was updated without my permission."

Check Program Files/Opera and confirm whether Opera was actually upgraded. I had a similar experience and discovered it didn't actually upgrade Opera -- I'm still at Presto -- but did completely upend my Opera prefs ini file, totally changing the look and feel of Presto and making it unusable. Until I started digging deep into my system, I also thought I had somehow been upgraded. Solution was to replace the new prefs file with a recent backup copy of the old one.

As I said in the other thread, to try to cram down an upgrade to people who've specifically opted out of upgrades and then destroy the utility of their existing Presto installation by replacing the prefs ini file is more than an ethical lapse.

Given that there now has appeared an announcement on this board that Opera has begun "offering" Presto users an upgrade to Opera 25, I believe it's fair to assume I was in fact a victim of a botched attempt at this "offer."

Listen Opera: If I want an upgrade, I will come to you for one.

As I hope my chain of posts finally made clear, I originally thought that an upgrade had gone through without my consent, but that doesn't seem to be the case. It seems to be the %appdata%/Opera files that have been changed, not the Opera Program Files.

And now that I've remembered that I have a very recent backup of my system files handy, I've been able to go back and see just what was changed in %appdata%/Opera. The biggest change seems to be operaprefs.ini. I had very customised settings and a large operaprefs file before the attack (or whatever). Afterward, operaprefs shrank to about 2kb from 8kb. As I said, Opera seemed to be upended after the "attack" and I assume the re-write or replacement of my operaprefs file caused that.

If anyone wants to see these files, they are available here (I've changed the extension from .ini to .txt, so you simply view the text on Google):

https://drive.google.com/file/d/0BynECQ6zBQFXVHRUUUZlQjNZMHc/view?usp=sharing

https://drive.google.com/file/d/0BynECQ6zBQFXa0dzMmJxdTlOUU0/view?usp=sharing

"OLDprefs" is my operaprefs file a week or two ago. "NEWprefs" is the much shorter file after the "attack." Whatever else happened, it's fairly clear the operaprefs file was somehow replaced. If someone recognizes the possible source of that NEWprefs file, I'd be glad to hear about it.

To bring this to a close:

I have done a thorough search. There's only one Opera version on my system. Nothing has been changed in Program Files/Opera -- I've checked it against an offline system backup I made last month. All the changes are in %appdata%/Opera.

I have copied the old %appdata/Opera folder from the system backup over to my current system, and I now have my old, pre-disaster Opera back (minus very new bookmarks, etc.).

Perhaps that splash screen "upgrade" will come back, in which case I'll do a screen shot and return.

Thank you.

The upgrade splash was a full screen, probably lightish blue with some graphics in the center. As I have said, I was furious because it gave me no option to postpone or reject the upgrade.

Yes, there are hackers about here who are motivated and talented. But I would certainly not want to be alarmist about this unless I was absolutely sure that those files on my machine did not come from Opera.

No AV other that PF 7.

The splash screen was in a frame; there were no navigation buttons available, but there was an address bar. There was no way to move from it. I restarted the browser, thinking the splash screen would disappear, but it didn't, so I browsed to a website using the address bar, and discovered the appearance of the browser had changed completely.

I am quite willing to send the %appdata% files to someone at Opera who can tell me whether they are in right order, or not.

And yes, I note my post count isn't increasing for some reason. (I'm posting with Firefox, not Opera).

As I said, the version number of Opera has not changed. I have website logs showing the same version before and after the event, and there has been no change to any of the files in Program Files/Opera (at least according to Windows timestamps). The only change seems to be in the Opera %appdata% files.

can't go to Help > Opera because it doesn't show.

No one has physical access to my machine. I am the sole user.

Opera 13?

This is how my Opera now logs, same as before:

Opera/9.80 (Windows NT 5.1) Presto/2.12.388 Version/12.17

Opera.exe and opera.dll both show version 12.17.1863.0.

I did not see your 2:51 post before making my post.

As you can see from the link, my Opera %appdata% file shows several files created or modified at the time of the attempted upgrade.

Do I understand your note correctly: that the creation and modification of these files is NOT the result of any activity by Opera's servers?

This is a very important point.

I was not aware of any malware which could install by mocking itself as an Opera upgrade.