Opera Forced Download Activity
-
My most used browser is Vivaldi, but sometimes I still use Opera.
Recently, when Opera is open, a background download will begin. The pattern of download is not continuous; it will run for a few seconds, pause, then run again. If forcibly terminated it will keep restarting. It is not an update download because I once let it run to 500MB and it was still going until I terminated it. I have never allowed the download to finish, if it ever would. When terminated, the download will continue to aggressively and instantly restart. The only way to stop it is to close Opera. Then it will not happen for a while.
The download activity only occurs with Opera active.
I use TCPview to follow the activity and server IP. I use the Bitmeter floating window chart to be aware when the download activity pattern begins.
Does anyone have any clue about what this forced download could be? I ask this question here because many users and admin are very familiar with Opera, and can offer objective opinion. -
@roberto105 My guess is an extension is doing this. The same advice applies here as for Vivaldi, disable extensions and see if the issue disappears, then enable one by one until it reappears. Or try in a clean profile with no extensions or changed settings. Or you might be able to use the Task Manager in Opera to show what internal process has network activity (not sure if extensions will show network activity directly). Maybe find what PID is using network IO in Process Explorer (also Sysinternals).
If I may ask, what is the server IP and port?
TCP View is good for showing connections, but I would recommend the following simple tools as well:
NetworkTrafficView: https://www.nirsoft.net/utils/network_traffic_view.html
SmartSniff: https://www.nirsoft.net/utils/smsniff.html
LiveTcpUdpWatch: https://www.nirsoft.net/utils/live_tcp_udp_watch.htmlKind of overlapping functionality for these tools, I would say LiveTcpUdpWatch would be best for this purpose. SmartSniff might also show you what the traffic actually is if unencrypted, but that's rare these days.
It's also possible to capture and decrypt TLS data from the browser using WireShark, but that's a more advanced topic
-
Thanks for your observations. My only extension is Opera Ad Blocker. Process Explorer shows Opera.exe as the active process(es).
Live TCP update will show IP, like TCP view. BTW, the IP shown is traced only to Bell Canada server, not beyond.
Server is 184.150.158.xxx many ports. It's Bell Canada, but of course they're just the carrier. I haven't been able to trace beyond that. I just wonder why Opera would be force feeding more than 500MB of data.
The only usual unsolicited traffic is the auto update, which amounts to nowhere near that volume, maybe 50MB or less. (In the distant past I and many others have attempted to stop the auto update by deleting the auto update executable but that gets forced as well.) -
@roberto105 said in Opera Forced Download Activity:
Process Explorer shows Opera.exe as the active process(es).
Yes, but what Process IDs? Find the PID in Process Explorer, compare to the Opera internal Task Manager (Shift-ESC) for instance. What actually are these processes doing the download?
Server is 184.150.158.xxx many ports.
What ports? 443 (https) or 80 (http)? Other ports than that would be very suspicious.
Might be a service worker too, check the URL:
opera://serviceworker-internals/
My only extension is Opera Ad Blocker.
Go to the URl:
opera://system/
. Expand the extensions part.
I can promise you the Ad Blocker is not the only extension you've gotYou could also use something like ProcessActivityView (https://www.nirsoft.net/utils/process_activity_view.html) or Process Monitor from Sysinternals to try to figure out what is being written to disk (and where). Process Monitor will also show network operations and you can filter on
vivaldi.exe
for instance. Another good tool is FileActivityWatch (https://www.nirsoft.net/utils/file_activity_watch.html), probably easier as you don't need to know the PID to watch. -
@Pathduck
Thanks again for the input. I was unaware of many of the resources you list. Many years ago I was quite curious and interested in such things but gradually came to treat computers as appliances so don't dig in the way I used to though I still have some capability.
Nothing suspicious in service workers or extensions, I don't load up on services, don't use social media, none activated, or sync of devices, so pretty clean. When the downloading event occurs again I'll get into Process Monitor (which I haven't used for years) and analyze what's going on and where the download is ending up.
Nothing happening for the last while.
Thanks again for the suggestions, which will help me when the next 'event' occurs. -
@roberto105 Opera does have forums, you might want to ask there.
-
@Eggcorn Yes, I did a search of the Opera forums, nothing there, I'm mostly done with O now, didn't feel like registering again to post a comment after deregistering many years ago. If something weird happens people will usually jump on it and you'll see a lot of activity. I tried the Vivaldi forum because a great number of V people have a lot of knowledge of Opera, I think many still use it to some degree (old habits), and could possibly offer suggestions.
I found the 500MB download (which I finally interrupted unfinished) puzzling enough that it was worth a shot to ask here, just out of curiosity. Not an issue for me any more, wasn't able to diagnose the problem just as an interesting exercise, and anyway I've mainly been using Vivaldi for some time. -
@roberto105
My problem with Opera was that the speed of downloads was almost glacial, and I had to use a different browser for downloading. I decided to get rid of it and got Vivaldi instead. -
This post is deleted! -