Opera browser is trying to visit a harmful website everytime I open it

[Wrichik Basu]

On our Windows 7 32-bit desktop, we have two browsers: Opera (default) and Chrome. Both are updated to the latest version.

Every time we open Opera, we get this message from Quick Heal:

This pop-up is not shown when Chrome is opened.

I cannot understand who is trying to access this website: tudap.ru. Is there some type of virus in the system? I conducted a full system scan with Quick Heal and also with the Malwarebytes tool, but nothing was found. This problem has started very recently; maybe only some weeks old.

Any idea how this can be solved? Is an extension causing this problem?

 

[jedishrfu]

What is more disturbing is that Chrome did not find it?

It could well be a virus that is doing this popup. I did check and Quick Heal is a valid provider of internet security from India. So perhaps a Quick Heal chrome plugin isn't installed.

How about trying Firefox?

More on tudap here:

https://rankchart.org/site/tudap.ru/

Seems safe from Google's and Semantics perspective, hence not being flagged.

 

[Borg]

I would take a look at the home page URL that is set in Opera. It's probably not what you expect.

 

[DaveC426913]

It's possible that Opera has a browser extension installed that Chrome does not.

 

[Wrichik Basu]

What is more disturbing is that Chrome did not find it?

Yes.

So perhaps a Quick Heal chrome plugin isn't installed.

There is no Quick Heal plugin. The software works on all browsers on the system. It acts like a firewall.

How about trying Firefox?

The pop-up is coming only with Opera.

 

[Wrichik Basu]

I would take a look at the home page URL that is set in Opera. It's probably not what you expect.

It is set to the Opera Start Page, and that is what we had set it to.

It's possible that Opera has a browser extension installed that Chrome does not.

True, Opera has two extensions that Chrome doesn't have. But they have been there for ages.

I checked the Quick Heal report page, and it seems the problem started from 26/8/2020. I don't remember installing any new software/extension during/before that time which can cause this problem.

 

[jedishrfu]

I checked online and could find no reports related to the tudap website as a bad site to visit perse although it does come from the Russian Federation.

 

[Wrichik Basu]

I checked online and could find no reports related to the tudap website as a bad site to visit perse although it does come from the Russian Federation.

The fact that it is not a harmful site lowers the worries. But one question remains: why is Opera trying to reach this site every time it is opened? I can configure Quick Heal firewall to allow access to this site, but I can't see any application installed on my PC that would normally want to reach this site.

 

[jedishrfu]

Maybe you could ask on the Opera forums:

https://forums.opera.com/

The Opera user community might have the answer.

 

[Wrichik Basu]

Found the cause of the problem: it was this extension: https://addons.opera.com/en/extensions/details/all-in-all-downloader/

It was installed for many years, so I never suspected it. Removed it, and now everything is fine.

Thanks everyone for the suggestions/advice/help.

 

[jedishrfu]

How did you discover it? process of elimination, or some scan of code?

EDIT: Okay I see a user comment on the link you provided flags it as spam.

 

[Wrichik Basu]

How did you discover it? process of elimination, or some scan of code?

Yes, simple process of elimination. I disabled all the extensions, and restarted the PC. On opening Opera, the pop-up was no longer coming. So I started enabling the extensions one by one. As soon as I enabled this extension, the pop-up came up. I verified it by disabling and enabling it again. After i removed the extension, the problem is gone.

EDIT: Okay I see a user comment on the link you provided flags it as spam.

I have put that comment.

 

[jedishrfu]

Ahh, I didn't catch that you were the poster of the comment. Good job to warn others.