Skype - Bing Rewards - Malware?

The last time Skype updated the software to 6.7, I immediately started having a problem after the update.

During the Skype update, it appears that a new registry key was written to Internet Explorer Main.  This key sets a value for "First Home Page" of .

This registry key and url, when IE starts, bypasses my normal home page and redirects to¿REW&publ=skypeuniversalinstaller&crea=TEXT_MFEREW_¿... which is an advertisement to join Bing Rewards and get free Skype credit.

I have tried removing the key, it is immediately written back.

I have tried various malware removal tools, and have been able to temporarily remove the issue - but it as soon as I start using Skype again, the issue is back.  I've tried uninstalling Skype.  To no avail.  Whatever was installed with Skype doesn't seem to get uninstalled with Skype.

Understand, this is not a matter of resetting the home page.  My home page has not changed, and it doesn't matter to what url it is set (including, for example about:blank.)  There is a new registry setting that is overriding the chosen home page.

Can someone please tell me how to remove this issue and how to keep it from re-occuring?

One comment I had received on another forum was that this "offer" should only be extended one time after the installation of the Bing toolbar.  But the Bing toolbar is not installed.  I did try installing and uninstalling the Bing toolbar to see if the issue would go away - to no avail.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Sudeep SharmaTechnical DesignerCommented:
First I would suggest you to check the Shortcut of IE and other browser. Sometimes Browser shortcuts have the Link in them.

Right click on IE and select properties and check the Target value and make sure there is nothing after it. Like you said "¿REW&publ=skypeuniversalinstaller&crea=TEXT_MFEREW_¿..."

Normal IE shortcut would look like this.

IE Shortcut
When you installed Skype did you install the Bing with it?
It seems to come with Internet Explorer.
I have already uninstalled my Bing
I tried Skype and found I had to go to the startup programs and stop it from running at boot or when my windows startup.

look in your taskmanager and stop the background  SKYPE software running
Open Internet Explorer >tools>manage add ons
Click on All add ons
if you can see Bing Toolbar disable it for now
All Add onsThen open internet options
On the home page take out what is there and actually type in what I have
Press ok and apply  don't click on use default or current
just  ok and apply close Internet explorer and reopen check if it's still using the about tabs
I tried to remove any home pages and use blank but this new IE10 wouldn't let me use blank but this works and you get the page you see in the background, it's nice and clean and helps IE to load quicker.
About tabsMake Google your default search engine that will replace Bing as well
install the toolbar if necessary as your new search engine
click on the wrench check the settings and remove Bing
click on wrenchUninstall the Bing
close all browsers
 go to control panel uninstall a program >Bing bar
while you are there look down through the list of installed programs and remove any you don't want.
it should be removed now.
Bing Rewards Client Installer from Microsoft Corporation
How do I remove Bing Rewards Client Installer?
Quickly and completely remove Bing Rewards Client Installer from your computer by downloading "Should I Remove It?", its 100% FREE and installs in seconds (click the button below).
Or, you can uninstall Bing Rewards Client Installer from your computer by using the Add/Remove Program feature in the Window's Control Panel.
kbachlerAuthor Commented:
@SSharma - No, the redirect is only in the registry, it is not in the shortcut.
Check Out How Miercom Evaluates Wi-Fi Security!

It's not just about Wi-Fi connectivity anymore. A wireless security breach can cost your business large amounts of time, trouble, and expense. Plus, hear first-hand from Miercom on how WatchGuard's Wi-Fi security stacks up against the competition plus a LIVE demo!

kbachlerAuthor Commented:
Bing Bar is not installed.

Redirect occurs no matter what is in homepage - including about:blank.

Google is the default search engine already.

The redirect appears to be ONLY in the registry, and apparently can't be removed permanently.

Bing Rewards Client Installer is not listed as an installed program.

I'll try the uninstaller you mentioned.
kbachlerAuthor Commented:
The uninstaller also did not find Bing Rewards Client Installer.

With Skype uninstalled, I tried deleting the Registry entries - they still returned shortly after deleting them.

No joy.
Sudeep SharmaTechnical DesignerCommented:
Should be malware then?

I would recommend to scan the system with the tools mentioned below and in the sequence they are mentioned and post the logs

Make sure you DO NOT REBOOT the system after running tools in point 1 & 2.

1. RogueKiller/TheKiller
2. MalwareBytes
3. TDSSKIller

I would also recommend you to go through the articles from Younghv and RPG for the links of the tools and for the future reference

Basic Malware Troubleshooting



Run MalwareBytes in Quick Mode and if that required reboot, then reboot the system and run tools mentioned in point 1 and 2 but this time run MalwareBytes in Full Systen Scan.

So in your next reply post the RogueKiller logs, MBAM logs and TDSSKIller Logs


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
According to Skype and Microsoft none of them could resolve this.
One user found a solution by running Combo fix
How to use ComboFix

How Do I Avoid Signing Up for Bing Rewards? microsoft site solution is to use Combo Fix

Go to start>run>type in msconfig   press enter
select selective start-up
selective start-upuntick Bing or similar name.
Untick Skype
startup group
Is this your question as well?
Bing Rewards forced homepage - Skype Malware?
The Bing Rewards offering comes together with the Bing toolbar installation. It should only be shown once the first time you start Internet Explorer after having installed / updated your Bing toolbar.

Have you tried the system restore once Skype was uninstalled as well?
kbachlerAuthor Commented:
I was the user who tired Combofix.  The problem returned once Skype was used again.  Skype is not currently on the system, Bing Bar was never installed.  I'm going to try all the malware attempts with Skype off the system, and then see if reinstalling a clean Skype avoids the problem.
Sounds good idea kbachler
Check your task manager that no services a still running.
Also when you run Skype setup please look closely of any offers don't tick those
The Bing Bar is installed automatically when you install Skype 5.8 for Windows desktop. However, if you do not wish to install the toolbar, simply un-check the box and click Continue.
If the original Skype installed is the cause try the default one
How to download Skype and install
kbachlerAuthor Commented:
Skype has been uninstalled for awhile, no joy.  I have some family functions today and hope to get to this tomorrow in terms of trying various malware elimators.

Perhaps someone else has suggested this, so forgive me.  Run AutoRuns and see what programs load at Start up.  This may help you find the bad actor.
kbachlerAuthor Commented:
Thank you all for your help.  For now, the issue appears to be resolved.  Steps included:

1. Uninstalling all anti-virus and anti-malware software.
2. Running in order a. RogueKiller/TheKiller, b. MalwareBytes c. TDSSKIller
3. Deleting the registry entries for First Home Page manually

It is POSSIBLE that anti-malware protection was preventing the changes to the registry.

I'll follow-up if anything returns.
kbachlerAuthor Commented:
The addition of "3. Deleting the registry entries for First Home Page manually"
KK HAHDCommented:
These companies advertise mostly their own or third-party products like when installing adobe flash player it advertises for an antivirus like:

Adobe flash player advertisments
Same like this Microsoft is advertising his own products using this advertising method. So you need to uninstall SKYPE and re-download full setup without these extra advertisements:

Here you can download Skype Latest Official Full Setup File without any advertisement.

Hope it helped you!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.