• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1768
  • Last Modified:

Skype - Bing Rewards - Malware?

The last time Skype updated the software to 6.7, I immediately started having a problem after the update.

During the Skype update, it appears that a new registry key was written to Internet Explorer Main.  This key sets a value for "First Home Page" of http://g.msn.com/1ewenusDefaultPack/UP97_FRPage .

This registry key and url, when IE starts, bypasses my normal home page and redirects to http://www.bing.com/rewards/signup/webtou?form=MFE¿REW&publ=skypeuniversalinstaller&crea=TEXT_MFEREW_¿... which is an advertisement to join Bing Rewards and get free Skype credit.

I have tried removing the key, it is immediately written back.

I have tried various malware removal tools, and have been able to temporarily remove the issue - but it as soon as I start using Skype again, the issue is back.  I've tried uninstalling Skype.  To no avail.  Whatever was installed with Skype doesn't seem to get uninstalled with Skype.

Understand, this is not a matter of resetting the home page.  My home page has not changed, and it doesn't matter to what url it is set (including, for example about:blank.)  There is a new registry setting that is overriding the chosen home page.

Can someone please tell me how to remove this issue and how to keep it from re-occuring?

One comment I had received on another forum was that this "offer" should only be extended one time after the installation of the Bing toolbar.  But the Bing toolbar is not installed.  I did try installing and uninstalling the Bing toolbar to see if the issue would go away - to no avail.
0
kbachler
Asked:
kbachler
  • 7
  • 3
  • 2
  • +2
2 Solutions
 
Sudeep SharmaTechnical DesignerCommented:
First I would suggest you to check the Shortcut of IE and other browser. Sometimes Browser shortcuts have the Link in them.

Right click on IE and select properties and check the Target value and make sure there is nothing after it. Like you said "http://www.bing.com/rewards/signup/webtou?form=MFE¿REW&publ=skypeuniversalinstaller&crea=TEXT_MFEREW_¿..."

Normal IE shortcut would look like this.

IE Shortcut
Sudeep
0
 
MereteCommented:
When you installed Skype did you install the Bing with it?
It seems to come with Internet Explorer.
I have already uninstalled my Bing
I tried Skype and found I had to go to the startup programs and stop it from running at boot or when my windows startup.

look in your taskmanager and stop the background  SKYPE software running
First
Open Internet Explorer >tools>manage add ons
Click on All add ons
if you can see Bing Toolbar disable it for now
All Add onsThen open internet options
On the home page take out what is there and actually type in what I have
about:Tabs
Press ok and apply  don't click on use default or current
just  ok and apply close Internet explorer and reopen check if it's still using the about tabs
I tried to remove any home pages and use blank but this new IE10 wouldn't let me use blank but this works and you get the page you see in the background, it's nice and clean and helps IE to load quicker.
About tabsMake Google your default search engine that will replace Bing as well
install the toolbar if necessary as your new search engine
http://www.google.com/toolbar/ie/index.html
click on the wrench check the settings and remove Bing
click on wrenchUninstall the Bing
close all browsers
 go to control panel uninstall a program >Bing bar
while you are there look down through the list of installed programs and remove any you don't want.
it should be removed now.
FYI
Bing Rewards Client Installer from Microsoft Corporation
How do I remove Bing Rewards Client Installer?
Quickly and completely remove Bing Rewards Client Installer from your computer by downloading "Should I Remove It?", its 100% FREE and installs in seconds (click the button below).
Or, you can uninstall Bing Rewards Client Installer from your computer by using the Add/Remove Program feature in the Window's Control Panel.
http://www.shouldiremoveit.com/Bing-Rewards-Client-Installer-6945-program.aspx
0
 
kbachlerAuthor Commented:
@SSharma - No, the redirect is only in the registry, it is not in the shortcut.
0
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

 
kbachlerAuthor Commented:
Bing Bar is not installed.

Redirect occurs no matter what is in homepage - including about:blank.

Google is the default search engine already.

The redirect appears to be ONLY in the registry, and apparently can't be removed permanently.

Bing Rewards Client Installer is not listed as an installed program.

I'll try the uninstaller you mentioned.
0
 
kbachlerAuthor Commented:
The uninstaller also did not find Bing Rewards Client Installer.

With Skype uninstalled, I tried deleting the Registry entries - they still returned shortly after deleting them.

No joy.
0
 
Sudeep SharmaTechnical DesignerCommented:
Should be malware then?

I would recommend to scan the system with the tools mentioned below and in the sequence they are mentioned and post the logs

Make sure you DO NOT REBOOT the system after running tools in point 1 & 2.

1. RogueKiller/TheKiller
2. MalwareBytes
3. TDSSKIller

I would also recommend you to go through the articles from Younghv and RPG for the links of the tools and for the future reference

Basic Malware Troubleshooting
http://www.experts-exchange.com/A_1940.html

Rogue-Killer-What-a-great-name
http://www.experts-exchange.com/A_4922.html

Stop-the-Bleeding-First-Aid-for-Malware
http://www.experts-exchange.com/A_5124.html

Run MalwareBytes in Quick Mode and if that required reboot, then reboot the system and run tools mentioned in point 1 and 2 but this time run MalwareBytes in Full Systen Scan.

So in your next reply post the RogueKiller logs, MBAM logs and TDSSKIller Logs

Sudeep
0
 
MereteCommented:
According to Skype and Microsoft none of them could resolve this.
One user found a solution by running Combo fix
How to use ComboFix
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

How Do I Avoid Signing Up for Bing Rewards? microsoft site solution is to use Combo Fix
http://answers.microsoft.com/en-us/ie/forum/ie10-windows_7/how-do-i-avoid-signing-up-for-bing-rewards/3299fc95-225e-475a-8afd-0b3dc4ee8d77?page=1

Go to start>run>type in msconfig   press enter
select selective start-up
selective start-upuntick Bing or similar name.
Untick Skype
startup group
Is this your question as well?
Bing Rewards forced homepage - Skype Malware?
The Bing Rewards offering comes together with the Bing toolbar installation. It should only be shown once the first time you start Internet Explorer after having installed / updated your Bing toolbar.
http://community.skype.com/t5/Windows-desktop-client/Bing-Rewards-forced-homepage-Skype-Malware/m-p/1931487

Have you tried the system restore once Skype was uninstalled as well?
0
 
kbachlerAuthor Commented:
I was the user who tired Combofix.  The problem returned once Skype was used again.  Skype is not currently on the system, Bing Bar was never installed.  I'm going to try all the malware attempts with Skype off the system, and then see if reinstalling a clean Skype avoids the problem.
0
 
MereteCommented:
Sounds good idea kbachler
Check your task manager that no services a still running.
Also when you run Skype setup please look closely of any offers don't tick those
The Bing Bar is installed automatically when you install Skype 5.8 for Windows desktop. However, if you do not wish to install the toolbar, simply un-check the box and click Continue.
If the original Skype installed is the cause try the default one
How to download Skype and install
http://www.tech-faq.com/how-to-setup-skype.html
http://digitalunite.com/guides/email-skype/skype/how-download-skype
Bing
0
 
kbachlerAuthor Commented:
Skype has been uninstalled for awhile, no joy.  I have some family functions today and hope to get to this tomorrow in terms of trying various malware elimators.
0
 
jcimarronCommented:
kbachler--

Perhaps someone else has suggested this, so forgive me.  Run AutoRuns and see what programs load at Start up.  This may help you find the bad actor.
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
0
 
kbachlerAuthor Commented:
Thank you all for your help.  For now, the issue appears to be resolved.  Steps included:

1. Uninstalling all anti-virus and anti-malware software.
2. Running in order a. RogueKiller/TheKiller, b. MalwareBytes c. TDSSKIller
3. Deleting the registry entries for First Home Page manually

It is POSSIBLE that anti-malware protection was preventing the changes to the registry.

I'll follow-up if anything returns.
0
 
kbachlerAuthor Commented:
The addition of "3. Deleting the registry entries for First Home Page manually"
0
 
KK HAHDCommented:
These companies advertise mostly their own or third-party products like when installing adobe flash player it advertises for an antivirus like:

Adobe flash player advertisments
Same like this Microsoft is advertising his own products using this advertising method. So you need to uninstall SKYPE and re-download full setup without these extra advertisements:

Here you can download Skype Latest Official Full Setup File without any advertisement.

Hope it helped you!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

How do you know if your security is working?

Protecting your business doesn’t have to mean sifting through endless alerts and notifications. With WatchGuard Total Security Suite, you can feel confident that your business is secure, meaning you can get back to the things that have been sitting on your to-do list.

  • 7
  • 3
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now