?

Log in

No account? Create an account

September 2018

S M T W T F S
      1
2345678
9101112131415
16171819202122
23242526272829
30      

Tags

Powered by LiveJournal.com

EasyBits GO, Skype, and The Crapware Problem

EasyBitsGoDialog.jpgThis morning at 9:59 AM local time, a dialog from an unknown app popped up and asked me if it could install Adobe's Flash player. My reaction is the one everyone should have in response to things like this: Don't click. Stop and think. I've been around for awhile and I'm not stupid. I'd never heard of EasyBits Go and certainly hadn't installed it on my system. I brought up Windows Task Manager, and sure as hell, there was a process running called easybitsgo.exe. Worse, there was an icon on my desktop that hadn't been there a few minutes before. And the dialog had a blatant misspelling on it. "Do you wan to install it now?"

Talk about red flags!

EasyBitsRegistryKeys.jpgI immediately did a search for EasyBitsGo.exe on my system, and found the executable at Documents and Settings/All Users/Application Data/Easybits GO/ There are several subfolders as well. There was an app listed in the Add or Remove Programs applet. There was a folder (dated a few minutes later) called "go" in my user tree under Application Data. It contains some kind of a log. Last and worst of all, there were Registry keys in the HKEY_CURRENT_USER subtree under Software/EasyBits.

Only after gathering that data (and taking a quick look on Google, which showed almost nothing) did I begin removing it. Online postings just a few minutes old verified my suspicion: It had ridden in on Skype. I was using Skype at 10 AM when the dialog popped up. I did not have a browser open, and in fact was not doing anything unusual. (I was editing an Odd Lots entry for Contra.)

EasyBits is a real company, and they created and have been running Skype Game Channel for some years now. I'm not a gamer and hadn't run across them before, but they have some history, and don't appear to be malware vendors. (This does not mean that malware could not impersonate them.) Nonetheless, however they had pulled it off, what they'd done was utterly unacceptable: They'd installed a whole app with no obvious connection to Skype without any warning, much less any request for permission.

Too, too much. I may be done with Skype. Still thinking about that. In the meantime, if this happened to you as well, here's how to fix it, at least under XP:

  1. In Skype, select menu option Tools | Options | Advanced, and un-check Automatically Start Extras. Click Save.
  2. Shut down Skype.
  3. Bring up Task Manager. If the EasyBits GO dialog is still visible, EasyBitsGO.exe is probably running. Kill it. The box will vanish. (Kill the process even if you've already closed the dialog.)
  4. Make sure the SkypePM.exe process is not running. If it is, kill it.
  5. Go to the Add or Remove Programs applet and uninstall EasyBits GO. It uninstalls almost instantly, which suggests that nothing is actually being uninstalled. This was the case as best I could tell.
  6. Find the folder tree at Documents and Settings/All Users/Application Data/Easybits GO/ and delete it.
  7. Go to the Application Data folder tree under the user that was active when the damned thing installed, and find the go folder. (It contains some kind of log file.) Delete it.
  8. Go to the Windows/Prefetch directory and look for the file EASYBITSGO.EXE-364DAFD6.pf and delete it.
  9. Search for and delete all instances of ezPMUtils.dll. They may be in different locations depending on your version of Windows.
  10. If you're comfortable editing the Registry, get rid of the keys at Software/EasyBits as shown in the screenshot above.
  11. Reboot. Theoretically that should do it, but if Skype could push this thing down to countless users without their knowledge once, it could do so again.
  12. After rebooting, I think it might make sense to update your virus scanner signature database and do a full scan on your system.

So whatthehell is going on here? There's still not a great deal online, but I'm seeing more and more angry people posting every hour. I have a guess: EasyBits paid Skype for the install. This is the crapware business model, in which a company pays a hardware or (less often) software vendor to install stuff that the customer did not ask for, and pays by the install. This is typically trial version software, and the crapware vendor benefits when customers cluelessly upgrade to paid versions.

The crapware business model is why I no longer buy retail PCs, which come so clogged with crapware that they can barely move. I buy either custom-built machines or used corporate machines like the SX280 USFF, which were never retail machines to begin with and came with no crapware at all.

Cheap or free stuff is often less cheap or less free than its vendors imply. Crapware is one reason retail PCs are as cheap as they are. Dell, HP, and the others take a certain profit on each retail PC selling crapware slots. Absent the crapware, the machine would cost more. I buy new custom locally or used on eBay, and the machines are as cheap as new retail PCs and work a lot better. (Why does a four-year-old P4 2.6 GHz corporate box go so much faster than a current Core 2 Quad 3 GHz retail PC? Crapware.)

This is a guess, but it makes sense. Why else but money would Skype do something so absolutely certain to get them crucified in the blogosphere? With my tinfoil hat on I could imagine that certain parties at Skype aren't happy with being assimilated by the Borg and are getting some parting shots in. It's too late to foul the deal, but anything that makes Ballmer itch in bad places might be worth it to them.

Finally, if this happened to you, let me know in the comments or by email. It seems like a lot of people got hit with this, at least those running current versions of Skype. What if the entire installed base of current Skype instances pushed EasyBits Go down the pipe and onto user desktops? That would be a freaky thing indeed, and will make them a Mordor horde of enemies. Stay tuned.

UPDATE: This thing may only install on XP SP3 and later. I cranked up an XP SP2 machine with Skype 5 installed, and so far it hasn't seen the EasyBits install.
Tags:

Comments

Page 1 of 3
<<[1] [2] [3] >>

(Anonymous)

730pm est and still no answer

A couple of forums on Skype's English website have a forum moderator saying that Skype has been informed. We'll see what that means. Either their dragging their feet in admitting wrong, or they don't know what's going on - from a security hole in their software, to them being a scapegoat. What I know is this. On two of my family's computers, we were using Skype and had this problem. On the other that wasn't using Skype, it seems fine.

(Anonymous)

Thanks !!

Thanks for this guide, Jeff !! I'm thinking about banning Skype from my machine..

(Anonymous)

Yep. It happened to me. What's worrying is that I left my computer for a while, and when I came back my browser refused to open, as the Window Station was being shut down (eh?) When I restarted I found easygames installed with NO CONSENT AT ALL. That made me very annoyed. On the Skype forums, a moderator has claimed it to be malware. I am proceeding with caution, and considering whether to keep Skype, as new information (hopefully actually FROM Skype) emerges.

(Anonymous)

hate these things

Thanks for the write up. It found its way onto my system today and now, hopefully, it is gone.

(Anonymous)

Thanks!

This just popped up on my system with a confirmation box, and when i closed it out with the X in the corner, EasyBitsGO proceeded to load itself anyway. Definitely glad I didn't have to do all the searching myself on where this had installed itself.

Thanks a lot! :)

(Anonymous)

crap

I got this software installed automatically and there is no consent. ridiculous.

Is there any virus injected by the way?

(Anonymous)

The same thing happened to me. I followed your guide, but when I tried to delete the Easybits GO file from the Application Data folder, it came up with an error message that said, "Cannot delete ezGameXN.dll: Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use." Any ideas? I don't have Skype open (logged off).
I'm hoping to hear from Skype about this soon as well.
Make sure that neither Skype.exe nor SkypePM.exe are running. Bring up Task Manager from the context menu when you right-click the task bar. Look in the Processes pane for those two processes. If either are active, highlight them and click End Process to kill them. They use those files, and if either or both of those two processes are active, you won't be able to delete that directory tree.

Hope this helps!

(Anonymous)

Thanks!

Glad I found your site. This just happened to me a few minutes ago and I'm extremely annoyed.

(Anonymous)

Got the easybytes just now

I just go the crap installed in my machine.

If this is Ballmer's plan to recoup the 8b$ he payed for skype, he is very wrong.

If this is skype's doing, Microsoft bought a turd...

Currently looking for alternatives to skype

(Anonymous)

Huge security and maintenance headache! Shame on Skype!

Huge security problem! Huge maintenance headache for lots of people like me! My mom is a senior. She and many of her friends use Skype to talk to their kids and grand kids. She called me today asking what she should do about this unexpected message popping up on her computer. She has no idea what she did to cause it. She's afraid to respond to it, because she doesn't know what it will do to her system. What's more, the games that EasyBits Go runs are explicitly labeled "Not Skype Certified" when running them directly from Skype.

How could Skype "give the keys" to the machines of all its users to a 3rd party company? And how could Skype allow their app to be used as a giant spamming engine to its entire user base?

(Anonymous)

Horrible Business Model

Thanks for the removal steps Jeff. For those who are a Vista/W7 user, check the following for the program: C:\ProgramData\Easybits GO
This thing also added it's self to the Installed Programs.

I've been using Skype for several years, but I cannot trust a company or use their products if they are going to silently install programs WITHOUT permission. This is a horrible business model.

(Anonymous)

This might be the last straw

I'm really annoyed about this, for many of the reasons you outline. Thank you for your blog - I don't feel alone in my frustration anymore. I tried to "contact" Skype but their website is some kind of maze that redirects to FAQs and never lets you actually contact them. My first real beef with Skype is that they've reached into my pocket and taken my money a few times in the form of Skype Out credit "expiring", which they then make you top up at fixed increments higher than my needs, which leads to more credit expiring/more money lost to Skype. This is shady as hell and I can't understand how it's legal.

(Anonymous)

Thanks and more info

Thanks for the info you posted. Getting rid of these sneaky programs is like ridding my yard of mole crickets.

Also, while snooping around for any remnants, I found another ezlog file under the AppData\skypePM folder.

(Anonymous)

Complete crap...

But I'm glad there are vigilantes like you on the net.

My system also was affected by this and I will be keeping a close eye. I'm unsure where else to be looking, considering this was the first google search that popped up. I run Vista Home Prem SP2 and whatever the latest Skype is. It appeared uninstall via Add/remove Prog tool, however it was silent (No windows) while doing so. I was unable to find any of the files/.dll's/.exe's that you listed so lets hope its gone. And lets hope Skype owns up to it, I don't need ANOTHER compromised information leak. (I was apart of the Sony PSN issue as well.)

Why is the world going to hell in a hand basket at such a damn quick pace?!?

XP SP2

I'm french sorry for my bad english.
Just for info : I both have Skype 5.3.0.111 and Windows XP SP2 32 bits and EasyBitsGo has been installed.

Thanks for tutorial on how to remove it.

(Anonymous)

Re: Easy Come - Not So Easy Go

Thanks for your info on what this is and the tutorial on how to try and get rid of it.
Running a business in three different time zones I use Sykpe extensively and have been very happy with it until now.
I'm appalled and angry at this unsolicited invasion into my computer and having to take the time out to deal with.
I wonder how Skype would respond if I charged them for 45min of my time to research and rectify the installation.
Maybe a class action is in order?
Shame on you Mr SKYPE!!!
Page 1 of 3
<<[1] [2] [3] >>