?

Log in

No account? Create an account

August 2019

S M T W T F S
    123
45678910
11121314151617
18192021222324
25262728293031

Tags

Powered by LiveJournal.com

EasyBits GO, Skype, and The Crapware Problem

EasyBitsGoDialog.jpgThis morning at 9:59 AM local time, a dialog from an unknown app popped up and asked me if it could install Adobe's Flash player. My reaction is the one everyone should have in response to things like this: Don't click. Stop and think. I've been around for awhile and I'm not stupid. I'd never heard of EasyBits Go and certainly hadn't installed it on my system. I brought up Windows Task Manager, and sure as hell, there was a process running called easybitsgo.exe. Worse, there was an icon on my desktop that hadn't been there a few minutes before. And the dialog had a blatant misspelling on it. "Do you wan to install it now?"

Talk about red flags!

EasyBitsRegistryKeys.jpgI immediately did a search for EasyBitsGo.exe on my system, and found the executable at Documents and Settings/All Users/Application Data/Easybits GO/ There are several subfolders as well. There was an app listed in the Add or Remove Programs applet. There was a folder (dated a few minutes later) called "go" in my user tree under Application Data. It contains some kind of a log. Last and worst of all, there were Registry keys in the HKEY_CURRENT_USER subtree under Software/EasyBits.

Only after gathering that data (and taking a quick look on Google, which showed almost nothing) did I begin removing it. Online postings just a few minutes old verified my suspicion: It had ridden in on Skype. I was using Skype at 10 AM when the dialog popped up. I did not have a browser open, and in fact was not doing anything unusual. (I was editing an Odd Lots entry for Contra.)

EasyBits is a real company, and they created and have been running Skype Game Channel for some years now. I'm not a gamer and hadn't run across them before, but they have some history, and don't appear to be malware vendors. (This does not mean that malware could not impersonate them.) Nonetheless, however they had pulled it off, what they'd done was utterly unacceptable: They'd installed a whole app with no obvious connection to Skype without any warning, much less any request for permission.

Too, too much. I may be done with Skype. Still thinking about that. In the meantime, if this happened to you as well, here's how to fix it, at least under XP:

  1. In Skype, select menu option Tools | Options | Advanced, and un-check Automatically Start Extras. Click Save.
  2. Shut down Skype.
  3. Bring up Task Manager. If the EasyBits GO dialog is still visible, EasyBitsGO.exe is probably running. Kill it. The box will vanish. (Kill the process even if you've already closed the dialog.)
  4. Make sure the SkypePM.exe process is not running. If it is, kill it.
  5. Go to the Add or Remove Programs applet and uninstall EasyBits GO. It uninstalls almost instantly, which suggests that nothing is actually being uninstalled. This was the case as best I could tell.
  6. Find the folder tree at Documents and Settings/All Users/Application Data/Easybits GO/ and delete it.
  7. Go to the Application Data folder tree under the user that was active when the damned thing installed, and find the go folder. (It contains some kind of log file.) Delete it.
  8. Go to the Windows/Prefetch directory and look for the file EASYBITSGO.EXE-364DAFD6.pf and delete it.
  9. Search for and delete all instances of ezPMUtils.dll. They may be in different locations depending on your version of Windows.
  10. If you're comfortable editing the Registry, get rid of the keys at Software/EasyBits as shown in the screenshot above.
  11. Reboot. Theoretically that should do it, but if Skype could push this thing down to countless users without their knowledge once, it could do so again.
  12. After rebooting, I think it might make sense to update your virus scanner signature database and do a full scan on your system.

So whatthehell is going on here? There's still not a great deal online, but I'm seeing more and more angry people posting every hour. I have a guess: EasyBits paid Skype for the install. This is the crapware business model, in which a company pays a hardware or (less often) software vendor to install stuff that the customer did not ask for, and pays by the install. This is typically trial version software, and the crapware vendor benefits when customers cluelessly upgrade to paid versions.

The crapware business model is why I no longer buy retail PCs, which come so clogged with crapware that they can barely move. I buy either custom-built machines or used corporate machines like the SX280 USFF, which were never retail machines to begin with and came with no crapware at all.

Cheap or free stuff is often less cheap or less free than its vendors imply. Crapware is one reason retail PCs are as cheap as they are. Dell, HP, and the others take a certain profit on each retail PC selling crapware slots. Absent the crapware, the machine would cost more. I buy new custom locally or used on eBay, and the machines are as cheap as new retail PCs and work a lot better. (Why does a four-year-old P4 2.6 GHz corporate box go so much faster than a current Core 2 Quad 3 GHz retail PC? Crapware.)

This is a guess, but it makes sense. Why else but money would Skype do something so absolutely certain to get them crucified in the blogosphere? With my tinfoil hat on I could imagine that certain parties at Skype aren't happy with being assimilated by the Borg and are getting some parting shots in. It's too late to foul the deal, but anything that makes Ballmer itch in bad places might be worth it to them.

Finally, if this happened to you, let me know in the comments or by email. It seems like a lot of people got hit with this, at least those running current versions of Skype. What if the entire installed base of current Skype instances pushed EasyBits Go down the pipe and onto user desktops? That would be a freaky thing indeed, and will make them a Mordor horde of enemies. Stay tuned.

UPDATE: This thing may only install on XP SP3 and later. I cranked up an XP SP2 machine with Skype 5 installed, and so far it hasn't seen the EasyBits install.
Tags:

Comments

Page 2 of 3
<<[1] [2] [3] >>

(Anonymous)

Easy Bits to Go - add to step 1 of Jeff's Fix-it.

Before saving the changes under the advanced settings, go to the bottom of the page under "Other things you can do" and click on "Manage other programs", then click "remove". I haven't tested it yet, but it is possible that this will solve the problem.
Jeff, Thanks for the information.

(Anonymous)

Easy Bits Go

Hi, I was suddenly hit with a noise from my computer, and did not know what that noise was. Then a little screen which stated it was from Skype asked if I would like to download, it gave me three choices. I checked remind me later/or ask me later. Then pressed closed. Well it downloaded immediately and I saw the desktop thumbnail. I was very concerned, and went directly to Add/Remove programs, and like you said it was instantaneous. Well the desktop thumbnail was gone, but I noticed a smaller symbol on my tool bar and the very bottom to the right, where all my start menu programs are shown, (I hope you know what I'm talking about)because I'm not at all BIG on all the lingo for computer talk, oy....I suffer. Anyway I right clicked and exited it. Thought ok it's gone. But I still decided to check so I did an online search, and viola! There was the Skype forum, and mucho listings of people in the last 24 hours that got hit with this, and boy they are ALL upset. There was a link to your site by one of the complainers, so here I am. Now I tried to follow your instructions on how to get rid of this unacceptable intrusion, and there are some files that will not allow me to delete! I can not access it! What's going on? I may just undo Skype all the way if I can't get this invasion off of my computer, I've scanned the files that will not delete, and they are clear, but I angry that they have stepped way beyond my personal boundaries and did this without consent! So what can I do? ezPMUtils.dll. this file will not allow me access to delete, the Game folder will not allow me to delete. I could not delete the folder listed on the Application folder, so I had to delete individually the files that would allow me to delete. So what else can I do?
I'm not an advanced computer techie, so I need step by step guidance, I get concerned I'm going to really screw up my system. It's been working great up till now. Please Help thank you for all of your knowledge. please email me at caltchmnn@gmail.com. if you would not mind. Once I heard Microsoft had bought them out, I knew it meant problems. I'm highly suspicious of the corporates. Thanks for your time and generosity in giving us this info to help us. cheers, and have a great Sunday. Later....

(Anonymous)

Thanks a bunch...

... for the nice, comprehensive guide to removing the crap.

For what it's worth... This was installed on my wife's account, on our Vista computer. Skype on her account was not working anymore two days ago, and I 'fixed' it by installing a patch or new version (didn't pay attention) they had on their website. Today she uses Skype and lo, Easybits comes with it. Could there be a connection there? Anybody in the same case?

Well! Now that this is cleaned up, I'm going back to Linux, friends...

Easybits Go in other folder?

Hi Jeff - thanks for the great post. Just wondered if anyone else has found Easybits Go files elsewhere on their computer?

I currently have a file called 'go_recent.sol' in the following folder (the folder's name is Organizer2.swf):

C:\Users\[name]\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\THAGURLP\localhost\ProgramData\Easybits GO\HTML\Organizer2.swf

Should I delete this too? Google brings up nothing.

Gahh I hate this Easybits Go sh1ts!

(Anonymous)

thank you, jeff

I also got hit with this, and this was the only way I could find to completely get rid of it. It sucks, but I have a hard time trusting skype now -_-

Plugins directory

You might also want to check the Skype Plugins directory (driveletter:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins or %ALLUSERSAPPDATA%\Skype\Plugins\Plugins) for an id-named folder that contains the crapware as well.
I removed it as well to be sure.

(Anonymous)

Re: Plugins directory

Hi using windows 7 pro >> program files>> Skype plugings remove: >>>>ezPMUtils >>>skypePM...now all working well....
Barry

SkypePM

Furthermore, the skypePM.exe in Program Files (x86)\Skype\Plugin Manager also has a Digital Signature from EasyBits Software AS... Not sure how much we can trust that now either...

(Anonymous)

Use options when installing skype

Jeff,

thanks for your brief uninstall how-to of easybits. With that I could remove this.

I uninstalled now skype complete to make a fresh reinstall. I used customised install and deselected skype plugin manager. NO easysbits installed an also no skypepm service remains running after skype quits.
Maybe that's a convienient install routine for the most users.

Regards
Karsten

(Anonymous)

Thanks!

Thanks alot! Your article helped me remove that software.

Perfect!

Thanks so much for your crystal-clear instructions.

Sometimes I think corporations are like cats. Many people like cats. But if the cat's growth were unregulated...well...you've seen what happens to mice.

With us being more like statistics than ever because of our online activity, the corporate calculus as to how much pain to inflict vs. how much profit it will yield will become more and more scientific. Our experience with this crapware is, in that sense, a big experiment and we are the mice in the lab. Eeeek! Another mouse metaphor!

The more universally accepted a service is (e.g., Skype), the more emboldened it may be to inflict profitable "pain" on consumers.

Best Regards,

Bob

www.PsychInnovations.com

(Anonymous)

Thank you

I'm glad Vista highlighted a new program and I was able to find your post when I realized I hadn't authorized this prgoram.

I found this page from Threat Expert- http://www.threatexpert.com/report.aspx?md5=f6a970c3351815ac9d932a792f23be45 which you may find of assistance when looking for instances of the program.

This intrusion is unacceptable.



(Anonymous)

EasyBits GO

Many thanks.
Hopefully, after your very useful info, it's 'EasyBits GONE'!
Like another of the people commenting, I had clicked 'ask me later' when Skype offered the download. I did not expect to get it regardless!

(Anonymous)

Update for Windoze 7

Thanks for a great post! Indeed it is just plain outrageous that Skype installs this crapware without even a by-your-leave! NOT A HAPPY BUNNY!

For Windoze 7 (maybe Vista as well) there are few very small changes:
6) Update - Application Data = ProgramData
7) Update - Under c:/Users/skypePM you will also find EZ logs.
8) Update - You will find more junk in c:/ProgramData/SkypeExtras/MLS - Remove the GO*.mls files

Does anyone know if SKYPE has actually answered to this intrusion?

Thanks again Jeff!!

(Anonymous)

think it happened with the last update

Noticed yesterday that a new icon for EasyGo had been added to my desktop. Skype recently notified me of an update, and I remember specifically checking (or unchecking) the box that I did not want to install EasyGo.

It's frustrating that corporations basically depreciating the value of what other people own- in miniscule chunks in the hopes that you won't notice and in ways that are difficult to correct- all in the hopes that you will buy their newer, more advanced stuff sooner.

thanks for the detailed assistance in getting this off my system -Amanda B.

(Anonymous)

skype is getting on the crapware route watchout...

I am seriously annoyed this time.
Page 2 of 3
<<[1] [2] [3] >>