Skype virus: what it is and how to remove it
Skype virus is a group of malicious programs and phishing scams that have been targeting users of this widely-spread application. One of the first cyber threats was Skype worm w32/Ramex.A which was detected in 2007.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A scan of the PC is a quick way to confirm that nothing installed is behind the baidu.com redirects.
Do it yourself · free Remove Skype virus yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Skype virus: summary
| Name | Skype virus |
|---|---|
| Type | Malware, adware, scam |
| Main problem caused by malware | Sends various messages and goo.gl links to all contacts automatically, without user's knowledge |
| Other issues reported by users | Interrupts its victims with annoying ads, redirects to sponsored websites, fake survey ads |
| Dangers | Redirects to infected websites, the loss of personal information, infiltration of malware, system crashes because of bitcoin mining |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Distribution | Not recorded in the old report |
|---|---|
| Damage | Not recorded in the old report |
| Symptoms | Redirects to an unknown domain |
| Evidence | 8 write-ups by security sites; details still limited |
| Domains | baidu.com |
| Ads shown as | Redirects through ad pages |
| Browsers | Chrome, Edge and Firefox |
| First seen | 7 May 2018 |
| Facts checked | 6 October 2026 |
Is Skype virus dangerous?
From our report of May 2018 · not reviewed since
Skype virus - an irritating issue related to this widely-used communication tool
Skype virus is a group of malicious programs and phishing scams that have been targeting users of this widely-spread application.
One of the first cyber threats was Skype worm w32/Ramex.A which was detected in 2007. However, it seems that the term "Skype virus 2018" will continue appearing in users' searches. The latest its versions are reported as Baidu virus and goo.gl virus.
Previously, Skype network was involved into distribution of Bitcoin-mining malware. Because of that, sometimes it is referred to as the Bitcoin virus.
This infection is used to exploit computers' resources to generate virtual currency. As a result, the affected machine becomes slow and practically unusable. However, bitcoin mining is not the primary goal of the malware.
The most popular versions of Skype malware have been designed to steal users' personal information, sensitive computer data or to distribute malicious content by sending messages telling "Hey, check this video" or "this is a very nice photo of you" that are followed by a malicious link.
For instance, the Koobface virus, which has been spreading messages featuring links to "shocking" or "hilarious" videos with the user's name (or username) attached. Links that are usually added to such messages are used to download and install the Koobface worm on the computer.
Up until now, hackers have presented several methods used to hack users' accounts . Besides, hackers have also started connecting the affected computers to botnets which are used to spread a massive amount of spam or initiate other malicious activities. For this reason, sometimes it is difficult to attribute any specific characteristics to Skype spam virus.
If you have problems with logging in to your Skype account or receive reports from your contacts that they received some shady link from you, you might suspect that your account was compromised. You should run a full system scan with or similar anti-malware software to remove Skype virus.
From our report of May 2018 · not reviewed since
The virus might send a "very nice photo of you"
One of the versions of Skype virus is known for spreading spam message saying "this is a very nice photo of you" which is followed by a link.
Once clicked, particular malware is dropped on the system. This malware was very active in 2013. Back then it mostly aimed at users from Latin America. However, they received a fake message in Spanish language "esta es una foto muy amable de tu parte."
However, several users from other countries reported about getting the same message in their native language. Therefore, language barrier does not prevent the virus from spreading around the globe.
From our report of May 2018 · not reviewed since
More from our earlier report on Skype virus
- Remove shared.xml file, change your Skype password, run a full system scan with .
How Skype virus got into your browser
From our report of May 2018 · not reviewed since
Hacked Skype accounts spread links to Baidu, LinkedIn, and other fake sites
In 2016, numerous Skype accounts were hacked and spread links to Baidu.com, LinkedIn.com, and other popular websites.
One of the most active Skype virus spam campaigns uses infected user's account to distribute a malicious Baidu.com link which redirects to the shady Forbes rip-off site Coolinfovip(dot)com .
You should be aware of links directing to shady Baidu link. At the end of the link, the name of a Skype contact recipient is appended. If you click on this link, your device might be infected with a severe virus, and all your contacts will receive the link automatically.
According to the latest news, Baidu virus uses multiple fake domains to display the fake Forbes website. Apart from the previously mentioned Coolinfovip, the virus can also redirect to 2016forbesnews-f.net.
This link is automatically sent to all users on the infected account owner's contact lists. The cycle is likely to repeat itself when the link is clicked on some other computer. That's why you should never leave this virus on your machine and remove Skype virus as soon as possible.
Additionally, Skype malware was noticed spreading malicious Google links which are typically shortened. Therefore, you should not click aun unknown link that starts with http://goo.gl/. Simarly, users reported about fake bit.ly links spam.
From our report of May 2018 · not reviewed since
Skype malware spread as a fake Adobe Flash Player update
In April 2017, Skype users were hit by malvertising campaign that urged to download fake Adobe Flash Player update.
People received this alert every time they logged into their accounts. Thus, there's no surprise that many users were ticked.
As soon as they logged into their accounts, they received a "File Download – Security Warning" window asking to enable FlashPlayer.hta file. The source code of a html application file contained parts of a disguised JavaScript code. It was programmed to run PowerShell and download a further payload.
Virus researchers have been able to identify the three web pages that were spreading fake Flash Player update:
Additionally, the three email addresses have been associated with dozens of malicious new registered websites:
Interestingly, that the former two domains have been already spotted for malicious activity by virus researchers. It suggests that this malvertising campaign is not the wrongdoings of an ordinary wannabe hacker. In fact, used .hta file, hidden JavaScript code, and the very fact that Flash player is employed sparks speculations that Cerber ransomware hackers might be behind this latest malvertising technique.
- oyomakaomojiya(.)org,
- admdownload.adobe.com,
- cievubeataporn(.)ne.
- jonathandpreston@wants.dicksinhisan.us
- edwardslawler@dicksinmyan.us,
- justincabel@airmail.cc.
Check your browser and PC
- Address:
baidu.com
How to remove Skype virus
How to remove the Skype virus extension
Do the browser steps in every browser and profile on the PC, then check Windows for the program that installed the extension.
Step 1: Remove extensions you did not add
Skype virus often works through an extension, so go through the extension list of each browser:
chrome://extensionsedge://extensions- Extensions and themes in Firefox
Switch suspicious extensions off one at a time and reload the page where the problem shows, then remove the one that stops it, and any other you did not add.
Remember the other browsers and profiles on the PC. If Remove is missing or greyed out, a policy forces the extension, which the policy step deals with. Windows 11 and Windows 10 show the same pages.
Chrome on Windows 11: More > Extensions > Manage extensions. Full procedure with screenshots: Remove a browser extension
Step 2: Uninstall programs you did not mean to install
Open Settings > Apps > Installed apps in Windows 11, or Settings > Apps > Apps & features in Windows 10, and sort the list by install date. Look at what appeared around the day the problem started and uninstall every program you do not recognise or did not choose.
Free converters, PDF and video tools, "system optimizers" and unknown browsers are the usual carriers of Skype virus. If a name is unclear, search for it before you remove it, so you do not uninstall a driver or a Windows component.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 3: Reset the browser
Finish the browser part with a reset, which puts the search engine, start page, new tab page and site permissions back to their defaults and switches extensions off. Chrome: Settings > Reset settings > Restore settings to their original defaults.
Edge: Settings > Reset settings. Firefox: Help > More troubleshooting information > Refresh Firefox, which also removes its extensions. Your bookmarks and saved passwords are kept, and the menus are the same on Windows 11 and Windows 10.
Chrome on Windows 11: Settings > Reset settings. Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
From our report of May 2018 · not reviewed since
Tips to recognize and avoid scam attacks
As you can already understand, Skype virus has many different shapes and forms.
However, it's still possible to recognize phishing attempts. All you have to do is to be attentive, careful and critical. All these features will stop you from spontaneous clicks or downloads.
- Ignore all the silly messages from your friends, like "lol is this your new profile pic?", "This is a very nice photo of you" and similar. Most importantly, do NOT click on the links that are incorporated to such messages or arrive on their own.
- Do not download funnypicture.jpg.exe, FlashPlayer.hta or other suspicious files that might be presented as Skype components or content received from your friend.
- Ask your contacts for confirmation if they have actually sent link or file to you.
- Install Skype and other updates. It helps to decrease the risk that cyber criminals will use security vulnerabilities to compromise your account.
- Set strong Skype password.
- Windows OS users should combine Skype account with Microsoft account if they haven't done it already. According to the computer, this makes your account more secure and recovery of the account easier.
- Set up two-step verification on your Microsoft account once you connect it with Skype account.
From our report of May 2018 · not reviewed since
Remove Skype virus automatically and secure your account
If you can't connect to your Skype account normally, you can be infected with Skype virus.
As you must have already understood, it is a seriously dangerous program/issue that can lead you to the loss of your private information. Besides, it can make your computer useless by misusing its resources.
For Skype virus removal, you need to install reliable anti-spyware from professional developers. We highly recommend or . Cracked or pirated programs may not only be useless but also cause system instabilities, making your computer more vulnerable and prone to malware infections.
However, to remove Skype virus without leaving its leftovers, follow the guidelines below:
From our report of May 2018 · not reviewed since
Windows OS
- Quit Skype app;
- Click Start, type in run and press Enter;
- Type in %appdata%skype, click OK;
- Find this file and delete it: shared.xml;
- Restart Skype app.
From our report of May 2018 · not reviewed since
Mac OS X
Once you clean up your PC, you have to change your Skype password:
However, if you do not see the Skype name in Change sign-in preferences, you have to follow these steps:
For that, use these steps:
[GI=method-2]To avoid system block caused by Skype virus, you can use System Restore method. Steps that you need to follow are given below:
- Quit Skype;
- When in Finder, locate the following folder: ~/Library/Application Support/Skype;
- Delete this file: shared.xml;
- Restart Skype.
- Go to https://account.microsoft.com and log in using your Microsoft account details.
- Navigate to Security and Privacy.
- Under Account Security option click on More security settings.
- Under Sign-in preferences, you have to choose Change sign-in preferences.
- When in Change sign-in preferences uncheck Skype name and press Save.
- Go to www.skype.com and log in with your Skype username.
- Click on Settings and preferences / Change password.
- Set a new password.
Questions about Skype virus
baidu.com opens when I click links. What causes it?
When every click leads to baidu.com first, an extension or a script on the page is rewriting the links. If it happens only on one site, that site uses aggressive ads; close it and use another source. If it happens everywhere, open the browser in a private window, where extensions are normally off, and try again.
No redirect in the private window means one of your extensions is responsible: remove the ones you do not know. A redirect in the private window too means the cause is outside the extensions, such as a notification permission, a changed search setting or a program installed on the PC. The removal steps in this guide cover each of those.
Should I worry about redirects to baidu.com?
Worry less about baidu.com itself and more about what keeps sending you there. A single redirect from a free streaming or download site is normal and harmless once the tab is closed.
Repeated redirects on sites that used to work fine mean something in the browser or in Windows changed, often an extension or program installed alongside other software. It may also collect the pages you visit. Remove the cause with the steps in this guide, and do not act on anything the redirected pages ask:
- no Allow clicks
- no downloads
- no calls
If you already did one of those, the matching section of this guide explains what to do next.
What is Skype virus?
Skype virus is an adware extension, a kind of adware. It earns money by showing redirects through ad pages, and each view, click or redirect pays whoever runs it. It is not something people usually choose; it arrives through a free download, a fake button or a misleading prompt.
Skype virus does not encrypt files or take control of Windows, but its ads are sold to anyone, including scam operators, so they can lead to fake virus warnings and unwanted downloads. The steps in this guide remove it from Windows and from each browser.
Which browsers does Skype virus affect?
In the cases we checked, Skype virus showed up in Chrome, Edge and Firefox. That does not rule out others on your PC, since adware installers often target every browser they find, and permissions and extensions sync across computers signed in to the same browser account.
Open each browser you have, go to its extensions page and its notification settings, and remove anything you do not recognise. Profiles count separately: Chrome and Edge can each hold several, and each one needs checking on its own.
Are the pop-ups I see really from Skype virus?
Compare them with the details in the table above. Skype virus produces redirects through ad pages, and the clearest sign of it is redirects to baidu.com. Other adware looks similar, so check the name of the sending site at the bottom of a notification, the address in the tab that opened, or the newest entries on the extensions page.
If those match, this guide fits. If you see a different name, the same kind of steps apply, but remove the item you actually find rather than guessing.
Did Skype virus collect my data?
Adware typically collects what it needs to choose ads:
- the sites you visit
- search terms
- approximate location
- browser and system details
Extensions with permission to read and change data on all websites can technically see everything on those pages, including forms. That is a privacy problem rather than proof of theft.
If you typed card details or passwords while it was active, changing the most important passwords is a reasonable precaution. Clearing cookies after removal ends the tracking sessions it may have started.
I let a "support technician" from an ad connect to my PC. What should I do?
Act quickly but calmly. Disconnect the PC from the internet first, so the connection ends. Uninstall the remote access tool they asked you to install and check Installed apps for anything else added during the call.
Run a Microsoft Defender full scan and offline scan. From another device, change your e-mail and banking passwords and sign out of all sessions.
If you paid by card, bank transfer or gift card, contact your bank or the card issuer immediately, and report the scam to the police. Do not answer if they call back.
Can an adware pop-up infect my PC just by appearing?
No. A pop-up, a notification or a new tab is only a web page or a message. It cannot run programs on Windows by itself, provided the browser and Windows are up to date. Infection needs a step from you:
- running a downloaded file
- installing an extension
- giving a stranger remote access
That is why scam pages work so hard to make you click. Close such pages with the tab's X or by closing the browser, not with buttons inside the page, which may start a download.
My scan found nothing, but the ads continue. Why?
Because the source may not be a file a scanner looks for. Browser notifications are a permission stored in the browser, and many adware extensions are not flagged because they come from an official store.
Some ad-supported programs are only reported if you enable detection of potentially unwanted apps. So a clean scan does not mean the job is done. Check each browser's notification permissions and extension list by hand, and turn on Potentially unwanted app blocking in Windows Security before scanning again.
Will Fortect remove Skype virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Skype virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Bitcoin Magazine: Bitcoin-Mining Malware Spreads Through Skype (read October 6, 2026)
- The Tech Portal: Skype becomes target of spam Baidu and Linkedin links, reinforces need to secure account (read October 6, 2026)
- Skype Support: What should I do if spam messages or links are sent from my account? (read October 6, 2026)
- Google Chrome Help: Use notifications to get alerts (no longer online) (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)