Charming Tab virus: how to remove charming-tab.com redirect to Bing

The browser extension called Charming Tab doesn’t live up to its name because it causes annoying redirects to charming-tab.com and from there to Bing.

1. What is Charming Tab?
2. Automated removal of the Charming Tab virus
3. Restore web browser settings to their original defaults

What is Charming Tab?

Most people don’t mind diluting their web surfing mundanity with something bright and aesthetically pleasing. One of the easiest ways to do it is by adding an extension to one’s preferred browser that will do the magic and give the standard features a facelift. For instance, making the new tab page look prettier is a good place to start. The Charming Tab extension claims to replace the default appearance of the new tab with awesome switchable backgrounds. Sounds good, and the add-on actually does what it says, but with a caveat. It may take over the user’s custom Internet navigation settings and thereby drive web traffic to charming-tab.com without clear consent. From there, every search request is forwarded to Bing no matter what lookup service the person prefers.

What makes matters worse is that every attempt to run a web search via the URL bar will still be returning charming-tab.com instead of the correct provider specified in the browser’s settings. A similar misconfiguration goes for the homepage, which will be no longer aligned with the web pages of the user’s choice. In other words, the effects of this extension being embedded in a browser go beyond setting an eye-catching tab page background. It additionally hijacks the search engine and homepage defaults without asking for the user’s blessing. This hallmark makes Charming Tab’s activity reminiscent of adware impact that makes itself felt in an unapproved fashion.

Despite the appealing look and feel of the new tab design, the extension isn’t safe to keep on a PC for one more strong reason. Besides turning web surfing preferences upside down, it poses an extra risk by monitoring the victim’s online habits. This unethical activity spans the harvesting of the Internet navigation history, bookmarked sites, search queries, and sign-in credentials. Charming Tab also collects unique system information, including the OS version, Internet Service Provider (ISP), and hardware configuration. With the totality of this data at its operators’ disposal, they can literally chase the user with numerous targeted ads appearing on the visited web pages. This is a privacy concern which, once again, contradicts proper software deployment practices.

The Charming Tab virus doesn’t always end up on a computer as a result of the user’s informed decision. One more vector of its distribution involves bundling, whereby people aren’t clued up on the presence of this add-on in a nifty-looking installer package. The pest often accompanies other extensions purporting to deliver features that are much in demand. Here is a list of browser helper apps that may reportedly come riddled with the Charming Tab hijacker:

• Color Picker;
• Favicon Changer;
• Floating video;
• Video Speed Controller;
• Image Downloader Plus;
• Dark Theme Suite.

There are undoubtedly more extensions whose authors play dirty by bundling their products with the PUA (potentially unwanted application) under scrutiny. What they all have in common is that the services they provide are trending, which expands the potential audiences and the attack surface. It’s worth emphasizing that cybercrooks may abuse legitimate extensions by injecting the Charming Tab payload behind the developers’ backs.

When an arbitrary browser add-on is no longer needed or is causing problems, the commonplace response is to disable it in the corresponding settings screen. This tactic may not be effective with Charming Tab, though. Both the deactivation toggle and the removal option are sometimes grayed out, which means they aren’t clickable. In Google Chrome, for example, the PUA is known to add a rogue enterprise policy that overrides the victim’s preferences and disallows attempts to delete the extension. Furthermore, the culprit creates a number of registry keys to maintain persistence. Under the circumstances, those infected need to think outside the box to address this issue. The following steps will shed light on the Charming Tab removal process.

Automated removal of the Charming Tab virus

When dealing with the Charming Tab threat, you can get a lot of mileage out of the Malwarebytes automatic security tool that will pinpoint and iron out the infection in minutes. Malwarebytes is one of the big names in the anti-malware industry with an immaculate track record of protecting systems against all prevalent forms of harmful code.

The solution uses artificial intelligence (AI) and machine learning to detect both known and zero-day threats, including potentially unwanted programs (PUPs), ransomware, exploits, and malicious sites. It boasts low system footprint, high scanning speed, and intuitive interface where every module clearly explains what it does. Follow the steps below to come through the malware predicament unscathed:

1. Download and install the latest version of Malwarebytes onto your PC.

^{As part of this step, you will be prompted to specify where you are installing the program (personal or work computer) and toggle the advanced setup options if you so desire. You can use all the premium features for 14 days free of charge.}

Download charming-tab.com remover

2. Once the application is up and running, go ahead and click on the Scan button in the bottom middle part of the GUI.

3. Wait until Malwarebytes checks for updates of its proprietary Katana detection engine and scans the memory, startup items, registry, and file system for threats.

4. When the scan is completed, go over the report listing the infections that have been identified. Make sure there are checkmarks next to all the unwanted items and click on the Quarantine button as shown below.

5. You will be prompted to restart your computer to finish the removal process. Click Yes to do it immediately or close the dialog and restart later on.

6. As soon as the threats have been moved to Quarantine, they can no longer harm your computer. If you are sure that you won’t need to restore any of those items at a later point, click on the Detection History pane at the bottom left of the Malwarebytes home screen, select the Quarantined items tab, and click Delete.

Use Control Panel to get rid of the Charming Tab PUA

• Open up the Control Panel from your Start menu in Windows. Depending on the OS build, select Uninstall a program (Windows 10, 7 and Vista) or Add or Remove Programs (Windows 8)

• To facilitate the process of locating the threat, sort the programs list by date to get the latest ones displayed at the very top. Find an unfamiliar, suspicious entry under the Name column, click Uninstall and follow further directions to get the removal done

Restore web browser settings to their original defaults

In the circumstances of a complex browser hijack like this, executing a reset makes the most sense despite a few obvious downsides. Customizations such as saved passwords, bookmarked pages etc. will be gone, but so will all the changes made by the potentially unwanted program. The instructions below address the workflow for the web browsers most targeted by the charming-tab.com redirect virus.

Reset Google Chrome

• Open Chrome, expand the Customize and control Google Chrome menu and choose Settings

• Scroll down the settings screen and click Advanced down at the bottom

• Move on to the Reset and clean up sub-section and select the option that says Restore settings to their original defaults

• Finally, confirm the restoration by clicking Reset settings on the warning message

• Restart Chrome.

Reset Mozilla Firefox

• Open Firefox, type about:support in the URL area and press Enter. Alternatively, you can click on the Open menu icon in the top right-hand part of the browser window, then select the Help option and proceed to Troubleshooting Information

• On the Troubleshooting Information screen, spot the Refresh Firefox button and click on it

• Follow subsequent directions to reset Firefox to its original settings

• Restart the browser.

Reset Internet Explorer

• Select Internet options under IE’s Tools (Alt+X)

• Proceed by clicking on Advanced tab, then select Reset

• To confirm the intended changes, click Reset on the Reset Internet Explorer Settings screen after ascertaining that the Delete personal settings checkbox is enabled

• Reboot the machine to fully implement the fix.

Reset Safari

• Go to the Safari menu and select Preferences

• When on the Preferences screen, select the Privacy tab and hit the Remove All Website Data button if you are up to erasing all website data stored on your Mac. Otherwise, you can use a site-specific removal option described below

• A dialog will appear, asking you to validate your choice. Click the Remove Now button if you are sure. Be advised this will log you out of online services and undo personalized web browser settings such as saved passwords, etc.

• Safari also allows deleting data for specific sites rather than all sites in general. To use this option, click the Details button under Privacy tab

• Select the websites for which you would like to erase data and click the Remove button

• Click the Done button to confirm and exit. You can also select the Remove All option to remove all data stored by the listed websites.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup.

Download Charming Tab virus removal tool