Coupon Server

Threat Scorecard

Ranking: 10,714
Threat Level: 20 % (Normal)
Infected Computers: 4,260
First Seen: October 7, 2013
Last Seen: September 9, 2023
OS(es) Affected: Windows

Coupon Server Image

Coupon Server is a potentially unwanted program, which was produced by 215 apps for Internet Explorer, Mozilla Firefox and Google Chrome. Coupon Serve may be usually embedded when online users install other free software products. Coupon Server may show annoying pop-up advertisements, coupons and sponsored links via a pop-up box popular shopping websites that are visited by Internet users. These pop-up advertisements may be illustrated as boxes, which incorporate a variety of coupons that are available or as underlined keywords, which when clicked may show a pop-up advertisement that declares it comes to the attacked PC user from Coupon Server. When target computer users install free software products, they may also install Coupon Server. While being installed, Coupon Server may display a box, which includes associated keyword suggestions, ads and sponsored links, in the right top part of the hijacked browser, whenever the web user will visit social networking or online shopping websites.

SpyHunter Detects & Remove Coupon Server

File System Details

Coupon Server may create the following file(s):
# File Name MD5 Detections
1. FrameworkBHO64.dll 023ff2822599f0744402b8283f90e83c 2
2. FrameworkBHO.dll bb42a18ef25de0e6b251d76bcf3fa914 2
3. FrameworkEngine.exe 8891c901021afc5ab5e8f8d4bc13a3fd 2
4. Coupon Server-updater.exe 6f12d5c5ce7afd606b13d36a5de174b4 2
5. FrameworkEngine.exe 99401fd49ff82216ac97bf0dffc74893 1
6. FrameworkBHO64.dll fa1df70f86ae658170fef101f3f5b362 1
7. FrameworkEngine.exe 9c267e119de70d461c30f3dabcf0912e 1
8. FrameworkEngine.exe 7195ea3a7cd931c925935a6dfb486d49 1
9. FrameworkEngine.exe 59fe8872a16efd996f22fb7694880996 1
10. FrameworkBHO64.dll 91f9f485d1e3ede5be0047b66a076459 1
11. FrameworkBHO64.dll 4235f42139318c55c7392b14260df213 1
12. FrameworkBHO64.dll e60c8029d474d01eb03a5eb4c636d18b 1
13. FrameworkBHO64.dll 2d3e42a80c0cc4e96593f2fd871d2341 1
14. FrameworkBHO.dll 0703727e36010d57fd1c959441232922 1
15. FrameworkEngine.exe dde0f26184230d87facde81efa3df744 1
16. FrameworkBHO64.dll cac2c18ab61fa74c83874d1e70b7f461 1
17. FrameworkBHO64.dll 53c62952d647a022c7791a73fa5eb520 1
18. FrameworkEngine.exe 736614e5d7549c13b77468fb2dc123f3 1
19. FrameworkBHO.dll 61c66f4d96129b3184c6a1f4146f685a 1
20. FrameworkBHO64.dll 3f304b3330c55457d933ad188bb1c420 1
21. FrameworkBHO64.dll 8c1ce178195715d97db93240c92a7396 1
22. FrameworkBHO64.dll e140a78ae61dbdba2768e7643979c876 1
23. FrameworkBHO64.dll a9889622bb7b2e46cea6f27d9904bb95 1
24. FrameworkBHO64.dll 1bc95beb9fc0ab24231433d2ae5ed46a 1
25. Coupon Server-bho64.dll 0cde50d8da900acbdb800259e1e0ea44 1
26. FrameworkBHO.dll e3801421278954dadde8101a1253e5d2 1
More files

Registry Details

Coupon Server may create the following registry entry or registry entries:
Software\AppDataLow\Software\Coupon Server
SOFTWARE\Coupon Server
Software\Microsoft\Internet Explorer\Approved Extensions\{11111111-1111-1111-1111-110311581152}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater35852.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110311581152}
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Coupon Server-repairJob
Software\Proxy\installations\Coupon Server
SOFTWARE\Wow6432Node\35852
SOFTWARE\Wow6432Node\Coupon Server
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110311581152}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Coupon Server-repairJob
SOFTWARE\Wow6432Node\Proxy\Installations\Coupon Server

Directories

Coupon Server may create the following directory or directories:

%APPDATA%\Coupon Server
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Coupon Server
%LOCALAPPDATA%\Coupon Server
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\dclojinfbfgccgbdkekjcfjbfakimkdj
%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_dclojinfbfgccgbdkekjcfjbfakimkdj_0
%PROGRAMFILES%\Coupon Server
%PROGRAMFILES(x86)%\Coupon Server

URLs

Coupon Server may call the following URLs:

coupon-server.com

Trending

Most Viewed

Loading...