CoupCoup Ads

Posted: July 13, 2015

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	99

First Seen:	June 26, 2015
OS(es) Affected:	Windows

CoupCoup is an extension for your Web browser that may display advertising content, in theory as a way of offering Web shopping coupons. Despite these seemingly good intentions, malware researchers have seen instances of CoupCoup delivering potentially compromised advertisements, as well as practices distribution and installation strategies that could make its presence unwanted. Most PC users should consider removing CoupCoup with anti-adware products as required for ensuring their browser's optimal performance.

How CoupCoup Coups Your Browser

CoupCoup is a browser extension that malware researchers have seen predominantly installing itself to Chrome, although CoupCoup also has expressed some limited compatibility with Internet Explorer. As implied by its brand name, CoupCoup is designed as an advertisement-delivering extension, which CoupCoup accomplishes by injecting its advertisements automatically into your Web pages while they're loaded. Most advertisements delivered by CoupCoup extensions may include graphical or text tags indicative of their origins, which allows PC users to note CoupCoup's entrance via its heavily visible symptoms.

Simultaneously with its injected advertisements, CoupCoup also may hijack your browser and redirect it to unwanted, third-party offers or generate new tabs for these offers. Malware researchers saw some cases of this function promoting hostile Web content, including technical support tactics (similar to the '866-344-4315' Pop-Up, the '844-809-5828' Scam Message or the '844-534-8203' Pop-Ups). These tactics normally request information, access to your PC for installing fraudulent software or up-front cash transfers for fraudulent PC repair services.

Although most PC users would find few, if any reasons to install CoupCoup intentionally, malware researchers also saw campaigns distributing CoupCoup via installer bundles with other programs. These bundles occasionally traced back to freeware products on Softonic.com, a site well-known for its pro-adware policies.

Tearing out the Browser Coupons You don't Want

Even adware products not known for promoting harmful content may become security or performance problems for the modified browser. Without any specific reasons for justifying its advertisement content, most PC users should treat removing CoupCoup, like any other adware, as a matter of basic browser maintenance. Any unprotected contact with its advertisements may subject your PC to other risks not within this article's scope, such as automatically-installed threats, exploit kits or phishing hoaxes.

Some variants of CoupCoup may reinstall themselves automatically, or use timers and mislabeled file names to avoid the complete deletion of their extensions. Well-designed anti-adware programs should be fully capable of deleting CoupCoup, despite these 'features.' However, regardless of the presence or lack of injected advertisements or other symptoms related to a CoupCoup installation, PC users trying to remove CoupCoup may wish to run multiple, sequential scans until they return clean results.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\ProgramData\coupcoup\coupcoup.exe

File name: C:\ProgramData\coupcoup\coupcoup.exe
MD5: 79f9311ac6a5009fef1a5756a0a529d3
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

"C:\ProgramData\coupcoup\coupcoup.exe" /progname=coupcoup /progver=3.4.2 /progpub=coupcoup /proguninstallurl=asdahjka.com /deleteappfolder=0 /deletefi

File name: "C:\ProgramData\coupcoup\coupcoup.exe" /progname=coupcoup /progver=3.4.2 /progpub=coupcoup /proguninstallurl=asdahjka.com /deleteappfolder=0 /deletefi
Mime Type: unknown/com /deleteappfolder=0 /deletefi
Group: Malware file