ExstraCoupon

Posted: January 28, 2014

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	8,742
Threat Level:	2/10
Infected PCs:	10,554

First Seen:	January 28, 2014
Last Seen:	October 9, 2023
OS(es) Affected:	Windows

ExstraCoupon is a bundle-distributed adware program that provides online coupon-themed advertisements for your browser. Since these advertisements have few advantages for their audiences, and since ExstraCoupon has an extremely suspicious history indicative of its being a non-useful product, malware experts have categorized ExstraCoupon as a Potentially Unwanted Program. Like with any other PUP, deleting ExstraCoupon should be high on your to-do list, but ExstraCoupon often prevents the complete removal of all of its components. Deleting ExstraCoupon, therefore, can be ensured for completeness with strong anti-malware tools, particularly ones that have their own histories for thwarting unwanted formats of browser add-ons.

The 'Exstra' to Your Web Browser that Came Included Automatically

ExstraCoupon is adware very similar to add-ons like Roboosaver or Digisaver, both of which have been known to be installed with ExstraCoupon, rather redundantly. Like these other two adware products, ExstraCoupon pretends to provide advertisements that could benefit your online shopping activities, although the real benefits of these advertisements are extremely dubious. Malware researchers also noticed that all three of these adware programs are distributed by bundled installers, which may install their adware along with some other, more helpful application that, presumably, was the original reason for the download. There are no known notifications for the installation of ExstraCoupon or its associated add-ons.

ExstraCoupon's advertisements are the earliest and only symptoms of its installation that most PC users ever will see, and, currently, take the format of additional search engine results. These search results, rather than being acquired organically, are predetermined, based on ExstraCoupon's advertising partners, and aren't guaranteed to be filtered for the safety of any audiences.

Cutting out the Coupon Extras You Didn't Ask to Get

In addition to coupon advertisements, ExstraCoupon does have one, other feature that you may not appreciate: ExstraCoupon attempts to reinstall itself. This makes deleting ExstraCoupon through all of the usual methods far more arduous than it needs to be. However, it's an attribute that's fairly common for most Potentially Unwanted Programs, and malware experts find that any competent anti-malware product is able to deal with it. Closing all browsers and launching full system scans from Safe Mode should be all the preparatory work required to remove ExstraCoupon entirely and permanently, along with its advertisements.

As stated before, malware researchers have found that ExstraCoupon is being installed through software bundlers. These programs may be detected, before they install anything, by appropriate anti-adware and anti-malware scanners. However, a safe Web surfer who avoids sites known to deliver these types of unwanted programs never should be in danger of unwanted contact with ExstraCoupon installers, which are expected to have heavy distribution on illegal sites and sites with poor reputations.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%ALLUSERSPROFILE%\EXstraCoupon\lEyd.dll

File name: lEyd.dll
Size: 427 KB (427008 bytes)
MD5: 98de13496b10a056dcc43ef38408da05
Detection count: 117
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\EXstraCoupon
Group: Malware file
Last Updated: August 12, 2014

%ALLUSERSPROFILE%\EExstraCoupoN\Ywv.x64.dll

File name: Ywv.x64.dll
Size: 475.64 KB (475648 bytes)
MD5: b2b0f4b2af72e5f59b54fcf518182f07
Detection count: 110
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\EExstraCoupoN
Group: Malware file
Last Updated: August 12, 2014

%ALLUSERSPROFILE%\ExsTraCoupon\7QE6.dll

File name: 7QE6.dll
Size: 427 KB (427008 bytes)
MD5: 9cccd023ffd2a0f1179f900fd8e3e17b
Detection count: 28
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\ExsTraCoupon
Group: Malware file
Last Updated: August 12, 2014

%ALLUSERSPROFILE%\ExstraCoupon\sWzc_FZ.x64.dll

File name: sWzc_FZ.x64.dll
Size: 473.6 KB (473600 bytes)
MD5: 49644fbd90388ccfa9a450575f9e7e3e
Detection count: 26
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\ExstraCoupon
Group: Malware file
Last Updated: August 12, 2014

%ALLUSERSPROFILE%\EXstraCoupon\AGj.dll

File name: AGj.dll
Size: 423.42 KB (423424 bytes)
MD5: 2700a8b8d74df22e2a0627cbb001d7b7
Detection count: 19
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\EXstraCoupon
Group: Malware file
Last Updated: August 12, 2014

C:\Documents and Settings\<username>\Application data\exstracoupon\WtN7.exe

File name: C:\Documents and Settings\<username>\Application data\exstracoupon\WtN7.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

C:\Documents and Settings\<username>\Application data\exstracoupon\WtN7.dll

File name: C:\Documents and Settings\<username>\Application data\exstracoupon\WtN7.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

Additional Information

The following directories were created:

%ALLUSERSPROFILE%\Application Data\ExstraCoupon%ALLUSERSPROFILE%\ExstraCoupon%PROGRAMFILES%\ExstraCoupon%PROGRAMFILES(x86)%\ExstraCoupon