Coupon Server

Posted: October 7, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	14,568
Threat Level:	2/10
Infected PCs:	10,022

First Seen:	October 7, 2013
Last Seen:	March 3, 2025
OS(es) Affected:	Windows

Coupon Server is an adware program designed to deliver relevant coupons while you interact with major shopping websites. Although Coupon Server's content isn't necessarily risky, malware research team usually does suggest removing any advertisement-generating applications from your PC to keep the stability and security of your browser optimized. Like similar shopping-focused add-ons such as SavingsShip or the MySavings Toolbar, Coupon Server usually is installed through software bundles that hide its inclusion until you've already gotten Coupon Server onto your computer. Avoiding untrusted download sources should be enough to keep unwanted Coupon Server installations from troubling your PC – while any competent anti-malware product should be more than adequate for deleting Coupon Server once Coupon Server is aboard your system.

When Your Server Gives You Coupons Apropos of Nothing

With hundreds of billions of dollars being spent in online shopping each year, many Web developers have a marked interest in sticking their businesses into that revenue stream, and Coupon Server is a good example of what results from such an attempt. A browser add-on that provides coupons for major retailers, Coupon Server is a legitimate service, but not always optimized for the best coupons available, and also includes poor controls for allowing you to determine when Coupon Server is displayed. By default, Coupon Server's coupons are shown as advertisements on top of your current Web page but within the same window. Coupon Server does clearly mark its coupons so that you will not confuse them with your normal site links, but Coupon Server also lacks any obvious way to control how these coupons are shown – or, most importantly, a way to turn them off easily.

In theory, Coupon Server may be installed independently, but Coupon Server usually will be installed along with other programs that happen to include Coupon Server as part of an overall bundle. Sites known to exploit software bundles for distributing toolbars and add-ons like Coupon Server should be considered untrustworthy download sources. If you must use such places to get new software, SpywareRemove.com malware experts recommend scanning any downloaded files before opening them and taking the risk of getting Coupon Server or other browser add-ons that you don't have any interest in installing.

Getting Your Shopping Coupons the Way You Want Them or not At All

Although Coupon Server only is adware and, thus, not a high-level PC threat, using anti-malware products for deleting Coupon Server still is the recommended solution, as far as SpywareRemove.com malware analysts are concerned. This is especially important for any circumstance where Coupon Server has been installed against your will since Coupon Server may be one of several other programs that were placed on your computer without getting your permission for the act. Not all programs distributed through software bundles, drive-by-downloads and other dishonest methods are known for showing symptoms that you could recognize immediately, unlike the coupon alerts of Coupon Server.

At the end of it all, though, Coupon Server is not a malicious program, and dealing with Coupon Server on a temporary basis does not harm your computer. You even may want to consider keeping Coupon Server installed if you feel that its coupons are especially beneficial – even if it is a sub-optimal decision as far as your Web-browsing performance is concerned.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%PROGRAMFILES(x86)%\Coupon Server\Coupon Server-bho64.dll

File name: Coupon Server-bho64.dll
Size: 952.71 KB (952712 bytes)
MD5: 0cde50d8da900acbdb800259e1e0ea44
Detection count: 71
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014

%PROGRAMFILES(x86)%\Coupon Server\FrameworkEngine.exe

File name: FrameworkEngine.exe
Size: 247.84 KB (247848 bytes)
MD5: 736614e5d7549c13b77468fb2dc123f3
Detection count: 60
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014

%PROGRAMFILES%\Coupon Server\Coupon Server-bho.dll

File name: Coupon Server-bho.dll
Size: 752 KB (752008 bytes)
MD5: bd2cd6ebafc20a73166d3b30a5058062
Detection count: 45
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014

%PROGRAMFILES%\Coupon Server\FrameworkBHO.dll

File name: FrameworkBHO.dll
Size: 258.08 KB (258088 bytes)
MD5: e3801421278954dadde8101a1253e5d2
Detection count: 25
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014

%TEMP%\setup_coupon server-1.1.20131213.exe

File name: setup_coupon server-1.1.20131213.exe
Size: 1.09 MB (1090736 bytes)
MD5: 37ff7f6434d7d650790bdf04897ba481
Detection count: 15
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%
Group: Malware file
Last Updated: February 7, 2014

%TEMP%\d7d2c4d2-91f0-47ac-a3ab-308d17db563a\Software\Coupon Server.exe

File name: Coupon Server.exe
Size: 1.1 MB (1104840 bytes)
MD5: 2b007a73f2e9b50ad7977e3a471ab571
Detection count: 6
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%\d7d2c4d2-91f0-47ac-a3ab-308d17db563a\Software
Group: Malware file
Last Updated: February 7, 2014

%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll

File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: 1bc95beb9fc0ab24231433d2ae5ed46a
Detection count: 6
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014

%PROGRAMFILES(x86)%\Coupon Server\Coupon Server-updater.exe

File name: Coupon Server-updater.exe
Size: 358.28 KB (358280 bytes)
MD5: 6f12d5c5ce7afd606b13d36a5de174b4
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014

More files

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\Coupon ServerSOFTWARE\Coupon ServerSoftware\Microsoft\Internet Explorer\Approved Extensions\{11111111-1111-1111-1111-110311581152}SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater35852.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110311581152}SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Coupon Server-repairJobSoftware\Proxy\installations\Coupon ServerSOFTWARE\Wow6432Node\35852SOFTWARE\Wow6432Node\Coupon ServerSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110311581152}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Coupon Server-repairJobSOFTWARE\Wow6432Node\Proxy\Installations\Coupon ServerHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}35852_Coupon Server

Additional Information

The following directories were created:

%APPDATA%\Coupon Server%APPDATA%\Microsoft\Windows\Start Menu\Programs\Coupon Server%LOCALAPPDATA%\Coupon Server%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\dclojinfbfgccgbdkekjcfjbfakimkdj%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_dclojinfbfgccgbdkekjcfjbfakimkdj_0%PROGRAMFILES%\Coupon Server%PROGRAMFILES(x86)%\Coupon Server