Home Malware Programs Potentially Unwanted Programs (PUPs) Coupon Server

Coupon Server

Posted: October 7, 2013

Threat Metric

Ranking: 11,586
Threat Level: 2/10
Infected PCs: 9,980
First Seen: October 7, 2013
Last Seen: October 3, 2023
OS(es) Affected: Windows

Coupon Server Screenshot 1Coupon Server is an adware program designed to deliver relevant coupons while you interact with major shopping websites. Although Coupon Server's content isn't necessarily risky, malware research team usually does suggest removing any advertisement-generating applications from your PC to keep the stability and security of your browser optimized. Like similar shopping-focused add-ons such as SavingsShip or the MySavings Toolbar, Coupon Server usually is installed through software bundles that hide its inclusion until you've already gotten Coupon Server onto your computer. Avoiding untrusted download sources should be enough to keep unwanted Coupon Server installations from troubling your PC – while any competent anti-malware product should be more than adequate for deleting Coupon Server once Coupon Server is aboard your system.

When Your Server Gives You Coupons Apropos of Nothing

With hundreds of billions of dollars being spent in online shopping each year, many Web developers have a marked interest in sticking their businesses into that revenue stream, and Coupon Server is a good example of what results from such an attempt. A browser add-on that provides coupons for major retailers, Coupon Server is a legitimate service, but not always optimized for the best coupons available, and also includes poor controls for allowing you to determine when Coupon Server is displayed. By default, Coupon Server's coupons are shown as advertisements on top of your current Web page but within the same window. Coupon Server does clearly mark its coupons so that you will not confuse them with your normal site links, but Coupon Server also lacks any obvious way to control how these coupons are shown – or, most importantly, a way to turn them off easily.

In theory, Coupon Server may be installed independently, but Coupon Server usually will be installed along with other programs that happen to include Coupon Server as part of an overall bundle. Sites known to exploit software bundles for distributing toolbars and add-ons like Coupon Server should be considered untrustworthy download sources. If you must use such places to get new software, SpywareRemove.com malware experts recommend scanning any downloaded files before opening them and taking the risk of getting Coupon Server or other browser add-ons that you don't have any interest in installing.

Getting Your Shopping Coupons the Way You Want Them or not At All

Although Coupon Server only is adware and, thus, not a high-level PC threat, using anti-malware products for deleting Coupon Server still is the recommended solution, as far as SpywareRemove.com malware analysts are concerned. This is especially important for any circumstance where Coupon Server has been installed against your will since Coupon Server may be one of several other programs that were placed on your computer without getting your permission for the act. Not all programs distributed through software bundles, drive-by-downloads and other dishonest methods are known for showing symptoms that you could recognize immediately, unlike the coupon alerts of Coupon Server.

At the end of it all, though, Coupon Server is not a malicious program, and dealing with Coupon Server on a temporary basis does not harm your computer. You even may want to consider keeping Coupon Server installed if you feel that its coupons are especially beneficial – even if it is a sub-optimal decision as far as your Web-browsing performance is concerned.

Coupon Server Screenshot 2Coupon Server Screenshot 3Coupon Server Screenshot 4

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: fa1df70f86ae658170fef101f3f5b362
Detection count: 92
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkEngine.exe File name: FrameworkEngine.exe
Size: 247.84 KB (247848 bytes)
MD5: 59fe8872a16efd996f22fb7694880996
Detection count: 84
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: 2d3e42a80c0cc4e96593f2fd871d2341
Detection count: 82
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: 8c1ce178195715d97db93240c92a7396
Detection count: 81
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\Coupon Server-bho64.dll File name: Coupon Server-bho64.dll
Size: 952.71 KB (952712 bytes)
MD5: 0cde50d8da900acbdb800259e1e0ea44
Detection count: 71
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkEngine.exe File name: FrameworkEngine.exe
Size: 247.84 KB (247848 bytes)
MD5: 9c267e119de70d461c30f3dabcf0912e
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkEngine.exe File name: FrameworkEngine.exe
Size: 247.84 KB (247848 bytes)
MD5: 99401fd49ff82216ac97bf0dffc74893
Detection count: 64
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES%\Coupon Server\FrameworkEngine.exe File name: FrameworkEngine.exe
Size: 247.84 KB (247848 bytes)
MD5: dde0f26184230d87facde81efa3df744
Detection count: 64
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkEngine.exe File name: FrameworkEngine.exe
Size: 247.84 KB (247848 bytes)
MD5: 736614e5d7549c13b77468fb2dc123f3
Detection count: 60
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES%\Coupon Server\FrameworkBHO.dll File name: FrameworkBHO.dll
Size: 258.08 KB (258088 bytes)
MD5: 0703727e36010d57fd1c959441232922
Detection count: 54
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: cac2c18ab61fa74c83874d1e70b7f461
Detection count: 51
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES%\Coupon Server\FrameworkBHO.dll File name: FrameworkBHO.dll
Size: 258.08 KB (258088 bytes)
MD5: 61c66f4d96129b3184c6a1f4146f685a
Detection count: 46
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: a9889622bb7b2e46cea6f27d9904bb95
Detection count: 45
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: e60c8029d474d01eb03a5eb4c636d18b
Detection count: 30
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES%\Coupon Server\FrameworkBHO.dll File name: FrameworkBHO.dll
Size: 258.08 KB (258088 bytes)
MD5: e3801421278954dadde8101a1253e5d2
Detection count: 25
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: 91f9f485d1e3ede5be0047b66a076459
Detection count: 22
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: 4235f42139318c55c7392b14260df213
Detection count: 15
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: 3f304b3330c55457d933ad188bb1c420
Detection count: 12
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\FrameworkBHO64.dll File name: FrameworkBHO64.dll
Size: 325.16 KB (325160 bytes)
MD5: 1bc95beb9fc0ab24231433d2ae5ed46a
Detection count: 6
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES%\Coupon Server\FrameworkBHO.dll File name: FrameworkBHO.dll
Size: 258.08 KB (258088 bytes)
MD5: bb42a18ef25de0e6b251d76bcf3fa914
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES%\Coupon Server\FrameworkEngine.exe File name: FrameworkEngine.exe
Size: 247.84 KB (247848 bytes)
MD5: 8891c901021afc5ab5e8f8d4bc13a3fd
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014
%PROGRAMFILES(x86)%\Coupon Server\Coupon Server-updater.exe File name: Coupon Server-updater.exe
Size: 358.28 KB (358280 bytes)
MD5: 6f12d5c5ce7afd606b13d36a5de174b4
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Coupon Server
Group: Malware file
Last Updated: February 7, 2014

More files

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\Coupon ServerSOFTWARE\Coupon ServerSoftware\Microsoft\Internet Explorer\Approved Extensions\{11111111-1111-1111-1111-110311581152}SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater35852.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110311581152}SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Coupon Server-repairJobSoftware\Proxy\installations\Coupon ServerSOFTWARE\Wow6432Node\35852SOFTWARE\Wow6432Node\Coupon ServerSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110311581152}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Coupon Server-repairJobSOFTWARE\Wow6432Node\Proxy\Installations\Coupon ServerHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}35852_Coupon Server

Additional Information

The following directories were created:
%APPDATA%\Coupon Server%APPDATA%\Microsoft\Windows\Start Menu\Programs\Coupon Server%LOCALAPPDATA%\Coupon Server%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\dclojinfbfgccgbdkekjcfjbfakimkdj%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_dclojinfbfgccgbdkekjcfjbfakimkdj_0%PROGRAMFILES%\Coupon Server%PROGRAMFILES(x86)%\Coupon Server
The following URL's were detected:
coupon-server.com
Loading...