KeyCoupons

Posted: May 19, 2014

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	740

First Seen:	May 19, 2014
Last Seen:	May 2, 2022
OS(es) Affected:	Windows

KeyCoupons is an adware application that changes your Web browser's settings to load extra advertisements. Although advertisement-promoting functions are not necessarily threatening, the invasive techniques used by KeyCoupons may endanger your Web-browsing experience or harm your browser's performance, and malware researchers have found no advantages to letting KeyCoupons remain installed. With all downsides and no benefits worth noting, getting rid of KeyCoupons should be an easy decision for anyone, but doing so without appropriate adware-removing software may result in continuing dysfunctions for your browser of choice.

The E-Coupons that Cost Your Browser Too Much

KeyCoupons is considered a Potentially Unwanted Program (alternately referred to as a PUP or a PUA) due to its general lack of beneficial attributes and suspicious business practices, particularly regarding its installation. Because KeyCoupons and similar adware programs may be bundled with the installers of unrelated software, most PC users install KeyCoupons by mischance when attempting to download a file manager or other, equally popular software. KeyCoupons is not sufficiently threatening to be considered a threat, but malware researchers have seen numerous negative, albeit not illegal issues with KeyCoupons:

KeyCoupons may inject advertising links into arbitrary Web page content, such as specific text 'keywords.'
KeyCoupons also may load additional windows or tabs for advertising content at random intervals, or when your browser loads a particular Web page.
KeyCoupons is unlikely to filter its content to protect your safety and always there is the risk of including fraudulent Flash updates and other well-known misleading tactics that distribute threatening software. Phishing attacks that may collect your information through fraudulent pretenses (such as a survey or contest) also are a secondary, but still considerable security risk.
Because KeyCoupons's advertisements may be loaded through sites not designed to host them, KeyCoupons advertisements may block your access to legitimate links, navigation interfaces or other website content.
You can't disable these advertisement functions without removing KeyCoupons, and failing to do so may allow KeyCoupons to be a continual source of performance problems, such as slow Web page loading times, which are caused by KeyCoupons's additional advertisement content.

The Key to Cutting KeyCoupons out of Your Browser Permanently

Since KeyCoupons is a separate application that may remain on your PC as an independent entity from the browser that KeyCoupons is so happy to modify, browsers that show any clear indications of the symptoms of a KeyCoupons installation shouldn't be uninstalled. Instead of attacking the symptom, malware analysts would suggest deleting KeyCoupons with applications that include adware-removal functions in their scope of features. Because of its similarity to other adware, such as Deal Slider, KeyCoupons may be mistakenly identified as another adware program, but this mistake shouldn't harm the uninstall process. However, you may wish to keep your Web browser closed and use Safe Mode while removing KeyCoupons.

Even though the liberties that KeyCoupons and other adware programs take with your browser are not nearly as extensive as the attacks of real threats, allowing the wholesale display of advertisements from an untrustworthy source always is a significant risk to your Web-surfing security. In providing advice for blocking the distribution of threatening software, malware experts also note that limiting potential points of contact, such as KeyCoupons advertising, is one of several steps needed to keep your PC safe.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%PROGRAMFILES%\KeyCoupons\FrameworkBHO.dll

File name: FrameworkBHO.dll
Size: 258.08 KB (258088 bytes)
MD5: e46e26630e73fee6707ec675e544e301
Detection count: 80
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\KeyCoupons
Group: Malware file
Last Updated: May 20, 2014

%PROGRAMFILES(x86)%\KeyCoupons\FrameworkEngine.exe

File name: FrameworkEngine.exe
Size: 282.67 KB (282672 bytes)
MD5: c833855e7a2c6919d01b79c18e4b47b6
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\KeyCoupons
Group: Malware file
Last Updated: May 20, 2014

%LOCALAPPDATA%\KeyCoupons\uninstall.exe

File name: uninstall.exe
Size: 146.52 KB (146521 bytes)
MD5: c8d189bd33f62fb2e6029fa4c8ecfe93
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\KeyCoupons
Group: Malware file
Last Updated: May 20, 2014

%PROGRAMFILES(x86)%\KeyCoupons\FrameworkBHO64.dll

File name: FrameworkBHO64.dll
Size: 345.64 KB (345648 bytes)
MD5: 3f129a466228b247843eccd0537989b4
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\KeyCoupons
Group: Malware file
Last Updated: June 9, 2014

C:\Users\<username>\appdata\Local\KeyCoupons\SoftwareDetector.exe

File name: C:\Users\<username>\appdata\Local\KeyCoupons\SoftwareDetector.exe
MD5: d277bec3154e086ecfaba5f32c3f1ef0
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

C:\Users\<username>\appdata\Local\KeyCoupons\gpedit.exe

File name: C:\Users\<username>\appdata\Local\KeyCoupons\gpedit.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

C:\Users\<username>\appdata\Local\KeyCoupons\SoftwareDetector.exe

File name: C:\Users\<username>\appdata\Local\KeyCoupons\SoftwareDetector.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

C:\Users\<username>\appdata\Local\KeyCoupons\sqlite3.exe

File name: C:\Users\<username>\appdata\Local\KeyCoupons\sqlite3.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

C:\Users\<username>\appdata\Local\KeyCoupons\uninstall.exe

File name: C:\Users\<username>\appdata\Local\KeyCoupons\uninstall.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}SOFTWARE\38966SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{6E713650-8DDF-499E-95B6-DD10C65CC8C5}SOFTWARE\Wow6432Node\38966

Additional Information

The following directories were created:

%APPDATA%\{6E713650-8DDF-499E-95B6-DD10C65CC8C5}%LOCALAPPDATA%\KeyCoupons%PROGRAMFILES%\KeyCoupons%PROGRAMFILES(x86)%\KeyCoupons%USERPROFILE%\AppData\LocalLow\{6E713650-8DDF-499E-95B6-DD10C65CC8C5}