Home Malware Programs Potentially Unwanted Programs (PUPs) NCupons

NCupons

Posted: March 24, 2015

Threat Metric

Ranking: 5,908
Threat Level: 2/10
Infected PCs: 71,101
First Seen: March 24, 2015
Last Seen: March 5, 2025
OS(es) Affected: Windows

NCupons is yet another misleading web browser extension or add-on that is discovered to exhibit adware symptoms. Typically, unwanted products with adware nature are distributed using questionable methods such as bundling. If you are thinking of installing NCupons, think twice as this application is not as useful as advertised. At first glance, NCupons might try to convince you that NCupons will enhance your online shopping experience. NCupons might also promise to deliver best coupons, discounts and deals in order to save money and time for you. However, once installed on your computer, adware-supported programs like NCupons starts keeping a record of your frequently visited websites, search queries, etc. With the collected information, NCupons generates user-orientated ads and coupons that are intended to redirect them to third-party websites and build up their online traffic.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



C:\Program Files (x86)\Viva\viva.exe File name: viva.exe
Size: 346.62 KB (346624 bytes)
MD5: 5ade3a92dd5e9627ab41c427af8eb154
Detection count: 6,909
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\Viva\viva.exe
Group: Malware file
Last Updated: May 31, 2024
C:\AdwCleaner\Quarantine\v1\20200810.114405\116\RBM\NCupons\ncupons.exe#C641E7461FDE6F7E File name: ncupons.exe#C641E7461FDE6F7E
Size: 2.21 MB (2216720 bytes)
MD5: 972f19123fe20d1b1cf97e93fa9d207a
Detection count: 201
Mime Type: unknown/exe#C641E7461FDE6F7E
Path: C:\AdwCleaner\Quarantine\v1\20200810.114405\116\RBM\NCupons\ncupons.exe#C641E7461FDE6F7E
Group: Malware file
Last Updated: November 11, 2021
%PROGRAMFILES%\RBM\NCupons\ncupons.exe File name: ncupons.exe
Size: 2.21 MB (2216720 bytes)
MD5: 68603bb3b9bbb6e56177ecb0ffc441f6
Detection count: 61
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\RBM\NCupons
Group: Malware file
Last Updated: June 16, 2017

More files

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%WINDIR%\System32\drivers\cashnbackdrv.sys%WINDIR%\System32\drivers\lmservicedrv.sys%WINDIR%\System32\drivers\ncuponsdrv.sys%WINDIR%\System32\drivers\vivadrv.sysHKEY..\..\..\..{RegistryKeys}SOFTWARE\NCuponsSOFTWARE\Wow6432Node\NCuponsSYSTEM\ControlSet001\Enum\Root\LEGACY_NCUPONSDRVSYSTEM\ControlSet001\Enum\Root\LEGACY_VIVADRVSYSTEM\ControlSet001\Services\COMLiveServiceSYSTEM\ControlSet001\Services\NCupons ApplicationSYSTEM\ControlSet001\Services\ncuponsdrvSYSTEM\ControlSet001\services\NSCP ServiceSYSTEM\ControlSet001\services\nscp_cnbSYSTEM\ControlSet001\Services\vivadrvSYSTEM\ControlSet002\Enum\Root\LEGACY_NCUPONSDRVSYSTEM\ControlSet002\Enum\Root\LEGACY_VIVADRVSYSTEM\ControlSet002\Services\COMLiveServiceSYSTEM\ControlSet002\Services\NCupons ApplicationSYSTEM\ControlSet002\Services\ncuponsdrvSYSTEM\ControlSet002\services\NSCP ServiceSYSTEM\ControlSet002\services\nscp_cnbSYSTEM\ControlSet002\Services\vivadrvSYSTEM\CurrentControlSet\Enum\Root\LEGACY_NCUPONSDRVSYSTEM\CurrentControlSet\Enum\Root\LEGACY_VIVADRVSYSTEM\CurrentControlSet\Services\COMLiveServiceSYSTEM\CurrentControlSet\Services\NCupons ApplicationSYSTEM\CurrentControlSet\Services\ncuponsdrvSYSTEM\CurrentControlSet\services\NSCP ServiceSYSTEM\CurrentControlSet\services\nscp_cnbSYSTEM\CurrentControlSet\Services\vivadrvHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}NCuponsnscp_cnb{15436961-4543-4CA2-ACBF-0B5C73D9E737}_is1

Additional Information

The following directories were created:
%PROGRAMFILES%\RBM\CashNBack%PROGRAMFILES%\RBM\NCupons%PROGRAMFILES%\nscp%PROGRAMFILES(x86)%\RBM\CashNBack%PROGRAMFILES(x86)%\RBM\NCupons%PROGRAMFILES(x86)%\nscp
Loading...