PennyBee
Posted: July 1, 2014
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Ranking: | 9,572 |
|---|---|
| Threat Level: | 2/10 |
| Infected PCs: | 105,722 |
| First Seen: | July 1, 2014 |
|---|---|
| Last Seen: | March 7, 2025 |
| OS(es) Affected: | Windows |
PennyBee is a shopping-themed browser add-on that displays coupons and other discounts when you browse the Web. Although PennyBee's functions have some theoretical advantages, in practice, its advertisements are more of a risk to your browser's security and performance than they are chances to save any substantial money. Removing PennyBee from your PC should be considered at the first opportunity, with anti-adware software used to confirm its complete deletion for the safety and stability of your Web browser.
The New Buzz of Browser Advertisements
Online advertising profits easily reach billions each year, but not all advertisements promote themselves through popular sites like Google or YouTube. Others, formatted as coupons for affiliated retailers, may be displayed by shopping adware, which include suspects like PennyBee, as well as PriceChop, SavingsBull, Deal4Me and RRSavings (as just some of many examples). PennyBee conducts these advertising campaigns in much the same ways as other types of adware:
- By monitoring your online activities, such as which websites you visit or products you view, PennyBee may configure its advertising content to related to the content you're viewing. However, this also uses up unnecessary system resources for functions that may cause your browser to perform more poorly than usual.
- PennyBee then loads its advertisements as injected or superimposed coupon links. While malware experts can't guarantee the safety or savings of PennyBee's coupons, they do warn that adware advertisements may be compromised by third parties who use them to distribute undesirable software.
How to Shoo Away a PennyBee
PennyBee makes the unusual recommendation of suggesting a separate download for a utility to uninstall its software, which is both atypical for legitimate applications and unnecessary for uninstalling PennyBee. Rather than taking its recommendation and risking exposing your PC to additional, unwanted software, malware experts encourage deleting PennyBee by way of dedicated anti-adware utilities and system scanners. Using these scans from within Safe Mode and using them without any opened Web browsers will help to keep any interference to a bare minimum, making PennyBee's complete deletion all the more certain.
Sadly, removing PennyBee only is half the story, and malware researchers have yet to ascertain all of the distribution methods used to install this coupon-based adware. While, with some searching, you may find its website at pennybee.com, adware may use secondary methods of distribution, many of which may fail to acquire the PC user's permission for the installation of the program.
Most adware installs through bundle-based utilities that may not announce the inclusion of PennyBee or its relatives, although this omission shouldn't stop proper PC security products from detecting them. Scanning suspicious files, particularly if you procure them from unusual sites or download networks, especially ones with links to threatening software or other Potentially Unwanted Programs.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:C:\AdwCleaner.BackupByPortableAppC\Quarantine\C\Program Files (x86)\PennyBee\PennyBee.exe.vir
File name: PennyBee.exe.virSize: 57.85 KB (57856 bytes)
MD5: f7181e6df93cb6123363915fe97079a3
Detection count: 8,963
Mime Type: unknown/vir
Path: C:\AdwCleaner.BackupByPortableAppC\Quarantine\C\Program Files (x86)\PennyBee\PennyBee.exe.vir
Group: Malware file
Last Updated: February 3, 2023
J:\System Volume Information\_restore{27B1F6D6-B036-447D-9353-49093C891238}\RP125\A0058046.exe
File name: A0058046.exeSize: 464.95 KB (464952 bytes)
MD5: 3e01a07597677e78805a1947e0b52a8e
Detection count: 3,839
File type: Executable File
Mime Type: unknown/exe
Path: J:\System Volume Information\_restore{27B1F6D6-B036-447D-9353-49093C891238}\RP125\A0058046.exe
Group: Malware file
Last Updated: August 10, 2021
C:\Program Files\PennyBee\PennyBee.exe
File name: PennyBee.exeSize: 57.85 KB (57856 bytes)
MD5: 68090de5d41ec985fc6de24a578308f0
Detection count: 3,553
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files\PennyBee\PennyBee.exe
Group: Malware file
Last Updated: May 29, 2022
%ALLUSERSPROFILE%\pennybeepro2\1.1.0.25\wpennybeeprod.exe
File name: wpennybeeprod.exeSize: 162.3 KB (162304 bytes)
MD5: 91f82effca8f74a894d48b10ea21b37a
Detection count: 46
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\pennybeepro2\1.1.0.25
Group: Malware file
Last Updated: March 26, 2016
%ALLUSERSPROFILE%\lyricsgizm2\1.1.0.25\lyricsgizmL32.exe
File name: lyricsgizmL32.exeSize: 124.41 KB (124416 bytes)
MD5: 3fb6073eb13c7203053393398494ec98
Detection count: 40
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\lyricsgizm2\1.1.0.25
Group: Malware file
Last Updated: July 27, 2017
%ALLUSERSPROFILE%\Application Data\lyricsgizm2\1.1.0.20\wlyricsgizmd.exe
File name: wlyricsgizmd.exeSize: 209.44 KB (209440 bytes)
MD5: 4909e8769c6f39726240772e2c508213
Detection count: 37
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data\lyricsgizm2\1.1.0.20
Group: Malware file
Last Updated: July 27, 2017
%ALLUSERSPROFILE%\Application Data\lyricsgizm2\1.1.0.20\lyricsgizm.exe
File name: lyricsgizm.exeSize: 392.73 KB (392736 bytes)
MD5: e1b69a2a405ed4f7c70291872858725a
Detection count: 37
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data\lyricsgizm2\1.1.0.20
Group: Malware file
Last Updated: July 27, 2017
\??\C:\windows\system32\Drivers\Jefdad120.sys
File name: Jefdad120.sysSize: 24.18 KB (24184 bytes)
MD5: 0758fb8fa82c1c60b51e9881dda66e94
Detection count: 36
File type: System file
Mime Type: unknown/sys
Path: \??\C:\windows\system32\Drivers
Group: Malware file
Last Updated: August 10, 2015
\??\C:\windows\system32\Drivers\Ipygi120.sys
File name: Ipygi120.sysSize: 24.69 KB (24696 bytes)
MD5: dc1633d35a8468f7b59cdf01832ac250
Detection count: 35
File type: System file
Mime Type: unknown/sys
Path: \??\C:\windows\system32\Drivers
Group: Malware file
Last Updated: August 10, 2015
%APPDATA%\PennyBee\UpdateProc\UpdateTask.exe
File name: UpdateTask.exeSize: 479.74 KB (479744 bytes)
MD5: 7297a1d8001a2de6462126f394d2e4c4
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\PennyBee\UpdateProc
Group: Malware file
Last Updated: March 23, 2016
988adae5538c14759e6e6ed4e52d2fdd
File name: 988adae5538c14759e6e6ed4e52d2fddSize: 134.51 KB (134512 bytes)
MD5: 988adae5538c14759e6e6ed4e52d2fdd
Detection count: 22
Group: Malware file
Last Updated: January 16, 2018
%PROGRAMFILES%\PennyBee\PennyBeeW.exe
File name: PennyBeeW.exeSize: 309.24 KB (309248 bytes)
MD5: 02418c3533493e0ac6df342d64186d4d
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\PennyBee
Group: Malware file
Last Updated: March 6, 2023
%ALLUSERSPROFILE%\pennybeepro2\1.1.0.23\pennybeeproD32.exe
File name: pennybeeproD32.exeSize: 126.97 KB (126976 bytes)
MD5: 102701e0a5ad26f1ac4340e9d9743f4c
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\pennybeepro2\1.1.0.23
Group: Malware file
Last Updated: October 2, 2014
%ALLUSERSPROFILE%\pennybeepro2\1.1.0.20\pennybeeprol64.exe
File name: pennybeeprol64.exeSize: 199.68 KB (199680 bytes)
MD5: dd6d5b2ae17a7b0ae4cfdff39a90bfa9
Detection count: 3
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\pennybeepro2\1.1.0.20
Group: Malware file
Last Updated: October 2, 2014
More files
Registry Modifications
CLSID{903260FE-C27C-4585-AC5C-2BB4AAB6C019}{A983DCA3-7CCD-4C76-B894-57ADEE66AFDC}{ECCD8756-E877-457F-8C44-4EC20055DDB5}Regexp file mask%windir%\System32\Tasks\pennybee Runner[RANDOM CHARACTERS]%windir%\System32\Tasks\pennybee[RANDOM CHARACTERS]%windir%\Tasks\pennybee Runner[RANDOM CHARACTERS]%windir%\Tasks\pennybee[RANDOM CHARACTERS]HKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\pennybeeSOFTWARE\Microsoft\Tracing\PennyBeeW_RASAPI32SOFTWARE\Microsoft\Tracing\PennyBeeW_RASMANCSSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\pennybee Runner.jobSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\pennybee Runner.job.fpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\PennyBee.jobSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\PennyBee.job.fpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\pennybeepro Runner.jobSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\pennybeepro Runner.job.fpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PennyBeeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\pennybee RunnerSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\pennybeepro RunnerSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PennyBee.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Run\PennyBeeSoftware\PennyBeeSOFTWARE\pennybeeproSOFTWARE\Wow6432Node\Microsoft\Tracing\PennyBeeW_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\PennyBeeW_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\PennyBee.exeSOFTWARE\Wow6432Node\pennybeeproSYSTEM\ControlSet001\services\pennybeeSYSTEM\ControlSet001\services\pennybeeproSYSTEM\ControlSet001\services\wpennybeedSYSTEM\CurrentControlSet\services\pennybeeSYSTEM\CurrentControlSet\services\pennybeeproSYSTEM\CurrentControlSet\services\wpennybeedHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}pennybeepennybeepro
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.