- Jan 11, 2011
- 2,007
What is CouponDropDown?
CouponDropDown is an adware that displays advertisements and hijacks your browsers. Although some adwares are not harmful, they are a nuisance due to constant pop-ups and ads. It is recommended that you remove these programs as some can be malicious.
Am I infected?
These are screenshots of this adware.
How to remove CouponDropDown (Removal Instructions)
This is a self-help guide, use at your own risk.
If you experience problems completing this guide, or the problem persists after following the instructions below or would like to have one of our staff members guide you through the process, please start a new thread in our <a href="https://malwaretips.com/forums/malware-removal-assistance-for-windows.10/">Malware Removal Assistance</a> forum.
<h2> Step 1: Uninstall CouponDropDown </h2>
Step 2: Remove browser Hijacks
Note: All your browsers will likely be hooked by the adware. As a result, you have to remove the CouponDropDown extension or add-on in each browser. You may or may not have the following add-ons. If you do, remove them as well.
CouponDropDown
FBPhotoZoom
GoPhoto.it
HDvid Codec
IB Updater
OneClickDownload
OneClickDownloader
Online HD TV
PutLockerDownloader
StartNow
TornTV
TorrentHandler
Yontoo
ZoomIt
For Google Chrome
For Firefox
For Internet Explorer
Step 3: Download AdwCleaner onto your desktop.
Malwarebytes should remove any remaining traces of this program. If you are still experiencing problems on your machine, please start a new thread in our Malware Removal Assistance forum.
Now that your PC is clean, I recommend you to create a new System Restore point then purge the old ones after.
For XP
How to create a Restore Point in XP
Delete all restore points except the most recent one
For Vista
Create a restore point
Delete all but the most recent restore point
For Windows 7
Create a restore point
Delete all but the most recent restore point - Click the Delete all but the most recent restore point link
Keep your system updated
I also recommend you to switch your antivirus program to a better one. Here are some suggestions:
Internet Explorer may be the most popular browser but it's definitely not the most secure browser. Consider using other browsers with addition add-ons to safeguard your system while browsing the internet.
Firefox is a more secure, faster browser than Internet Explorer. Firefox contains less vulnerabilities, reducing the risk of drive-by downloads. In addition, you can add the following add-ons to increase security.
Lastly, it is important to perform system maintenance on a regular basis. Here are a few tools and on-demand scanners that you should keep & use every 1-2 weeks to keep your system healthy.
<h2> Technical Details </h2>
CouponDropDown is an adware that displays advertisements and hijacks your browsers. Although some adwares are not harmful, they are a nuisance due to constant pop-ups and ads. It is recommended that you remove these programs as some can be malicious.
Am I infected?
These are screenshots of this adware.
How to remove CouponDropDown (Removal Instructions)
This is a self-help guide, use at your own risk.
If you experience problems completing this guide, or the problem persists after following the instructions below or would like to have one of our staff members guide you through the process, please start a new thread in our <a href="https://malwaretips.com/forums/malware-removal-assistance-for-windows.10/">Malware Removal Assistance</a> forum.
<h2> Step 1: Uninstall CouponDropDown </h2>
- Click Start, select Control Panel
- Click Add/Remove Programs (Or if you are using Vista/ Window 7, click Uninstall a program)
- Let the list of programs finish loading and find CouponDropDown and uninstall it
- If you don't see CouponDropDown on the list, proceed to the next step
Step 2: Remove browser Hijacks
Note: All your browsers will likely be hooked by the adware. As a result, you have to remove the CouponDropDown extension or add-on in each browser. You may or may not have the following add-ons. If you do, remove them as well.
CouponDropDown
FBPhotoZoom
GoPhoto.it
HDvid Codec
IB Updater
OneClickDownload
OneClickDownloader
Online HD TV
PutLockerDownloader
StartNow
TornTV
TorrentHandler
Yontoo
ZoomIt
For Google Chrome
- Open Chrome and click
- On the left hand side, click on the Extension tab
- Delete the CouponDropDown extension by clicking the trash can icon
- Remove any other add-ons on the list above
For Firefox
- Start Firefox and click the orange box on the top left corner. A drop down box will appear. Select Add-Ons
- Add-Ons Manager will pop up. Look for the CouponDropDown extension and remove it. Remove any other add-ons on the list above
For Internet Explorer
- Start IE and click Tools then Manage Add-Ons
- Locate the CouponDropDown Add-on and disable it.
- Remove any other add-ons on the list above
Step 3: Download AdwCleaner onto your desktop.
- Download the latest official version of Malwarebytes Anti-Malware FREE.
MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK (This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
- Start the Malwarebytes' Anti-Malware installation process by double clicking on mbam-setup file.
- When the installation begins, keep following the prompts in order to continue with the setup process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware checked. Then click on the Finish button. If Malwarebytes' prompts you to reboot, please do not do so.
- Malwarebytes Anti-Malware will now start and you'll be prompted to start a trial period , please select 'Decline' as we just want to use the on-demand scanner.
- On the Scanner tab,select Perform full scan and then click on the Scanbutton to start scanning your computer.
- Malwarebytes' Anti-Malware will now start scanning your computer for CouponDropDown malicious files as shown below.
- When the scan is finished a message box will appear, click OK to continue
- You will now be presented with a screen showing you the malware infections that Malwarebytes' Anti-Malware has detected.Please note that the infections found may be different than what is shown in the image.Make sure that everything is Checked (ticked) and click on the Remove Selected button.
- Malwarebytes' Anti-Malware will now start removing the malicious files.After completing this task it will display a message stating that it needs to reboot,please allow this request and then let your PC boot in Normal mode.
Malwarebytes should remove any remaining traces of this program. If you are still experiencing problems on your machine, please start a new thread in our Malware Removal Assistance forum.
Now that your PC is clean, I recommend you to create a new System Restore point then purge the old ones after.
For XP
How to create a Restore Point in XP
Delete all restore points except the most recent one
For Vista
Create a restore point
Delete all but the most recent restore point
For Windows 7
Create a restore point
Delete all but the most recent restore point - Click the Delete all but the most recent restore point link
Keep your system updated
- Keeping your programs (especially Adobe and Java products) updated is essential. Update Checker will notify you if any of your programs require an update.
- Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office product bugs and vulnerabilities.
- Please ensure you update your system regularly and have automatic updates on. You can learn how to turn Automatic Updates on here
I also recommend you to switch your antivirus program to a better one. Here are some suggestions:
- avast! 7 Home Edition - Don't use it with Online Armor
- Comodo Firewall - If you are an advance user
- Sandboxie - "Quarantines" your browser so anything that you do in it will be isolated from your system.
- Backup important files regulary to an external hard-drive or USB
Internet Explorer may be the most popular browser but it's definitely not the most secure browser. Consider using other browsers with addition add-ons to safeguard your system while browsing the internet.
Firefox is a more secure, faster browser than Internet Explorer. Firefox contains less vulnerabilities, reducing the risk of drive-by downloads. In addition, you can add the following add-ons to increase security.
- KeyScramber - Encrypts your keystrokes to protect you against keyloggers that steals personal & banking information
- AdBlock - Disable/blocks advertisements on websites so you won't accidentally click on a malicious ad.
- NoScript - Disables Flash & Java contents to avoid exploits or drive-by attacks
- Web of Trust - Shows the website rating by other users and blocks dangerous and poor-rated sites
Lastly, it is important to perform system maintenance on a regular basis. Here are a few tools and on-demand scanners that you should keep & use every 1-2 weeks to keep your system healthy.
<h2> Technical Details </h2>
Files:
%LocalAppData%\CouponDropDown\
%LocalAppData%\CouponDropDown\Chrome\
%LocalAppData%\CouponDropDown\Chrome\CouponDropDown.crx
%ProgramFilesX86%\CouponDropDown\
%ProgramFilesX86%\CouponDropDown\CouponDropDown.dll
%ProgramFilesX86%\CouponDropDown\CouponDropDown.exe
%ProgramFilesX86%\CouponDropDown\CouponDropDown.ico
%ProgramFilesX86%\CouponDropDown\CouponDropDown.ini
%ProgramFilesX86%\CouponDropDown\CouponDropDownGui.exe
%ProgramFilesX86%\CouponDropDown\CouponDropDownInstaller.log
%ProgramFilesX86%\CouponDropDown\Uninstall.exe
Registry keys:
HKEY_CURRENT_USER\Software\AppDataLow\Software\CouponDropDown\
HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider
HKEY_CURRENT_USER\Software\Cr_Installer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.FBApi
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.Sandbox
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055435552}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066436652}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077437752}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11111111-1111-1111-1111-110011431152}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22222222-2222-2222-2222-220022432252}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33333333-3333-3333-3333-330033433352}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550055435552}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660066436652}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77777777-7777-7777-7777-770077437752}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440044434452}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110011431152}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022432252}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33333333-3333-3333-3333-330033433352}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550055435552}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066436652}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{77777777-7777-7777-7777-770077437752}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\New Windows\Allow\*.crossrider.com
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011431152}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CouponDropDown
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011431152}
Last edited by a moderator: