How to remove CouponDropDown (Uninstall Guide)

Fiery

Level 1
Thread author
Jan 11, 2011
2,007
What is CouponDropDown?

CouponDropDown is an adware that displays advertisements and hijacks your browsers. Although some adwares are not harmful, they are a nuisance due to constant pop-ups and ads. It is recommended that you remove these programs as some can be malicious.


Am I infected?

These are screenshots of this adware.

coupondropdown-adware.jpg


coupondropdown.jpg


How to remove CouponDropDown (Removal Instructions)
This is a self-help guide, use at your own risk.

If you experience problems completing this guide, or the problem persists after following the instructions below or would like to have one of our staff members guide you through the process, please start a new thread in our <a href="https://malwaretips.com/forums/malware-removal-assistance-for-windows.10/">Malware Removal Assistance</a> forum.

<h2> Step 1: Uninstall CouponDropDown </h2>
  • Click Start, select Control Panel
  • Click Add/Remove Programs (Or if you are using Vista/ Window 7, click Uninstall a program)
  • Let the list of programs finish loading and find CouponDropDown and uninstall it
  • If you don't see CouponDropDown on the list, proceed to the next step

Step 2: Remove browser Hijacks
Note: All your browsers will likely be hooked by the adware. As a result, you have to remove the CouponDropDown extension or add-on in each browser. You may or may not have the following add-ons. If you do, remove them as well.

CouponDropDown
FBPhotoZoom
GoPhoto.it
HDvid Codec
IB Updater
OneClickDownload
OneClickDownloader
Online HD TV
PutLockerDownloader
StartNow
TornTV
TorrentHandler
Yontoo
ZoomIt

For Google Chrome
  • Open Chrome and click
    ChromeMenubutton.png
    and select Settings
  • On the left hand side, click on the Extension tab
  • Delete the CouponDropDown extension by clicking the trash can icon
    coupondropdown-google-chrome.jpg
  • Remove any other add-ons on the list above

For Firefox
  • Start Firefox and click the orange box on the top left corner. A drop down box will appear. Select Add-Ons
  • Add-Ons Manager will pop up. Look for the CouponDropDown extension and remove it. Remove any other add-ons on the list above

For Internet Explorer
  • Start IE and click Tools then Manage Add-Ons
  • Locate the CouponDropDown Add-on and disable it.
  • Remove any other add-ons on the list above

Step 3: Download AdwCleaner onto your desktop.
  1. Download the latest official version of Malwarebytes Anti-Malware FREE.
    MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK (This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
  2. Start the Malwarebytes' Anti-Malware installation process by double clicking on mbam-setup file.
    malwarebytes-setup.png

  3. When the installation begins, keep following the prompts in order to continue with the setup process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware checked. Then click on the Finish button. If Malwarebytes' prompts you to reboot, please do not do so.
    update-malwarebytes.png

  4. Malwarebytes Anti-Malware will now start and you'll be prompted to start a trial period , please select 'Decline' as we just want to use the on-demand scanner.
    mbam3.PNG

  5. On the Scanner tab,select Perform full scan and then click on the Scanbutton to start scanning your computer.
    start-scan-malwarebytes.png

  6. Malwarebytes' Anti-Malware will now start scanning your computer for CouponDropDown malicious files as shown below.
    scan-malwarebytes.png

  7. When the scan is finished a message box will appear, click OK to continue
    results-malwarebytes.png
  8. You will now be presented with a screen showing you the malware infections that Malwarebytes' Anti-Malware has detected.Please note that the infections found may be different than what is shown in the image.Make sure that everything is Checked (ticked) and click on the Remove Selected button.
    detection-malwarebytes.png
  9. Malwarebytes' Anti-Malware will now start removing the malicious files.After completing this task it will display a message stating that it needs to reboot,please allow this request and then let your PC boot in Normal mode.


Malwarebytes should remove any remaining traces of this program. If you are still experiencing problems on your machine, please start a new thread in our Malware Removal Assistance forum.




Now that your PC is clean, I recommend you to create a new System Restore point then purge the old ones after.

For XP
How to create a Restore Point in XP
Delete all restore points except the most recent one

For Vista
Create a restore point
Delete all but the most recent restore point

For Windows 7
Create a restore point
Delete all but the most recent restore point - Click the Delete all but the most recent restore point link




Keep your system updated







    • Keeping your programs (especially Adobe and Java products) updated is essential. Update Checker will notify you if any of your programs require an update.
    • Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office product bugs and vulnerabilities.
    • Please ensure you update your system regularly and have automatic updates on. You can learn how to turn Automatic Updates on here


I also recommend you to switch your antivirus program to a better one. Here are some suggestions:



In addition to your antivirus, you need additional protection such as a firewall and behavioural blocker.


Other steps that you may want to do to further protect your system/files:



    • Sandboxie - "Quarantines" your browser so anything that you do in it will be isolated from your system.
    • Backup important files regulary to an external hard-drive or USB
Here are only a few suggestions that will improve your system security. Should you wish to allow us to make full recommendations and set your PC up with maximum security, please start a thread here. Our community of PC enthusiasts and experts will give you feedback and help you secure your system from future malware infections.


Internet Explorer may be the most popular browser but it's definitely not the most secure browser. Consider using other browsers with addition add-ons to safeguard your system while browsing the internet.

Firefox is a more secure, faster browser than Internet Explorer. Firefox contains less vulnerabilities, reducing the risk of drive-by downloads. In addition, you can add the following add-ons to increase security.





    • KeyScramber - Encrypts your keystrokes to protect you against keyloggers that steals personal & banking information
    • AdBlock - Disable/blocks advertisements on websites so you won't accidentally click on a malicious ad.
    • NoScript - Disables Flash & Java contents to avoid exploits or drive-by attacks
    • Web of Trust - Shows the website rating by other users and blocks dangerous and poor-rated sites
Google Chrome is another good browser that is faster and more secure than Internet Explorer by having a sandbox feature. Additionally, you can add the following add-on to Chrome to heighten security.



Lastly, it is important to perform system maintenance on a regular basis. Here are a few tools and on-demand scanners that you should keep & use every 1-2 weeks to keep your system healthy.



<h2> Technical Details </h2>
Files:

%LocalAppData%\CouponDropDown\
%LocalAppData%\CouponDropDown\Chrome\
%LocalAppData%\CouponDropDown\Chrome\CouponDropDown.crx
%ProgramFilesX86%\CouponDropDown\
%ProgramFilesX86%\CouponDropDown\CouponDropDown.dll
%ProgramFilesX86%\CouponDropDown\CouponDropDown.exe
%ProgramFilesX86%\CouponDropDown\CouponDropDown.ico
%ProgramFilesX86%\CouponDropDown\CouponDropDown.ini
%ProgramFilesX86%\CouponDropDown\CouponDropDownGui.exe
%ProgramFilesX86%\CouponDropDown\CouponDropDownInstaller.log
%ProgramFilesX86%\CouponDropDown\Uninstall.exe

Registry keys:

HKEY_CURRENT_USER\Software\AppDataLow\Software\CouponDropDown\
HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider
HKEY_CURRENT_USER\Software\Cr_Installer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.FBApi
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.Sandbox
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055435552}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066436652}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077437752}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11111111-1111-1111-1111-110011431152}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22222222-2222-2222-2222-220022432252}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33333333-3333-3333-3333-330033433352}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550055435552}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660066436652}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77777777-7777-7777-7777-770077437752}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440044434452}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110011431152}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022432252}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33333333-3333-3333-3333-330033433352}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550055435552}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066436652}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{77777777-7777-7777-7777-770077437752}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\New Windows\Allow\*.crossrider.com
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011431152}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CouponDropDown
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011431152}
 
Last edited by a moderator:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top