What is WbSvCouponApp?

WbSvCouponApp is software application developed by InstalleRex-WebPick. It is most commonly found on computers running Windows 7 with nearly 67.53% of installations running this operating system. WbSvCouponApp's installer is typically 836.00 KB in size and installs around 69 files. The most common release is 2.2.0.1281 with 20.78% of all installations currently using this version.

WbSvCouponApp is most popular in the United States with 58.14% of installations residing in this country.

About WbSvCouponApp?

Coupon App is a web browser extension developed by JustPlug.It and distributed through the WebPick InstalleRex download and install manager. It is often bundled with adware offers and includes various components such as a Windows service, auto-starting component, and browser toolbar/plugin. The purpose of the extension is to inject advertisements in the form of banner ads, hyper-text links, popups, and affiliate codes in links as coupon offers. Additionally, it may hijack existing advertising on websites. During installation, the program will install itself in a folder with a random name in Program Files or ProgramData, and each included file will also have a shared randomly generated name. The Windows Service runs with full administrator rights under the Services control app and connects to remote servers for updates. It also creates a server that listens for TCP network requests locally.

Multiple virus scanners have detected malware in WbSvCouponApp.

VG.exe (MD5: eb4ce60ecd7f5821196fa0e2996ea50b) has been flagged by 36 scanners:

Scanner Software	Version	Result
Agnitum Outpost	5.5.1.3	PUA.MultiPlug!
AhnLab-V3	2015.05.21.00	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
AVG	15.0.0.4347	Generic5.AVUU
Avira	8.3.1.6	SPR/Tool.689664.1
AVware	1.5.0.21	Trojan.Win32.Generic!BT
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Comodo Security	22187	ApplicUnwnt
Cyren	5.4.16.7	W32/Application.SEEW-0376
ESET-NOD32	11657	a variant of Win32/AdWare.MultiPlug.Y
McAfee	6.0.5.614	Artemis!EB4CE60ECD7F
McAfee-GW-Edition	v2015	BehavesLike.Win32.PUP.jh
NANO AntiVirus	0.30.24.1636	Riskware.Win32.MultiPlug.dfmntw
Panda Antivirus	4.6.4.2	Trj/Genetic.gen
Sophos	4.98.0	Generic PUA OA
SUPERAntiSpyware	5.6.0.1032	Adware.Multiplug/Variant
Symantec	20141.2.0.56	Trojan.Gen.2
Tencent	1.0.0.1	Trojan.Win32.Qudamah.Gen.3
VIPRE Antivirus	40408	Trojan.Win32.Generic!BT
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.654852
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.bY
Bitdefender	7.2	Application.Generic.654852
Fortinet FortiGate	5.1.152.0	Riskware/MultiPlug
F-Secure	11.0.19100.45	Application.Generic.654852
G Data	24	Application.Generic.654852
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A
MicroWorld-eScan	12.0.250.0	Application.Generic.654852
Qihoo-360	1.0.0.1015	Win32/Trojan.Dropper.c9f
TrendMicro-HouseCall	9.700.0.1001	Suspicious_GEN.F47V0620
IKARUS anti.virus	T3.1.6.1.0	Win32.Downloader.UZJ
K7 AntiVirus	9.176.11847	Adware ( 00495ec11 )
K7GW	9.176.11847	Adware ( 00495ec11 )
Avira AntiVir	7.11.158.2	Adware/MultiPlug.Y.4
Antiy-AVL	1.0.0.1	Trojan/Win32.TSGeneric
Dr.Web	7.00.7.12100	Trojan.Crossrider.1760
ViRobot	2011.4.7.4223	Adware.Agent.695808

1U.exe (MD5: 18c75d6e6235019d9d92dd51ff43cc3b) has been flagged by 16 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Dr.Web	7.00.9.04080	Trojan.Crossrider.5139
McAfee	6.0.4.564	Artemis!18C75D6E6235
McAfee-GW-Edition	2013	Artemis!18C75D6E6235
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0317
VIPRE Antivirus	28488	JustPlugIt (fs)
AVG	14.0.0.3972	Generic5.AWDQ
Baidu-International	3.5.1.41473	Adware.Win32.BHO.77
ESET-NOD32	9968	a variant of Win32/AdWare.MultiPlug.Y
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A
Comodo Security	18155	Application.Win32.MultiPlug.SJ
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
ViRobot	2011.4.7.4223	Adware.Agent.695808

2RApv.exe (MD5: 028c1a42ac6ff8fc1798d94718ed480f) has been flagged by 23 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.621135
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:MultiPlug-AD [PUP]
AVG	13.0.0.3169	Generic_r.JW
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.45
Bitdefender	7.2	Application.Generic.621135
Comodo Security	18122	ApplicUnwnt
ESET-NOD32	9691	a variant of Win32/AdWare.MultiPlug.T
G Data	24	Application.Generic.621135
K7GW	9.176.11799	Adware ( 004976341 )
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
MicroWorld-eScan	12.0.250.0	Application.Generic.621135
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0416
VIPRE Antivirus	28332	Trojan.Win32.Generic!BT
Dr.Web	7.00.7.12100	Trojan.Crossrider.1760
IKARUS anti.virus	T3.1.5.6.0	Virus.Win32.Dropper
K7 AntiVirus	9.176.11322	Adware ( 00495ec11 )
McAfee	6.0.4.564	Artemis!29EE858C3050
McAfee-GW-Edition	2013	Artemis!29EE858C3050
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
Symantec	20131.1.5.61	WS.Reputation.1
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
ViRobot	2011.4.7.4223	Adware.Agent.695808

FTjBX6Vo6.exe (MD5: dc0ac7dbdcbbb8b2561ba9b8ccab3d37) has been flagged by 9 scanners:

Scanner Software	Version	Result
AhnLab-V3	2014.05.28.00	Dropper/Win32.Preloader
Malwarebytes	1.75.0001	PUP.Optional.Multiplug
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ViRobot	2011.4.7.4223	Adware.Agent.695808
Baidu-International	3.5.1.41473	Adware.Win32.AdBlock.81
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0519
AVG	14.0.0.3955	Generic5.AVLQ
ESET-NOD32	9924	a variant of Win32/AdWare.MultiPlug.Y

Fp8F3EOou.exe (MD5: d0d484be64658687aec68689c2480693) has been flagged by 12 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:MultiPlug-AD [PUP]
AVG	13.0.0.3169	Generic_r.JW
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.T
Comodo Security	18155	Application.Win32.MultiPlug.SJ
ESET-NOD32	9712	a variant of Win32/AdWare.MultiPlug.T
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0214
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ViRobot	2011.4.7.4223	Adware.Agent.695808

Software Details

URL:

https://optonthing.info

Support:

–

Installation path:

C:\ProgramData\wbsvcouponapp

Uninstaller:

"C:\ProgramData\WbSvCouponApp\hikS.exe" /s /n /C:"ExecuteCommands;UninstallCommands" ""

Size:

836.00 KB

Language:

English

WbSvCouponApp Executable Details

Primary executable:

hikS.exe

Name:

WbSvCouponApp

Path:

C:\ProgramData\wbsvcouponapp\hikS.exe

MD5:

ef38514253e4dafb6823f236bc47bb5f

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

OrfRN.exe

Malware

76c781b09e1bd3b17c5e863c3c01effe

EXE

8J.exe

15f67f067cc9df510882bf68bc1df4d7

EXE

036oA.exe

15f67f067cc9df510882bf68bc1df4d7

EXE

F1A.exe

1dc7c3ef6eea8c9d6f3e5fc8055a42d3

EXE

bs1RIovBdw.exe

Malware

1dc7c3ef6eea8c9d6f3e5fc8055a42d3

EXE

wxUtWs1POE.exe

Adware

307a1013b73429aea7aaf426f863f9ea

EXE

ODe33IMf.exe

c023be37240262b15ac48ab871e2f2b4

EXE

IG3JJfxUJq.exe

c023be37240262b15ac48ab871e2f2b4

EXE

DNxYHDZ.exe

Adware

c023be37240262b15ac48ab871e2f2b4

EXE

DO5WLfgfT.exe

Adware

089eccf24986211f60726ee4710c5d76

File Type	Filename	MD5
EXE	OrfRN.exe Malware	76c781b09e1bd3b17c5e863c3c01effe
EXE	8J.exe	15f67f067cc9df510882bf68bc1df4d7
EXE	036oA.exe	15f67f067cc9df510882bf68bc1df4d7
EXE	F1A.exe	1dc7c3ef6eea8c9d6f3e5fc8055a42d3
EXE	bs1RIovBdw.exe Malware	1dc7c3ef6eea8c9d6f3e5fc8055a42d3
EXE	wxUtWs1POE.exe Adware	307a1013b73429aea7aaf426f863f9ea
EXE	ODe33IMf.exe	c023be37240262b15ac48ab871e2f2b4
EXE	IG3JJfxUJq.exe	c023be37240262b15ac48ab871e2f2b4
EXE	DNxYHDZ.exe Adware	c023be37240262b15ac48ab871e2f2b4
EXE	DO5WLfgfT.exe Adware	089eccf24986211f60726ee4710c5d76

WbSvCouponApp

What is WbSvCouponApp?

About WbSvCouponApp?

Multiple virus scanners have detected malware in WbSvCouponApp.

Software Details

WbSvCouponApp Executable Details