What is WbSvCouponApp?

WbSvCouponApp is software application developed by InstalleRex-WebPick. It is most commonly found on computers running Windows 7 with nearly 67.53% of installations running this operating system. WbSvCouponApp's installer is typically 836.00 KB in size and installs around 69 files. The most common release is 2.2.0.1281 with 20.78% of all installations currently using this version.

WbSvCouponApp is most popular in the United States with 58.14% of installations residing in this country.

About WbSvCouponApp?

Coupon App is a web browser extension developed by JustPlug.It and distributed through the WebPick InstalleRex download and install manager. It is often bundled with adware offers and includes various components such as a Windows service, auto-starting component, and browser toolbar/plugin. The purpose of the extension is to inject advertisements in the form of banner ads, hyper-text links, popups, and affiliate codes in links as coupon offers. Additionally, it may hijack existing advertising on websites. During installation, the program will install itself in a folder with a random name in Program Files or ProgramData, and each included file will also have a shared randomly generated name. The Windows Service runs with full administrator rights under the Services control app and connects to remote servers for updates. It also creates a server that listens for TCP network requests locally.

Multiple virus scanners have detected malware in WbSvCouponApp.

VG.exe (MD5: eb4ce60ecd7f5821196fa0e2996ea50b) has been flagged by 36 scanners:

Scanner Software	Version	Result
Agnitum Outpost	5.5.1.3	PUA.MultiPlug!
AhnLab-V3	2015.05.21.00	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
AVG	15.0.0.4347	Generic5.AVUU
Avira	8.3.1.6	SPR/Tool.689664.1
AVware	1.5.0.21	Trojan.Win32.Generic!BT
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Comodo Security	22187	ApplicUnwnt
Cyren	5.4.16.7	W32/Application.SEEW-0376
ESET-NOD32	11657	a variant of Win32/AdWare.MultiPlug.Y
McAfee	6.0.5.614	Artemis!EB4CE60ECD7F
McAfee-GW-Edition	v2015	BehavesLike.Win32.PUP.jh
NANO AntiVirus	0.30.24.1636	Riskware.Win32.MultiPlug.dfmntw
Panda Antivirus	4.6.4.2	Trj/Genetic.gen
Sophos	4.98.0	Generic PUA OA
SUPERAntiSpyware	5.6.0.1032	Adware.Multiplug/Variant
Symantec	20141.2.0.56	Trojan.Gen.2
Tencent	1.0.0.1	Trojan.Win32.Qudamah.Gen.3
VIPRE Antivirus	40408	Trojan.Win32.Generic!BT
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.654852
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.bY
Bitdefender	7.2	Application.Generic.654852
Fortinet FortiGate	5.1.152.0	Riskware/MultiPlug
F-Secure	11.0.19100.45	Application.Generic.654852
G Data	24	Application.Generic.654852
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A
MicroWorld-eScan	12.0.250.0	Application.Generic.654852
Qihoo-360	1.0.0.1015	Win32/Trojan.Dropper.c9f
TrendMicro-HouseCall	9.700.0.1001	Suspicious_GEN.F47V0620
IKARUS anti.virus	T3.1.6.1.0	Win32.Downloader.UZJ
K7 AntiVirus	9.176.11847	Adware ( 00495ec11 )
K7GW	9.176.11847	Adware ( 00495ec11 )
Avira AntiVir	7.11.158.2	Adware/MultiPlug.Y.4
Antiy-AVL	1.0.0.1	Trojan/Win32.TSGeneric
Dr.Web	7.00.7.12100	Trojan.Crossrider.1760
ViRobot	2011.4.7.4223	Adware.Agent.695808

1U.exe (MD5: 18c75d6e6235019d9d92dd51ff43cc3b) has been flagged by 16 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Dr.Web	7.00.9.04080	Trojan.Crossrider.5139
McAfee	6.0.4.564	Artemis!18C75D6E6235
McAfee-GW-Edition	2013	Artemis!18C75D6E6235
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0317
VIPRE Antivirus	28488	JustPlugIt (fs)
AVG	14.0.0.3972	Generic5.AWDQ
Baidu-International	3.5.1.41473	Adware.Win32.BHO.77
ESET-NOD32	9968	a variant of Win32/AdWare.MultiPlug.Y
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A
Comodo Security	18155	Application.Win32.MultiPlug.SJ
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
ViRobot	2011.4.7.4223	Adware.Agent.695808

2RApv.exe (MD5: 028c1a42ac6ff8fc1798d94718ed480f) has been flagged by 23 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.621135
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:MultiPlug-AD [PUP]
AVG	13.0.0.3169	Generic_r.JW
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.45
Bitdefender	7.2	Application.Generic.621135
Comodo Security	18122	ApplicUnwnt
ESET-NOD32	9691	a variant of Win32/AdWare.MultiPlug.T
G Data	24	Application.Generic.621135
K7GW	9.176.11799	Adware ( 004976341 )
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
MicroWorld-eScan	12.0.250.0	Application.Generic.621135
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0416
VIPRE Antivirus	28332	Trojan.Win32.Generic!BT
Dr.Web	7.00.7.12100	Trojan.Crossrider.1760
IKARUS anti.virus	T3.1.5.6.0	Virus.Win32.Dropper
K7 AntiVirus	9.176.11322	Adware ( 00495ec11 )
McAfee	6.0.4.564	Artemis!29EE858C3050
McAfee-GW-Edition	2013	Artemis!29EE858C3050
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
Symantec	20131.1.5.61	WS.Reputation.1
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
ViRobot	2011.4.7.4223	Adware.Agent.695808

FTjBX6Vo6.exe (MD5: dc0ac7dbdcbbb8b2561ba9b8ccab3d37) has been flagged by 9 scanners:

Scanner Software	Version	Result
AhnLab-V3	2014.05.28.00	Dropper/Win32.Preloader
Malwarebytes	1.75.0001	PUP.Optional.Multiplug
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ViRobot	2011.4.7.4223	Adware.Agent.695808
Baidu-International	3.5.1.41473	Adware.Win32.AdBlock.81
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0519
AVG	14.0.0.3955	Generic5.AVLQ
ESET-NOD32	9924	a variant of Win32/AdWare.MultiPlug.Y

Fp8F3EOou.exe (MD5: d0d484be64658687aec68689c2480693) has been flagged by 12 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:MultiPlug-AD [PUP]
AVG	13.0.0.3169	Generic_r.JW
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.T
Comodo Security	18155	Application.Win32.MultiPlug.SJ
ESET-NOD32	9712	a variant of Win32/AdWare.MultiPlug.T
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0214
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ViRobot	2011.4.7.4223	Adware.Agent.695808

Software Details

URL:

https://optonthing.info

Support:

–

Installation path:

C:\ProgramData\wbsvcouponapp

Uninstaller:

"C:\ProgramData\WbSvCouponApp\hikS.exe" /s /n /C:"ExecuteCommands;UninstallCommands" ""

Size:

836.00 KB

Language:

English

WbSvCouponApp Executable Details

Primary executable:

hikS.exe

Name:

WbSvCouponApp

Path:

C:\ProgramData\wbsvcouponapp\hikS.exe

MD5:

ef38514253e4dafb6823f236bc47bb5f

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

1cwHZ.exe

ef38514253e4dafb6823f236bc47bb5f

EXE

smFLm1umzad.exe

ec23e83d367281290af0228ffa7eada8

EXE

nV7.exe

Adware

ec23e83d367281290af0228ffa7eada8

EXE

t_BeP9X2.exe