What is WbSvCouponApp?

WbSvCouponApp is software application developed by InstalleRex-WebPick. It is most commonly found on computers running Windows 7 with nearly 67.53% of installations running this operating system. WbSvCouponApp's installer is typically 836.00 KB in size and installs around 69 files. The most common release is 2.2.0.1281 with 20.78% of all installations currently using this version.

WbSvCouponApp is most popular in the United States with 58.14% of installations residing in this country.

About WbSvCouponApp?

Coupon App is a web browser extension developed by JustPlug.It and distributed through the WebPick InstalleRex download and install manager. It is often bundled with adware offers and includes various components such as a Windows service, auto-starting component, and browser toolbar/plugin. The purpose of the extension is to inject advertisements in the form of banner ads, hyper-text links, popups, and affiliate codes in links as coupon offers. Additionally, it may hijack existing advertising on websites. During installation, the program will install itself in a folder with a random name in Program Files or ProgramData, and each included file will also have a shared randomly generated name. The Windows Service runs with full administrator rights under the Services control app and connects to remote servers for updates. It also creates a server that listens for TCP network requests locally.

Multiple virus scanners have detected malware in WbSvCouponApp.

VG.exe (MD5: eb4ce60ecd7f5821196fa0e2996ea50b) has been flagged by 36 scanners:

Scanner Software	Version	Result
Agnitum Outpost	5.5.1.3	PUA.MultiPlug!
AhnLab-V3	2015.05.21.00	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
AVG	15.0.0.4347	Generic5.AVUU
Avira	8.3.1.6	SPR/Tool.689664.1
AVware	1.5.0.21	Trojan.Win32.Generic!BT
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Comodo Security	22187	ApplicUnwnt
Cyren	5.4.16.7	W32/Application.SEEW-0376
ESET-NOD32	11657	a variant of Win32/AdWare.MultiPlug.Y
McAfee	6.0.5.614	Artemis!EB4CE60ECD7F
McAfee-GW-Edition	v2015	BehavesLike.Win32.PUP.jh
NANO AntiVirus	0.30.24.1636	Riskware.Win32.MultiPlug.dfmntw
Panda Antivirus	4.6.4.2	Trj/Genetic.gen
Sophos	4.98.0	Generic PUA OA
SUPERAntiSpyware	5.6.0.1032	Adware.Multiplug/Variant
Symantec	20141.2.0.56	Trojan.Gen.2
Tencent	1.0.0.1	Trojan.Win32.Qudamah.Gen.3
VIPRE Antivirus	40408	Trojan.Win32.Generic!BT
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.654852
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.bY
Bitdefender	7.2	Application.Generic.654852
Fortinet FortiGate	5.1.152.0	Riskware/MultiPlug
F-Secure	11.0.19100.45	Application.Generic.654852
G Data	24	Application.Generic.654852
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A
MicroWorld-eScan	12.0.250.0	Application.Generic.654852
Qihoo-360	1.0.0.1015	Win32/Trojan.Dropper.c9f
TrendMicro-HouseCall	9.700.0.1001	Suspicious_GEN.F47V0620
IKARUS anti.virus	T3.1.6.1.0	Win32.Downloader.UZJ
K7 AntiVirus	9.176.11847	Adware ( 00495ec11 )
K7GW	9.176.11847	Adware ( 00495ec11 )
Avira AntiVir	7.11.158.2	Adware/MultiPlug.Y.4
Antiy-AVL	1.0.0.1	Trojan/Win32.TSGeneric
Dr.Web	7.00.7.12100	Trojan.Crossrider.1760
ViRobot	2011.4.7.4223	Adware.Agent.695808

1U.exe (MD5: 18c75d6e6235019d9d92dd51ff43cc3b) has been flagged by 16 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:Dropper-gen [Drp]
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
Dr.Web	7.00.9.04080	Trojan.Crossrider.5139
McAfee	6.0.4.564	Artemis!18C75D6E6235
McAfee-GW-Edition	2013	Artemis!18C75D6E6235
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0317
VIPRE Antivirus	28488	JustPlugIt (fs)
AVG	14.0.0.3972	Generic5.AWDQ
Baidu-International	3.5.1.41473	Adware.Win32.BHO.77
ESET-NOD32	9968	a variant of Win32/AdWare.MultiPlug.Y
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A
Comodo Security	18155	Application.Win32.MultiPlug.SJ
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
ViRobot	2011.4.7.4223	Adware.Agent.695808

2RApv.exe (MD5: 028c1a42ac6ff8fc1798d94718ed480f) has been flagged by 23 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	12.0.163.0	Application.Generic.621135
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:MultiPlug-AD [PUP]
AVG	13.0.0.3169	Generic_r.JW
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.45
Bitdefender	7.2	Application.Generic.621135
Comodo Security	18122	ApplicUnwnt
ESET-NOD32	9691	a variant of Win32/AdWare.MultiPlug.T
G Data	24	Application.Generic.621135
K7GW	9.176.11799	Adware ( 004976341 )
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
MicroWorld-eScan	12.0.250.0	Application.Generic.621135
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0416
VIPRE Antivirus	28332	Trojan.Win32.Generic!BT
Dr.Web	7.00.7.12100	Trojan.Crossrider.1760
IKARUS anti.virus	T3.1.5.6.0	Virus.Win32.Dropper
K7 AntiVirus	9.176.11322	Adware ( 00495ec11 )
McAfee	6.0.4.564	Artemis!29EE858C3050
McAfee-GW-Edition	2013	Artemis!29EE858C3050
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
Symantec	20131.1.5.61	WS.Reputation.1
ByteHero BDV	1.0.0.1	Trojan.Exception.gen.101
ViRobot	2011.4.7.4223	Adware.Agent.695808

FTjBX6Vo6.exe (MD5: dc0ac7dbdcbbb8b2561ba9b8ccab3d37) has been flagged by 9 scanners:

Scanner Software	Version	Result
AhnLab-V3	2014.05.28.00	Dropper/Win32.Preloader
Malwarebytes	1.75.0001	PUP.Optional.Multiplug
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ViRobot	2011.4.7.4223	Adware.Agent.695808
Baidu-International	3.5.1.41473	Adware.Win32.AdBlock.81
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0519
AVG	14.0.0.3955	Generic5.AVLQ
ESET-NOD32	9924	a variant of Win32/AdWare.MultiPlug.Y

Fp8F3EOou.exe (MD5: d0d484be64658687aec68689c2480693) has been flagged by 12 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Dropper/Win32.Preloader
avast!	8.0.1489.320	Win32:MultiPlug-AD [PUP]
AVG	13.0.0.3169	Generic_r.JW
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.T
Comodo Security	18155	Application.Win32.MultiPlug.SJ
ESET-NOD32	9712	a variant of Win32/AdWare.MultiPlug.T
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
Qihoo-360	1.0.0.1015	HEUR/Malware.QVM10.Gen
TrendMicro-HouseCall	9.700-1001	TROJ_GEN.F47V0214
McAfee-GW-Edition	2013	Heuristic.BehavesLike.Win32.Suspicious.H
Symantec	20131.1.5.61	WS.Reputation.1
ViRobot	2011.4.7.4223	Adware.Agent.695808

Software Details

URL:

https://optonthing.info

Support:

–

Installation path:

C:\ProgramData\wbsvcouponapp

Uninstaller:

"C:\ProgramData\WbSvCouponApp\hikS.exe" /s /n /C:"ExecuteCommands;UninstallCommands" ""

Size:

836.00 KB

Language:

English

WbSvCouponApp Executable Details

Primary executable:

hikS.exe

Name:

WbSvCouponApp

Path:

C:\ProgramData\wbsvcouponapp\hikS.exe

MD5:

ef38514253e4dafb6823f236bc47bb5f

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

Knwmz.exe

3783983065bccd7189bdc1e0bdfd613d

EXE

R3LuGPJyg.exe

ded38d4c0669f64d9930f2b586a82d1f

EXE

YpAMk.exe

409d8dbf552a8acf79987be286054802

EXE

Fun7ruh.exe

d2e294f66a3de9848e63b400e2bcd222

EXE

AmzRu.exe

bbcd5d82d444db868b37b903b303d046

EXE

u0SVZjl2rL.exe

d9454ad18f985b372e320f14774415b9

EXE

EjmNR.exe

d3702154bee60b93a1c20e2060686145

EXE

itapWmVa9.exe

f5e9e6c50360364f62cf2c7ccd25d260

EXE

wPNCZNrb.exe

ddeefbd4af6f3bc4ac4f0c674147d226

WbSvCouponApp

What is WbSvCouponApp?

About WbSvCouponApp?

Multiple virus scanners have detected malware in WbSvCouponApp.

Software Details

WbSvCouponApp Executable Details