Friday
2008-11-29, 23:59
The following instructions have been created to help you to get rid of "CouponAndOffers" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Removal Instructions:
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "couponsandoffers" and pointing to "wjview /cp:p "<$PROGRAMFILES>\couponsandoffers\System\Code" Main lp: "C:\<$PROGRAMFILES>\couponsandoffers".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$PROGRAMFILES>\couponsandoffers\couponsandoffers.exe".
The file at "<$PROGRAMFILES>\couponsandoffers\couponsandoffers1.exe".
The file at "<$PROGRAMFILES>\couponsandoffers\couponsandoffers.inf".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\dump.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\run.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\System\MTemp\lock.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\systemdata.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\systemdata1.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\updates.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\merchants.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\administrator\cao4data.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\Applications\cmpck.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\Applications\couponsandoffers4.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\Applications\datamerchcouponsandofferssaved.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_about2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_agreement2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_offer3.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_preferences2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_script0.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\topmoxie_conflicts2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\topmoxie_proxy.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\MTemp\logfile.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\browsers.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\loader.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\personality.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\shopping.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\system.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_preferences2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_preferences2_wo.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_script0.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_script0_wo.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\a.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\b.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ba.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bb.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bc.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bd.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\be.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bf.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bg.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bh.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bi.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bj.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bk.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bl.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bm.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bn.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bo.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bp.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bq.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\br.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bs.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bt.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bu.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bv.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bw.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bx.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\by.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bz.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\c.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ca.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cb.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cc.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cd.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ce.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cf.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cg.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ch.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ci.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cj.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ck.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cl.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cm.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cn.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\co.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cp.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cq.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cr.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cs.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ct.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cu.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cv.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cw.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cx.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cy.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cz.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\d.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\da.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\db.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dc.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dd.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\de.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\df.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dg.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dh.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\di.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dj.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dk.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dl.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dn.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dp.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dq.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dr.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ds.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dt.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\du.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dv.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dw.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dy.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dz.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\e.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ea.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\eb.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ec.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ed.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\f.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\g.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\h.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\i.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\j.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\k.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\l.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\m.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\Main.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\n.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\p.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\q.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\r.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\s.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\t.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\u.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\v.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\w.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\x.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\y.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Images\p.gif".
Make sure you set your file manager to display hidden and system files. If CouponAndOffers uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Removal Instructions:
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "couponsandoffers" and pointing to "wjview /cp:p "<$PROGRAMFILES>\couponsandoffers\System\Code" Main lp: "C:\<$PROGRAMFILES>\couponsandoffers".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$PROGRAMFILES>\couponsandoffers\couponsandoffers.exe".
The file at "<$PROGRAMFILES>\couponsandoffers\couponsandoffers1.exe".
The file at "<$PROGRAMFILES>\couponsandoffers\couponsandoffers.inf".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\dump.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\run.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\System\MTemp\lock.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\systemdata.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\systemdata1.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\updates.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\merchants.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\ApplicationData\administrator\cao4data.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\Applications\cmpck.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\Applications\couponsandoffers4.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\Applications\datamerchcouponsandofferssaved.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_about2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_agreement2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_offer3.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_preferences2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\couponsandoffers_script0.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\topmoxie_conflicts2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Html\topmoxie_proxy.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\MTemp\logfile.txt".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\browsers.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\loader.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\personality.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\shopping.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\System\system.dls".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_preferences2.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_preferences2_wo.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_script0.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Temp\couponsandoffers_script0_wo.htm".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\a.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\b.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ba.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bb.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bc.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bd.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\be.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bf.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bg.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bh.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bi.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bj.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bk.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bl.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bm.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bn.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bo.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bp.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bq.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\br.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bs.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bt.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bu.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bv.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bw.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bx.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\by.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\bz.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\c.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ca.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cb.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cc.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cd.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ce.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cf.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cg.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ch.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ci.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cj.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ck.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cl.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cm.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cn.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\co.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cp.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cq.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cr.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cs.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ct.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cu.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cv.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cw.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cx.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cy.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\cz.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\d.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\da.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\db.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dc.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dd.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\de.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\df.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dg.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dh.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\di.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dj.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dk.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dl.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dn.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dp.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dq.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dr.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ds.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dt.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\du.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dv.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dw.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dy.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\dz.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\e.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ea.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\eb.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ec.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\ed.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\f.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\g.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\h.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\i.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\j.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\k.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\l.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\m.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\Main.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\n.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\p.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\q.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\r.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\s.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\t.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\u.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\v.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\w.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\x.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Code\y.class".
The file at "<$PROGRAMFILES>\couponsandoffers\System\Images\p.gif".
Make sure you set your file manager to display hidden and system files. If CouponAndOffers uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.