[Adware/Hijacker] Coupon Companion

[RLS0812]

I just ran into this little "gem" today while doing normal internet browsing.
The first thing I noticed was sluggish response between link clicking and page loading.
Second thing I noticed was certain key words on almost every web page I visited were underlined and linked.
Third thing was text ads appearing in Facebook as "ad not by Facebook".

Running my mouse over the "ad not by Facebook" revealed the name "Coupon Companion" ... which I never knowingly installed.

A Sypbot scan turned up nothing, so I looked for "coupon" on my hard drive.
* 2 files turned up as "Coupon Companion" in "Program Files" and "AppData/Local" ...
* 2 more files turned up as "couponcp-a.akamaihd.net" under "AppData\Roaming\Macromedia\Flash Player\#SharedObjects" and "AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys"
* One registry key turned up under "Coupon Companion"
* One Firefox extension turned up as "Coupon Companion"

I deleted everything, which seemed to stop the ads, however "couponcp-a.akamaihd.net" reinstalled it's self ... so now I need to figure out what the heck is auto dropping the files.

*[Update]*
After digging around I found that the "couponcp-a.akamaihd.net" folders are from unrelated flash cookies.

[tashi]

Hello RLS0812,

What is the operating system and how is the computer running now?

Best regards.

[RLS0812]

Windows 7 ( 64 bit )

As of when I posted this, there has been no unwanted in-linking or ads - Firefox responds much faster.

I still am trying to figure out what installed Coupon Companion on my system with out my consent ....

[tashi]

Hello RLS0812,


I still am trying to figure out what installed Coupon Companion on my system with out my consent ....

Did you download anything from CNET? See http://www.facebook.com/cnet/posts/10151146661732275

[RLS0812]

.... I was unaware that CNET now has adware in their downloader !

The date on "Coupon Companion" matches the date I downloaded "Magic Unlocker Assistant" http://download.cnet.com/Unlocker/3000-2248_4-11749326.html

[tashi]

Hi there,

"Coupon Companion"
http://forums.cnet.com/7723-7598_102-568380/coupon-companion-adware/

:lip:

[RLS0812]

Will Spybot recognize Coupon Companion as a PUP in a future update ?

[tashi]

Hello RLS0812,

You could post here: Requests for additions to Spybot's detections (http://forums.spybot.info/forumdisplay.php?f=17) and provide a link back to this thread to give perspective. :)