Remove the Coupon Drop Down Adware

CouponDropDown is a PUP, or potentially unwanted program, that displays pop-ups and advertisements on web pages that you visit. These advertisements will be shown as boxes containing various coupons that are available or as underlined keywords, which when clicked will display an advertisement that states it is brought to you by CouponDropDown. CouponDropDown is an add-on for Internet Explorer, Firefox, and Chrome that is typically installed when you install other free programs. When you install these free programs, they will also install CouponDropDown as well. Some of the programs that are known to bundle CouponDropDown include 1ClickDownload, Yontoo, and FBPhotoZoom.

 

CouponDropDown Ad 

For more screen shots of this infection click on the image above.

There are a total of 2 images you can view.

Unfortunately, many people find it difficult to remove this program as it is bundled under different program name. This guide will walk you through various steps that you can use to remove this program and disable it in your installed web browsers.

Threat Classification:

• Adware

Advanced information:

View CouponDropDown files.

View CouponDropDown Registry Information.

Tools Needed for this fix:

• None

Guide Updates:

11/20/12 - Initial guide creation.

11/28/12 - Updated to include StartNow Toolbar.

---

Removal Instructions for CouponDropDown:

To remove CouponDropDown we need to perform a few different steps. The first step is to remove any associated programs from the Add or Remove Programs or the Uninstall Programs control panel.

Click on the Start button and then select Control Panel. For Windows 8 you can access the Control Panel by searching for Control Panel at the Start Screen. When the Control Panel opens, double-click on one of the options below depending on your version of Windows

For Windows XP double-click on the Add or Remove Programs icon.

For Windows Vista, Windows 7 and Windows 8, double-click on the Uninstall Program option.

When the Add or Remove Programs or the Uninstall Program screen is displayed, please scroll through the list of programs and double-click on each of the entries listed in bold below to uninstall them. If you do not see any of the entries listed below do not be concerned and just continue with the guide.

1ClickDown

1ClickDownloader

FB Photo Zoom

GoPhoto.it

HDvid Codec 

IB Updater 

Incredibar Toolbar

OneClickDownload

OneClickDownloader

Online HD TV

PutLockerDownload

StartNow

TornTV

Yontoo

When you double-click on each of the above entries to uninstall them, please follow the default prompts and allow it to remove all files and all configuration information related to this program. If any of the programs ask you to reboot your computer, do not allow it to reboot until you have uninstalled all of the programs listed above.

When you are done, you can close the Control Panel screen.

Now we need to disable any add-ons or extensions affiliated with CouponDropDown. To do this, please perform the steps below that are associated with each browser you have installed on your computer. Please make sure you follow the steps for each browser installed on your computer regardless of whether or not you use them.

Remove the Chrome CouponDropDown Extension

Start Chrome and then click on the Chrome menu button (). When the menu appears, click on the Settings menu option. When the Settings screen appear, click on the Extension option. You will now be presented with a screen listing the installed extensions as shown below.

Click on the trashcan and delete the following extensions if they are present:

CouponDropDown

FBPhotoZoom

GoPhoto.it 

HDvid Codec 

IB Updater

OneClickDownload

OneClickDownloader 

Online HD TV 

PutLockerDownloader

StartNow 

TornTV

TorrentHandler 

Yontoo

ZoomIt

Once you have deleted all of the above extensions, you can close Chrome.

Remove the Internet Explorer CouponDropDown Add-on

Start Internet Explorer and then click on the Settings button (). When the menu appears, click on the Manage add-ons menu option. You will now be presented with a screen listing all of the the installed add-ons as shown below.

If any of the following items exist, left-click on it once to highlight it and then click on the Disable button that will then appear.

CouponDropDown

FBPhotoZoom

GoPhoto.it

HDvid Codec 

Incredibar Toolbar

Incredibar Helper Object 

IB Updater

OneClickDownload

OneClickDownloader 

Online HD TV 

PutLockerDownloader 

Smartdownloader class

StartNow 

TornTV

TorrentHandler 

Yontoo 

Yontoo API

Once you have disabled all of the above add-ons, you can close Internet Explorer.

Remove the Firefox CouponDropDown Add-on

Start Firefox and then click on the Firefox menu button (). When the menu appears, click on the Add-ons menu option. You will now be presented with a screen listing all of the the installed add-ons as shown below.

If any of the following items exist, click on the Remove button next to each one. If the Remove button does not exist, then please click on the Disable button.

CouponDropDown

FBPhotoZoom

HDvid Codec 

GoPhoto.it 

Incredibar

IB Updater

OneClickDownload

OneClickDownloader 

Online HD TV 

PutLockerDownloader

StartNow Toolbar 

TornTV

TorrentHandler 

Yontoo

Once you have removed or disabled all of the above add-ons, you can close Firefox.

Once you have removed the software from each of your browsers, your computer should now be free of the CouponDropDown program. It is suggested that you now perform a scan with a anti-malware program such as Emsisoft Anti-Malware or Malwarebytes Anti-Malware to make sure there is nothing else present on your computer.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

---

Associated CouponDropDown Files:

%ProgramFilesX86%\CouponDropDown\

%ProgramFilesX86%\CouponDropDown\CouponDropDown.dll

%ProgramFilesX86%\CouponDropDown\CouponDropDown.exe

%ProgramFilesX86%\CouponDropDown\CouponDropDown.ico

%ProgramFilesX86%\CouponDropDown\CouponDropDown.ini

%ProgramFilesX86%\CouponDropDown\CouponDropDownGui.exe

%ProgramFilesX86%\CouponDropDown\CouponDropDownInstaller.log

%ProgramFilesX86%\CouponDropDown\Uninstall.exe

%LocalAppData%\CouponDropDown\

%LocalAppData%\CouponDropDown\Chrome\

%LocalAppData%\CouponDropDown\Chrome\CouponDropDown.crx

File Location Notes:

%ProgramFilesX86% refers to the Program Files folder for 32-bit programs. The path to this folder is C:\Program Files\ on 32-bit versions of Windows or C:\Program Files (X86)\ on 64-bit versions of Windows.

%LocalAppData% refers to the current users Local settings Application Data folder. By default, this is C:\Documents and Settings\<Current User>\Local Settings\Application Data for Windows 2000/XP. For Windows Vista, Windows 7, and Windows 8 it is C:\Users\<Current User>\AppData\Local.

Associated CouponDropDown Windows Registry Information:

HKCU\Software\AppDataLow\Software\CouponDropDown\

HKCU\Software\AppDataLow\Software\Crossrider

HKCU\Software\Cr_Installer

HKLM\SOFTWARE\Classes\CrossriderApp0004352.BHO

HKLM\SOFTWARE\Classes\CrossriderApp0004352.FBApi

HKLM\SOFTWARE\Classes\CrossriderApp0004352.Sandbox

HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055435552}

HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066436652}

HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077437752}

HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{11111111-1111-1111-1111-110011431152}

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{22222222-2222-2222-2222-220022432252}

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{33333333-3333-3333-3333-330033433352}

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550055435552}

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660066436652}

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{77777777-7777-7777-7777-770077437752}

HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440044434452}

HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110011431152}

HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022432252}

HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{33333333-3333-3333-3333-330033433352}

HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550055435552}

HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066436652}

HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77777777-7777-7777-7777-770077437752}

HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\New Windows\Allow\*.crossrider.com

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011431152}

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CouponDropDown

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011431152}

---

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus, Trojan, Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.