CouponMarvel.B is an adware variant that infiltrates Windows systems to inject unwanted advertisements into web browsers and track browsing activity for revenue generation. This potentially unwanted program (PUP) belongs to the coupon-injector family of adware, designed to monetize user web traffic by inserting third-party ads, banners, pop-ups, and fraudulent coupon offers into legitimate websites. While not as destructive as ransomware or banking trojans, CouponMarvel.B degrades system performance, compromises user privacy, and creates security vulnerabilities that can lead to more serious infections.
Users typically discover they're infected when their browser suddenly displays excessive advertisements on sites that don't normally show them, when search results redirect through unknown domains, or when system performance noticeably degrades. The adware operates by installing browser extensions or helper objects, modifying browser settings, and establishing persistent mechanisms to survive basic removal attempts.
Threat Profile
| Family | Adware / Coupon Injector / Potentially Unwanted Program (PUP) |
| Aliases | Adware.CouponMarvel, PUP.Optional.CouponMarvel, Win32/CouponMarvel.B, Adware:Win32/CouponMarvel!B |
| Platform | Windows 7/8/8.1/10/11 (32-bit and 64-bit); primarily targets Chrome, Firefox, Edge, Internet Explorer |
| Discovered | Variants in this family emerged circa 2014-2016 during the peak of coupon-injector adware proliferation |
| Distribution | Software bundling, fake updates, freeware installers, misleading download buttons on file-sharing sites |
| Persistence Mechanisms | Registry Run keys, browser extension manifests, scheduled tasks, Windows services (varies by variant) |
| Primary Capabilities | Ad injection, browser hijacking, search redirection, click-fraud, affiliate cookie stuffing, browsing data collection |
| Data Collection | Browsing history, search queries, clicked links, shopping habits, IP address, system configuration |
| Network Behavior | Connects to ad-serving domains, affiliate networks, tracking pixels; generates significant HTTP/HTTPS traffic to third-party servers |
| System Impact | Moderate CPU usage, increased memory consumption, slowed browser performance, network bandwidth consumption |
| IoCs/Artifacts | Random-named folders in %APPDATA% or %LOCALAPPDATA%, browser extension with randomized ID, modified browser shortcuts, registry entries under HKCU\Software\[random string] |
| Removal Difficulty | Moderate — requires removal of multiple components across filesystem, registry, and browser configuration |
How It Spreads
CouponMarvel.B rarely arrives alone. The overwhelming majority of infections occur through software bundling, where the adware is packaged alongside legitimate freeware or shareware applications. When users download programs from third-party hosting sites, torrent repositories, or "download accelerator" services, they often accept installation packages that include multiple additional programs. The adware installer hides within "Custom" or "Advanced" installation options that most users skip, defaulting to the "Express" or "Recommended" installation that installs everything without informed consent.
Another common vector involves deceptive advertising and fake update notifications. Users encounter pop-ups claiming their Flash Player, Java, video codec, or browser is out of date, with a prominent download button that actually delivers the adware payload instead of the promised update. These fake update screens are designed to mimic legitimate software interfaces, complete with progress bars and official-looking graphics. File-sharing sites particularly favor this technique, placing fake "Download" buttons that are actually advertisements, while the real download link is small and difficult to locate.
Distribution methods for this adware family include:
- Bundled freeware installers — Download managers, PDF converters, video players, and codec packs from non-official sources
- Fake update notifications — Fraudulent prompts claiming Flash, Java, browser, or media player updates are required
- Misleading download buttons — Ad-laden file hosting sites with multiple "Download" buttons, most being advertisements
- Browser extension stores — Occasionally appears in official extension repositories with misleading descriptions before removal by platform operators
- Malvertising campaigns — Compromised or malicious advertisements on legitimate websites that redirect to exploit kits or direct downloads
- Email attachments — Less common for this family, but can arrive as a secondary payload from other malware
- Compromised software downloads — Legitimate-looking software from unofficial mirrors or warez sites with added malicious components
What It Does On Your Machine
Once installed, CouponMarvel.B establishes multiple footholds in your system to ensure persistence and profitability. The adware's primary function is ad injection — it monitors your browsing activity in real-time and inserts advertisements, coupon pop-ups, comparison shopping widgets, and sponsored links into web pages you visit. When you shop on Amazon, Walmart, eBay, or other e-commerce sites, the adware overlays legitimate product listings with its own ads and coupon offers. These injected elements typically contain affiliate tracking codes, meaning the adware operators earn commission when you click through their ads or make purchases.
The browser modification component is equally intrusive. CouponMarvel.B often changes your default search engine to a partner search portal that delivers ad-heavy results and tracks your queries. Your homepage and new tab page may redirect to sponsored portals or search engines you didn't authorize. Browser shortcuts on your desktop and taskbar might be modified to include command-line parameters that force these redirections even if you manually change your settings back. Some variants install browser helper objects (BHOs) in Internet Explorer or extensions in Chrome, Firefox, and Edge that resist removal through normal browser settings.
Beyond the visible annoyances, the adware engages in extensive data collection. It tracks every website you visit, every search term you enter, products you view, and links you click. This browsing profile is transmitted to remote servers and typically sold to advertising networks or data brokers. While the adware family itself isn't considered high-severity from a security standpoint, the data collection and third-party ad network integrations create security risks. The injected ads aren't vetted for safety — they can lead to phishing sites, tech support scams, or additional malware downloads. Users have reported the adware facilitating drive-by download attempts and serving ads for fake antivirus programs.
Performance degradation is another significant impact. The constant background monitoring, ad injection processing, and network communications consume system resources. Users notice browsers becoming sluggish, pages taking longer to load, increased CPU usage when browsing, and occasional browser crashes. The adware can interfere with legitimate website functionality, breaking JavaScript elements or causing display issues on sites that detect and attempt to block the injected content.
Manual Removal — Step by Step
Disconnect Network and Document Symptoms
Before making any changes, disconnect your computer from the internet by unplugging the Ethernet cable or disabling Wi-Fi. This prevents the adware from communicating with its command servers, downloading additional components, or updating its configuration. Take screenshots of the unwanted ads, changed browser settings, and any suspicious programs in your Programs and Features list — this documentation helps verify complete removal later.
Boot Into Safe Mode with Networking
Restart your computer into Safe Mode with Networking to prevent the adware from loading its persistent components. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and press F5 for Safe Mode with Networking. On Windows 7/8, restart and press F8 repeatedly before Windows loads, then select Safe Mode with Networking from the menu. This environment limits what programs can run and makes removal more effective.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11) and carefully review the installed programs list, sorted by installation date. Look for programs you don't recognize installed around the time problems started, particularly those with generic names, random characters, or containing words like "Coupon," "Deal," "Shopping," "Helper," or "Updater." Uninstall anything suspicious. The adware may appear under various names or disguise itself as a legitimate-sounding utility. If an uninstaller fails or leaves components behind, note the program name for manual cleanup.
Remove Browser Extensions and Reset Settings
Open each installed browser and remove all extensions you didn't intentionally install. In Chrome, navigate to chrome://extensions/, enable Developer Mode to see extension IDs, and remove anything unfamiliar. In Firefox, go to about:addons and remove suspicious extensions and themes. In Edge, check edge://extensions/. After removing extensions, reset each browser to default settings — this removes modified search engines, homepages, and startup pages. In Chrome: Settings > Reset and clean up > Restore settings to original defaults. In Firefox: Help > More Troubleshooting Information > Refresh Firefox. In Edge: Settings > Reset settings > Restore settings to their default values.
Clean Registry Persistence Entries
Press Windows+R, type "regedit" and press Enter to open Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (and the WOW6432Node version on 64-bit systems). Look for entries with suspicious names, random characters, or referencing the programs you uninstalled. Right-click and delete these entries. Also check HKEY_CURRENT_USER\Software for folders with random alphanumeric names or references to CouponMarvel — delete entire suspicious keys. Create a registry backup before making changes (File > Export) so you can restore if something goes wrong.
Remove Scheduled Tasks
Open Task Scheduler (search for it in the Start menu or run "taskschd.msc"). Review the Task Scheduler Library for tasks with suspicious names, especially those configured to run frequently or at logon. Look for tasks referencing the uninstalled programs or containing generic names like "Update," "Helper," or random strings. Right-click suspicious tasks and delete them. Check the Actions tab of each task to see what executable it runs — if it points to a file in a user's AppData folder or has a random name, it's likely malicious.
Delete Leftover Files and Folders
Navigate to C:\Users\[YourUsername]\AppData\Local and C:\Users\[YourUsername]\AppData\Roaming (you may need to enable viewing hidden files in File Explorer options). Look for folders with random GUID-like names (series of numbers and letters in curly braces or dashes), folders named after the uninstalled programs, or folders you don't recognize. Delete these folders. Also check C:\Program Files and C:\Program Files (x86) for leftover folders from the uninstalled adware. Empty the Recycle Bin when finished to permanently remove these files.
Run Reputable Anti-Malware Scanners
Reconnect to the internet and download Malwarebytes Free (from malwarebytes.com — be careful of fake sites) and run a full system scan. Malwarebytes excels at detecting adware and PUPs that traditional antivirus might miss. Quarantine and remove everything it finds. Follow up with a scan using AdwCleaner (also from Malwarebytes) which specifically targets adware remnants, browser hijackers, and modified shortcuts. Run Windows Defender (or your preferred antivirus) for a full scan as well to catch any additional threats that may have piggybacked on the adware installation.
Check Browser Shortcuts for Command-Line Hijacks
Right-click your browser shortcuts on the desktop, taskbar, and Start menu, select Properties, and examine the Target field. It should only contain the path to the browser executable (like "C:\Program Files\Google\Chrome\Application\chrome.exe") with no additional text after it. If you see extra parameters, URLs, or anything following the .exe path, delete everything after the closing quote mark around the executable path. Click Apply and OK. This removes a common persistence trick where adware modifies shortcuts to force homepage redirections even after you've cleaned browser settings.
Reboot, Monitor, and Change Passwords
Restart your computer normally (not in Safe Mode) and test your browsers. Verify that unwanted ads don't appear on sites like Amazon or Google, your homepage and search engine are correct, and performance is back to normal. Monitor for several days to ensure symptoms don't return. If the adware collected browsing data that included logged-in sessions, change passwords for sensitive accounts (email, banking, shopping sites) as a precaution. Use a different, clean device to change passwords if you're uncertain whether the infection is completely removed.
Prevention
- Download software only from official sources — Get programs directly from the developer's website or verified sources like the Microsoft Store. Avoid third-party download sites, especially those with multiple "Download" buttons and excessive advertising. If you must use a download portal, carefully inspect every installation screen.
- Always choose Custom/Advanced installation options — Never click through installer screens on "Express" or "Recommended" mode. Custom installation reveals bundled programs that would otherwise install silently. Uncheck any additional software, toolbars, browser changes, or optional offers before proceeding.
- Keep your system and software genuinely updated — Enable automatic updates for Windows, your browsers, and security software. Real updates come through built-in updaters or official websites — never trust pop-up messages claiming you need to update Flash, Java, or codecs. Most modern browsers have Flash built-in, and Java is rarely needed for typical home use.
- Use a reputable ad blocker with anti-adware capabilities — Browser extensions like uBlock Origin help block malicious advertisements and sites known to distribute adware. While ad blockers aren't perfect security solutions, they reduce exposure to malvertising campaigns and deceptive download buttons on file-sharing sites.
- Maintain active anti-malware protection — Keep Windows Defender enabled (or a reputable alternative antivirus) with real-time protection active. Supplement with periodic scans using Malwarebytes Free. Don't disable your security software because an installer asks you to — that's a major red flag.
- Be skeptical of too-good-to-be-true offers — If a coupon, deal, software, or download seems unrealistically generous, it probably is. Scammers use free premium software, amazing deals, and exclusive coupons as lures. Verify offers through official channels before clicking.
- Review installed programs and browser extensions monthly — Make it a habit to check Programs and Features and your browser extensions for anything you don't recognize. Remove unused or unfamiliar items promptly. Adware sometimes installs quietly and waits weeks before activating to avoid detection.
- Use a standard user account for daily activities — Don't browse the web or install routine programs while logged in as an administrator. A standard user account limits what software can install system-wide, forcing installers to request explicit permission that makes malicious installations more obvious.
Bring It In
While the steps above can successfully remove CouponMarvel.B from many systems, adware infections are often more stubborn than they initially appear. Browser hijackers frequently install multiple redundant components specifically designed to survive basic removal attempts. What looks like successful cleanup can be followed by the infection reappearing days later from a hidden scheduled task, a service you missed, or a compromised system file. If you've followed these steps and still see unwanted ads, redirections, or suspicious behavior — or if the technical process feels overwhelming — professional help is your best option.
Computer Repair Roswell has removed thousands of adware infections from computers across the North Atlanta area. We use professional-grade tools and techniques that go beyond what consumer software can accomplish, including offline scanning, driver-level rootkit detection, and forensic analysis to find every trace of the infection. Bring your computer to our Roswell shop at 1865 Piedmont Road NE Suite 2100, or call us at (770) 667-9142 to describe your symptoms. We offer free diagnostics to determine the extent of infection, and most adware removals are completed same-day with our 90-day reinfection warranty. Don't let adware compromise your privacy, waste your time, or expose you to more serious threats — let us handle it right the first time.