Jump to content

Pernicious Infection: Unremovable Rightcoupon & Browser Hijacker

Recommended Posts

Hi all,

I am starting to be a bit desperate because obviously my PC is undergoing a pernicious infection, but no anti-malware or anti-virus seem to recognize the threat:

The infection seems to be showing the following symptoms:

a) An ever-present Rightcoupon banner, which must be a new and nastier variant of the "normal" Rightcoupon malware, since none of the methods suggested to remove the "traditional" one (resetting Chrome, deleting suspicious extensions [there are none!], blocking suspicious services [there are none!], etc...) seem to work with it.

b) A nasty browser hijacker which doesn't just "steal" the links when I try to use a search engine (i.e., Bing or Google) leading me to all kind of random advertisement or outright fraudulent page, but sometimes it even recognize an attempt to *click* into the search engine text box and keep opening its ... as if it was covering the text box with its invisible "link/button"! I have also the impression that this browser hijacker ... is slowing down my pc a lot...but definitely having to close 3-4 pages of *trash* before having access to the desired page is slowing down my own "productivity"! :(

I have tried to use Malwarebytes both in Threat Scan and in Custom Scan (with all options enable) multiple times, both with normal Windows and safe mode Windows.

I have tried to use AdwCleaner...

I have tried to use Avast...and then deleted it, because...well...for it all seems to always works apart from the fact that you've not upgraded!!

I have tried to use Avira Antivirus...

I have tried Kapersky Antivirus...both with normal Windows and safe mode Windows...finds nothing...so I deleted it!

I have tried Panda Antivirus...both with normal Windows and safe mode Windows...which finds something, but not what I need it to find!!

I went as far as to download esoteric stuff* like Microsoft Malicious Software Removal Tool...which found 88 infected items (which I thought..."Hey? Cool! A Microsoft software that works                        as should be straight from the box? I'd not have bet 1 penny on it!! Amazing!!") and then, in a very Microsoftian way, reported back to its company and left the user with no information or hint                      about what it did to his pc!!!

I have even thought to try a boot drive USB antivirus scan, but for some mysterious reason, the system fails to recognize my USB key and to startup with the Linux-based OS that is loaded on the key,

so no way to use that... :(

In the end I have decided to see if here you can help with this infection...frankly I am getting a bit desperate, because this infection is really nasty.

Rightcoupon is already a disgusting bit of ... ... whomever programmed it should be burned at the stake for it!!

But last time I got infected with it, a scan in safe mode and a Chrome reset managed to "kill the beast"!!

This time even that fails... :(

Please help me! :(



* = Allow me the pun, but I guess you'll agree...it is not exactly the kind of software the average computer user would think to use when he has an infected pc!



Threat Scan Report.txt

Symptom 1.jpg

Symptom 2.jpg

symptom 3.jpg

symptom 4.jpg

symptom 5.jpg



Edited by Skarm
Changed signature
Link to post
Share on other sites

  • Root Admin

Hello @Skarm and :welcome:

Let's start by resetting your browsers. Then we'll run some more scans to see what's going on.


Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Reset Chrome back to defaults to completely clear out issues with Chrome.

  • First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
  • Scroll down until you see the  reset_chrome_sync.png "reset sync" button to clear your data from the server and remove your passphrase.
  • Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
  • Press the Windows key + R at the same time, to bring up the run dialog box.
    • run_command.png
  • Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\
  1. Press Ctrl + A to select all the files and folders.
  2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
  3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
  4. Example of all files and folders selected, except Bookmarks



Restart your computer now 


After the restart run the following.







Please run the following steps and post back the logs as an attachment when ready.


  • If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • If you don't have Malwarebytes 3 installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know on your next reply.


Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Right-click on the program and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan.
  • When finished, please click Clean.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Copy its content into your next reply.


RESTART THE COMPUTER Before running Step 3

Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.





Link to post
Share on other sites

Done as per your instruction, Ron!

Here are the results...

I have scanned with ADWcleaner 2 times, so the current situation is the 2nd try.

I have deleted the two files (FRST.txt and Additions.txt) I had from before...these are new.






AdwCleaner[C02] - 1st Scan.txt

AdwCleaner[S03] - 2nd scan.txt


Threat Scan.txt

Link to post
Share on other sites

  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.



Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.