What is TermCoach?
The Malwarebytes research team has determined that TermCoach is adware. These adware applications display advertisements not originating from the sites you are browsing.
How do I know if my computer is affected by TermCoach?
You may see this entry in your list of installed programs:
and these warnings during install:
and this type of advertisements:
How did TermCoach get on my computer?
Adware applications use different methods for distributing themselves. This particular one was bundled with other software.
How do I remove TermCoach?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-version.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to the following:
- Enable free trial of Malwarebytes Anti-Malware Premium
- Launch Malwarebytes Anti-Malware
- Then click Finish.
- If an update is found, you will be prompted to download and install the latest version.
- Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
- When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
- Reboot your computer if prompted.
- No, Malwarebytes' Anti-Malware removes TermCoach completely.
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the TermCoach adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
Technical details for experts
You will see these signs in a HijackThis log:
O23 - Service: TermCoach 1.10.0.21 Client Service (tcsvc_1.10.0.21) - TermCoach - C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exeYou may see these signs in FRST logs:
R2 tcsvc_1.10.0.21; C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe [300120 2015-07-28] (TermCoach) R1 tcfd_vt_1_10_0_21; C:\Windows\System32\drivers\tcfd_vt_1_10_0_21.sys [61312 2015-07-28] (TermCoach) C:\Program Files (x86)\TermCoach_1.10.0.21 (TermCoach) C:\Windows\system32\Drivers\tcfd_vt_1_10_0_21.sys (TermCoach) C:\Windows\system32\Drivers\tcfd_vw_1_10_0_21.sys TermCoach 1.10.0.21 (HKLM-x32\...\TermCoach_1.10.0.21) (Version: 1.10.0.21 - TermCoach)Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
Adds the folder C:\Program Files (x86)\TermCoach_1.10.0.21
Adds the file terms-of-service.rtf"="28/07/2015 19:40, 24088 bytes, A
Adds the file Uninstall.exe"="28/07/2015 23:43, 314432 bytes, A
Adds the folder C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses
Adds the file buildcrx-license.txt"="19/05/2014 21:10, 7074 bytes, A
Adds the file Info-ZIP-license.txt"="19/05/2014 21:10, 2944 bytes, A
Adds the file JSON-simple-license.txt"="30/10/2014 02:55, 11558 bytes, A
Adds the file nsJSON-license.txt"="19/05/2014 21:10, 809 bytes, A
Adds the file Nustache-license.txt"="30/10/2014 02:55, 1079 bytes, A
Adds the file TaskScheduler-license.txt"="30/10/2014 02:55, 0 bytes, A
Adds the file UAC-license.txt"="19/05/2014 21:10, 956 bytes, A
Adds the folder C:\Program Files (x86)\TermCoach_1.10.0.21\Service
Adds the file tcsvc.exe"="28/07/2015 23:43, 300120 bytes, A
In the existing folder C:\Windows\System32\drivers
Adds the file tcfd_vt_1_10_0_21.sys"="28/07/2015 23:43, 61312 bytes, A
Adds the file tcfd_vw_1_10_0_21.sys"="28/07/2015 23:43, 57728 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TermCoach_1.10.0.21]
"DisplayIcon"="REG_SZ", "C:\Program Files (x86)\TermCoach_1.10.0.21\Uninstall.exe"
"DisplayName"="REG_SZ", "TermCoach 1.10.0.21"
"DisplayVersion"="REG_SZ", "1.10.0.21"
"NoModify"="REG_DWORD", 1
"NoRepair"="REG_DWORD", 1
"Publisher"="REG_SZ", "TermCoach"
"UninstallString"="REG_SZ", "C:\Program Files (x86)\TermCoach_1.10.0.21\Uninstall.exe"
"URLInfoAbout"="REG_SZ", "http://www.termcoachapp.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TermCoach_1.10.0.21]
"cr-at"="REG_SZ", ""
"cr-pid"="REG_SZ", ""
"cr-ver"="REG_SZ", "43.0.2357.134"
"dbsr"="REG_SZ", "firefox"
"features"="REG_SZ", "0x01000000"
"ff-at"="REG_SZ", ""
"ff-pid"="REG_SZ", ""
"ff-ver"="REG_SZ", "38.0.5 (x86 en-GB)"
"hid"="REG_SZ", "1FB0C54E-C74D-AB91-A3A6-1983589F206E"
"ie-at"="REG_SZ", ""
"ie-pid"="REG_SZ", ""
"ie-ver"="REG_SZ", "11.0.9600.17914"
"iid"="REG_SZ", "00000000-0000-0000-0000-000000000000"
"itm"="REG_SZ", "2015-08-06T06:56:18Z"
"nf-at"="REG_SZ", "2360C1D0-57AD-B235-EEB9-DEAC6931556F"
"nf-pid"="REG_SZ", "F92623A0-FD0F-4A70-9EA5-98F528E8A056"
"nid"="REG_SZ", "7D5BAFA9-43AD-43BF-9BAE-D2823A38F2CB"
"osn"="REG_SZ", "Windows 7 Ultimate"
"ost"="REG_SZ", "x64"
"osv"="REG_SZ", "6.1.7601"
"user_sid"="REG_SZ", "S-1-5-21-612512518-1730918975-1677248042-1002"
"ver"="REG_SZ", "1.10.0.21"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tcfd_vt_1_10_0_21]
"DisplayName"="REG_SZ", "tcfd_vt_1_10_0_21"
"ErrorControl"="REG_DWORD", 1
"Group"="REG_SZ", "PNP_TDI"
"ImagePath"="REG_EXPAND_SZ, "system32\drivers\tcfd_vt_1_10_0_21.sys"
"Start"="REG_DWORD", 1
"Tag"="REG_DWORD", 10
"Type"="REG_DWORD", 1
"WOW64"="REG_DWORD", 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tcfd_vt_1_10_0_21\Enum]
"0"="REG_SZ", "Root\LEGACY_TCFD_VT_1_10_0_21\0000"
"Count"="REG_DWORD", 1
"NextInstance"="REG_DWORD", 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tcsvc_1.10.0.21]
"Description"="REG_SZ", "This service enables TermCoach 1.10.0.21 on HTTP websites"
"DisplayName"="REG_SZ", "TermCoach 1.10.0.21 Client Service"
"ErrorControl"="REG_DWORD", 1
"ImagePath"="REG_EXPAND_SZ, ""C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe""
"ObjectName"="REG_SZ", "LocalSystem"
"Start"="REG_DWORD", 2
"Type"="REG_DWORD", 16
"WOW64"="REG_DWORD", 1
Malwarebytes Anti-Malware log:Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 06/08/2015
Scan Time: 09:06
Logfile: mbamTermCoach.txt
Administrator: Yes
Version: 2.1.8.1057
Malware Database: v2015.08.06.01
Rootkit Database: v2015.08.04.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 329621
Time Elapsed: 4 min, 19 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 1
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe, 1936, Delete-on-Reboot, [b7e2d2334942d06690ec85fa669f8080]
Modules: 0
(No malicious items detected)
Registry Keys: 4
PUP.Optional.TermCoach.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\tcsvc_1.10.0.21, Quarantined, [b7e2d2334942d06690ec85fa669f8080],
PUP.Optional.TermCoach.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\TermCoach_1.10.0.21, Quarantined, [b7e21ee763287bbb027a5b24897c4cb4],
PUP.Optional.TermCoach.A, HKLM\SOFTWARE\WOW6432NODE\TermCoach_1.10.0.21, Quarantined, [d7c27f865f2cca6cb9d90ba24fb531cf],
PUP.Optional.Vitruvian.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCFD_VT_1_10_0_21, Quarantined, [7722ae57701baf874990921784809f61],
Registry Values: 2
PUP.Optional.Vitruvian.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\tcfd_vt_1_10_0_21|ImagePath, system32\drivers\tcfd_vt_1_10_0_21.sys, Quarantined, [7722ae57701baf874990921784809f61]
PUP.Optional.Vitruvian.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\tcsvc_1.10.0.21|ImagePath, "C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe", Quarantined, [376260a56b20e4526892c8d72adae21e]
Registry Data: 0
(No malicious items detected)
Folders: 3
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21, Delete-on-Reboot, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Service, Delete-on-Reboot, [dabf7293771438fef235848d7e859b65],
Files: 18
PUP.Optional.TermCoach.A, C:\WINDOWS\SYSTEM32\drivers\tcfd_vt_1_10_0_21.sys, Delete-on-Reboot, [bea1e754ee46eca66fd9ab5af04ba6e3],
PUP.Optional.TermCoach.A, C:\WINDOWS\SYSTEM32\drivers\tcfd_vw_1_10_0_21.sys, Delete-on-Reboot, [b29ab4fc3efa6b8a54f7621f57e10396],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe, Delete-on-Reboot, [b7e2d2334942d06690ec85fa669f8080],
PUP.Optional.TermCoach.A, C:\Users\{username}\Desktop\TermCoach.exe, Quarantined, [3e5bd233117a4ee87309e699b2539c64],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Uninstall.exe, Quarantined, [b7e21ee763287bbb027a5b24897c4cb4],
PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, Quarantined, [5c3d6f96eba0999d4800e0b405ff1fe1],
PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-install-v0003, Quarantined, [2d6c3dc87a1141f565e39df71be99b65],
PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-processes-v0002, Quarantined, [2c6d27de6823f34397b1d4c0749039c7],
PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, Quarantined, [eaaf8085cebde2542b1d336118ecab55],
PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, Quarantined, [3e5bec196427979f5aeebdd7b94b30d0],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\terms-of-service.rtf, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\buildcrx-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\Info-ZIP-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\JSON-simple-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\nsJSON-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\Nustache-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\TaskScheduler-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65],
PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\UAC-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65],
Physical Sectors: 0
(No malicious items detected)
(end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
