Removal instructions for TermCoach

[Metallica]

What is TermCoach?

The Malwarebytes research team has determined that TermCoach is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by TermCoach?

You may see this entry in your list of installed programs:

and these warnings during install:

and this type of advertisements:

How did TermCoach get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove TermCoach?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to the following:
  • Enable free trial of Malwarebytes Anti-Malware Premium
  • Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
• Reboot your computer if prompted.

Is there anything else I need to do to get rid of TermCoach?

• No, Malwarebytes' Anti-Malware removes TermCoach completely.

How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the TermCoach adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

You will see these signs in a HijackThis log:

O23 - Service: TermCoach 1.10.0.21 Client Service (tcsvc_1.10.0.21) - TermCoach - C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe

You may see these signs in FRST logs:

 R2 tcsvc_1.10.0.21; C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe [300120 2015-07-28] (TermCoach) R1 tcfd_vt_1_10_0_21; C:\Windows\System32\drivers\tcfd_vt_1_10_0_21.sys [61312 2015-07-28] (TermCoach) C:\Program Files (x86)\TermCoach_1.10.0.21 (TermCoach) C:\Windows\system32\Drivers\tcfd_vt_1_10_0_21.sys (TermCoach) C:\Windows\system32\Drivers\tcfd_vw_1_10_0_21.sysTermCoach 1.10.0.21 (HKLM-x32\...\TermCoach_1.10.0.21) (Version: 1.10.0.21 - TermCoach)

Alterations made by the installer:

File system details [View: All details] (Selection)---------------------------------------------------    Adds the folder C:\Program Files (x86)\TermCoach_1.10.0.21       Adds the file terms-of-service.rtf"="28/07/2015 19:40, 24088 bytes, A       Adds the file Uninstall.exe"="28/07/2015 23:43, 314432 bytes, A    Adds the folder C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses       Adds the file buildcrx-license.txt"="19/05/2014 21:10, 7074 bytes, A       Adds the file Info-ZIP-license.txt"="19/05/2014 21:10, 2944 bytes, A       Adds the file JSON-simple-license.txt"="30/10/2014 02:55, 11558 bytes, A       Adds the file nsJSON-license.txt"="19/05/2014 21:10, 809 bytes, A       Adds the file Nustache-license.txt"="30/10/2014 02:55, 1079 bytes, A       Adds the file TaskScheduler-license.txt"="30/10/2014 02:55, 0 bytes, A       Adds the file UAC-license.txt"="19/05/2014 21:10, 956 bytes, A    Adds the folder C:\Program Files (x86)\TermCoach_1.10.0.21\Service       Adds the file tcsvc.exe"="28/07/2015 23:43, 300120 bytes, A    In the existing folder C:\Windows\System32\drivers       Adds the file tcfd_vt_1_10_0_21.sys"="28/07/2015 23:43, 61312 bytes, A       Adds the file tcfd_vw_1_10_0_21.sys"="28/07/2015 23:43, 57728 bytes, ARegistry details [View: All details] (Selection)------------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TermCoach_1.10.0.21]       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\TermCoach_1.10.0.21\Uninstall.exe"       "DisplayName"="REG_SZ", "TermCoach 1.10.0.21"       "DisplayVersion"="REG_SZ", "1.10.0.21"       "NoModify"="REG_DWORD", 1       "NoRepair"="REG_DWORD", 1       "Publisher"="REG_SZ", "TermCoach"       "UninstallString"="REG_SZ", "C:\Program Files (x86)\TermCoach_1.10.0.21\Uninstall.exe"       "URLInfoAbout"="REG_SZ", "http://www.termcoachapp.com"    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TermCoach_1.10.0.21]       "cr-at"="REG_SZ", ""       "cr-pid"="REG_SZ", ""       "cr-ver"="REG_SZ", "43.0.2357.134"       "dbsr"="REG_SZ", "firefox"       "features"="REG_SZ", "0x01000000"       "ff-at"="REG_SZ", ""       "ff-pid"="REG_SZ", ""       "ff-ver"="REG_SZ", "38.0.5 (x86 en-GB)"       "hid"="REG_SZ", "1FB0C54E-C74D-AB91-A3A6-1983589F206E"       "ie-at"="REG_SZ", ""       "ie-pid"="REG_SZ", ""       "ie-ver"="REG_SZ", "11.0.9600.17914"       "iid"="REG_SZ", "00000000-0000-0000-0000-000000000000"       "itm"="REG_SZ", "2015-08-06T06:56:18Z"       "nf-at"="REG_SZ", "2360C1D0-57AD-B235-EEB9-DEAC6931556F"       "nf-pid"="REG_SZ", "F92623A0-FD0F-4A70-9EA5-98F528E8A056"       "nid"="REG_SZ", "7D5BAFA9-43AD-43BF-9BAE-D2823A38F2CB"       "osn"="REG_SZ", "Windows 7 Ultimate"       "ost"="REG_SZ", "x64"       "osv"="REG_SZ", "6.1.7601"       "user_sid"="REG_SZ", "S-1-5-21-612512518-1730918975-1677248042-1002"       "ver"="REG_SZ", "1.10.0.21"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tcfd_vt_1_10_0_21]       "DisplayName"="REG_SZ", "tcfd_vt_1_10_0_21"       "ErrorControl"="REG_DWORD", 1       "Group"="REG_SZ", "PNP_TDI"       "ImagePath"="REG_EXPAND_SZ, "system32\drivers\tcfd_vt_1_10_0_21.sys"       "Start"="REG_DWORD", 1       "Tag"="REG_DWORD", 10       "Type"="REG_DWORD", 1       "WOW64"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tcfd_vt_1_10_0_21\Enum]       "0"="REG_SZ", "Root\LEGACY_TCFD_VT_1_10_0_21\0000"       "Count"="REG_DWORD", 1       "NextInstance"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tcsvc_1.10.0.21]       "Description"="REG_SZ", "This service enables TermCoach 1.10.0.21 on HTTP websites"       "DisplayName"="REG_SZ", "TermCoach 1.10.0.21 Client Service"       "ErrorControl"="REG_DWORD", 1       "ImagePath"="REG_EXPAND_SZ, ""C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe""       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 2       "Type"="REG_DWORD", 16       "WOW64"="REG_DWORD", 1

Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 06/08/2015Scan Time: 09:06Logfile: mbamTermCoach.txtAdministrator: YesVersion: 2.1.8.1057Malware Database: v2015.08.06.01Rootkit Database: v2015.08.04.01License: PremiumMalware Protection: DisabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: {username}Scan Type: Threat ScanResult: CompletedObjects Scanned: 329621Time Elapsed: 4 min, 19 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 1PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe, 1936, Delete-on-Reboot, [b7e2d2334942d06690ec85fa669f8080]Modules: 0(No malicious items detected)Registry Keys: 4PUP.Optional.TermCoach.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\tcsvc_1.10.0.21, Quarantined, [b7e2d2334942d06690ec85fa669f8080], PUP.Optional.TermCoach.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\TermCoach_1.10.0.21, Quarantined, [b7e21ee763287bbb027a5b24897c4cb4], PUP.Optional.TermCoach.A, HKLM\SOFTWARE\WOW6432NODE\TermCoach_1.10.0.21, Quarantined, [d7c27f865f2cca6cb9d90ba24fb531cf], PUP.Optional.Vitruvian.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCFD_VT_1_10_0_21, Quarantined, [7722ae57701baf874990921784809f61], Registry Values: 2PUP.Optional.Vitruvian.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\tcfd_vt_1_10_0_21|ImagePath, system32\drivers\tcfd_vt_1_10_0_21.sys, Quarantined, [7722ae57701baf874990921784809f61]PUP.Optional.Vitruvian.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\tcsvc_1.10.0.21|ImagePath, "C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe", Quarantined, [376260a56b20e4526892c8d72adae21e]Registry Data: 0(No malicious items detected)Folders: 3PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21, Delete-on-Reboot, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Service, Delete-on-Reboot, [dabf7293771438fef235848d7e859b65], Files: 18PUP.Optional.TermCoach.A, C:\WINDOWS\SYSTEM32\drivers\tcfd_vt_1_10_0_21.sys, Delete-on-Reboot, [bea1e754ee46eca66fd9ab5af04ba6e3], PUP.Optional.TermCoach.A, C:\WINDOWS\SYSTEM32\drivers\tcfd_vw_1_10_0_21.sys, Delete-on-Reboot, [b29ab4fc3efa6b8a54f7621f57e10396], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe, Delete-on-Reboot, [b7e2d2334942d06690ec85fa669f8080], PUP.Optional.TermCoach.A, C:\Users\{username}\Desktop\TermCoach.exe, Quarantined, [3e5bd233117a4ee87309e699b2539c64], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\Uninstall.exe, Quarantined, [b7e21ee763287bbb027a5b24897c4cb4], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, Quarantined, [5c3d6f96eba0999d4800e0b405ff1fe1], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-install-v0003, Quarantined, [2d6c3dc87a1141f565e39df71be99b65], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-processes-v0002, Quarantined, [2c6d27de6823f34397b1d4c0749039c7], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, Quarantined, [eaaf8085cebde2542b1d336118ecab55], PUP.Optional.Vitruvian.A, C:\Users\{username}\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, Quarantined, [3e5bec196427979f5aeebdd7b94b30d0], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\terms-of-service.rtf, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\buildcrx-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\Info-ZIP-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\JSON-simple-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\nsJSON-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\Nustache-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\TaskScheduler-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65], PUP.Optional.TermCoach.A, C:\Program Files (x86)\TermCoach_1.10.0.21\3rd Party Licenses\UAC-license.txt, Quarantined, [dabf7293771438fef235848d7e859b65], Physical Sectors: 0(No malicious items detected)(end)

As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.