Does this sound like your story? You see pop-up ads from ain.couptwo.com while browsing websites that typically don’t advertise in pop-up windows. The pop ups manage to escape the built-in pop-up blockers in Google Chrome, Mozilla Firefox, Internet Explorer, Safari or Opera. Maybe the ain.couptwo.com pop-ups show up when clicking search results from Google? Or does the pop-ups appear even when you’re not browsing?

Here’s how the ain.couptwo.com pop-up looked like when I got it on my system:

Does this sound like your system, you probably have some adware installed on your computer that pops up the ain.couptwo.com ads. So there’s no idea contacting the owner of the site you were browsing. The advertisements are not coming from them. I’ll do my best to help you with the ain.couptwo.com removal in this blog post.

Those that have been reading this blog already know this, but for new visitors: Not long ago I dedicated some of my lab machines and wilfully installed a few adware programs on them. Since then I have been tracking the behaviour on these systems to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it downloads and installs additional unwanted software on the computers. I first noticed the ain.couptwo.com pop-up on one of these lab machines.

ain.couptwo.com resolves to 208.43.241.247. ain.couptwo.com was created on 2014-09-18.

So, how do you remove the ain.couptwo.com pop-up ads? On the machine where I got the ain.couptwo.com ads I had TinyWallet, BrowserWarden and BlockAndSurf installed. I removed them with FreeFixer and that stopped the ain.couptwo.com pop-ups and all the other ads I was getting in Firefox.

BlockAndSurf was the adware that caused the pop-ups in my case.

The problem with this type of pop up is that it can be popped up by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

Anyway, here’s my suggestion for the ain.couptwo.com ads removal:

1. What software do you have installed if you look in the Add/Remove programs dialog in the Windows Control Panel? Something that you don’t remember installing yourself or that was recently installed?
2. You can also review the add-ons you installed in your browsers. Same thing here, do you see anything that you don’t remember installing?
3. If that didn’t solve the problem, you can give FreeFixer a try. FreeFixer is built to assist users when manually tracking down adware and other types of unwanted software. It is a freeware utility that I’ve been working since 2006 and it scans your system at lots of locations where unwanted software is known to hook into your computer. If you would like to get additional details about a file in FreeFixer’s scan result, you can just click the More Info link for that file and a web page with a VirusTotal report will open up, which can be very useful to determine if the file is safe or malware:

   

Here you can see FreeFixer in action removing the adware that caused the ain.couptwo.com pop-up ads:

Are you a Mac or Linux user and get the ain.couptwo.com popups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thank you very much!

Did you find any adware on your machine? Did that stop the ain.couptwo.com ads? Please post the name of the adware you uninstalled from your machine in the comment below.

Thank you!

Update 2014-12-18: I’ve been documenting this type of pop-ups. I’m calling them “Coup Pop-Ups“, since they often use “Coup” in the domain name. For example, couptwo.com and coupthree.com. But what about one, four, five, six, etc? I think the following domains are registered by the same company, and that we might see them in pop-ups in the future:

• CoupFive.com
• CoupSix.com