Adware.FrameFox
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 15,166 |
| Threat Level: | 20 % (Normal) |
| Infected Computers: | 22,113 |
| First Seen: | December 23, 2013 |
| Last Seen: | October 24, 2025 |
| OS(es) Affected: | Windows |
Framefox is a Web browser extension that may have numerous unwanted effects on affected computer systems. Although security researchers have classified Framefox as a Potentially Unwanted Program, there are extremely harmful characteristics associated with Framefox, including the fact that Framefox is developed by Duuqu, which may be associated with Duqu. Duqu was associated with high profile attacks on various targets in 2011 as well as with the infamous Stuxnet, one of the most well-known threats in recent years. Although specific damaging intentions have not been observed in the case of Framefox, security researchers strongly recommend removing and avoiding Framefox immediately to prevent other threats or PUPs from making their way into the affected computer.
Table of Contents
Understanding How Framefox is Distributed
There are several ways in which Framefox may be distributed. Framefox and similar PUPs may be distributed using the following methods:
- Framefox may be installed as a Web browser extension and is commonly bundled with low quality freeware. Even though PC users may opt out of the installation of Framefox, not paying attention to the installation process may allow marketers to install PUPs like Framefox on the affected Web browser. You can prevent this from happening by monitoring carefully all new software installations and opting out of installing unwanted components like Framefox.
- Framefox may be distributed using social engineering techniques. In most cases, these consist in tricking inexperienced computer users into believing that Framefox is a useful Web browser extension and then prompting them to download and install Framefox by themselves. It is important to know that social engineering is an essential part of most modern threats and that most other threat distribution methods may involve social engineering to some degree (for example, spam email messages with corrupted attachments may use social engineering strategies to trick inexperienced computer users into opening the attached files).
- Framefox may also be distributed through email, social media, or instant messaging spam. These messages may contain risky attachments that, when opened, install Framefox on the affected Web browser.
SpyHunter Detects & Remove Adware.FrameFox
File System Details
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | framefox.exe.vir | 6017ca94be482bcb527d92c6d481b2cc | 16,777 |
| 2. | FrameFoxSetup.exe | cfdfb01c8f4cc858dd098aaea145c5e1 | 6 |
| 3. | FrameFox_1909-357c9206.exe | f69ab43eb987667d54518527148c5528 | 5 |
| 4. | framefox.exe | 112c2f2558abf9fb8dd77881b8f865ac | 2 |
Registry Details
Directories
Adware.FrameFox may create the following directory or directories:
| %ProgramFiles%\FrameFox |
| %ProgramFiles(x86)%\FrameFox |
| %Windir%\Installer\{33ECC890-C480-4124-B95B-BA36E025B120} |
URLs
Adware.FrameFox may call the following URLs:
| FrameFox |
