Nicenfree

Posted: February 17, 2015

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	1,670

First Seen:	February 17, 2015
Last Seen:	May 9, 2023
OS(es) Affected:	Windows

NiceNFree, also known as nicEnfree, is a browser add-on that displays advertisements in browsers such as Internet Explorer and Firefox. Bundled installers that include more than one program are common sources of NiceNFree installations, which may generate third party content. You should consider deleting NiceNFree with an appropriate anti-adware or anti-malware solution in preference over other options for its removal. Until you do so, malware experts would advise you to avoid any contact with suspicious in-browser advertisements.

The NiceNFree that Came Freely – but not So Nicely

NiceNFree is installed to Internet Explorer as a Browser Helper Object or BHO, and to Firefox as a standard extension. In neither case does NiceNFree attempt to hide itself from its users, and you can view NiceNFree's installation from your browser's standard add-on menus. Although malware experts verified NiceNFree as not being a threat, NiceNFree does include characteristics of being a Potentially Unwanted Program that has limited or no advantages for its user base.

NiceNFree generates advertising content in either IE or Firefox by injecting modifications into the browser's HTML pages. These advertisements may interfere with your normal Web-surfing activities in various ways, such as blocking navigation menus, and also risk exposing you to potentially threatening content. With respect to the latter category, malware experts have found phishing tactics, and software update hoaxes (a subset of other attacks) may be some of the most common hazards seen in adware advertisements. Like the majority of adware, NiceNFree doesn't provide controls for disabling its advertisements. However, NiceNFree does provide labels for its advertisement content, which should allow any unwilling users of NiceNFree to identify its presence without any significant trouble. Most users report installing NiceNFree unintentionally during a bundled installation with other software. These bundles may be responsible for introducing additional PUPs not mentioned in this article, and, so far, have no histories of disclosing their distribution of NiceNFree.

A Nice Way out of a Bad Browser Bargain

While you should uninstall NiceNFree from most PCs, malware experts can provide extensive records of NiceNFree using semi-random file names to hide some of its components, such as adttkovxka4mox.x64.dll, 0uucawah47xpsl.x64.dll or l1nimj5kdomsrk.x64.dll. Since NiceNFree has no guarantees of removing all of these files through a normal uninstall process, you should consider using anti-adware products to remove NiceNFree thoroughly. Terminate all browser processes from memory before doing so, and, when available or appropriate, use Safe Mode during any system scans.

NiceNFree very frequently is identified as a variant of Adware.Multiplug. Unfortunately, a majority of PC security products have yet to develop individual database entries for NiceNFree, which results in NiceNFree being found as a generic PUP. In some cases, malware experts conclude that one can leave certain PUPs to the discretion of their users. However, any software that survives by installing itself automatically should be distrusted as a source for advertising content of any type.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%PROGRAMFILES(x86)%\nicenfrree\lqoniqxSzXkfah.x64.dll

File name: lqoniqxSzXkfah.x64.dll
Size: 699.9 KB (699904 bytes)
MD5: 96af92edbd7bfe45b217f680695d0d94
Detection count: 38
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\nicenfrree
Group: Malware file
Last Updated: February 17, 2015

%ALLUSERSPROFILE%\nicenfRee\qVRGwPEjz0xGIA.x64.dll

File name: qVRGwPEjz0xGIA.x64.dll
Size: 693.76 KB (693760 bytes)
MD5: bc91c57a76b063c03c9e401ae992cdf4
Detection count: 16
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\nicenfRee
Group: Malware file
Last Updated: February 17, 2015

%PROGRAMFILES%\nicenfrEei\e28TOr5wjilthu.dll

File name: e28TOr5wjilthu.dll
Size: 560.12 KB (560128 bytes)
MD5: ec182759fee025cd41838d47af5dbd55
Detection count: 14
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\nicenfrEei
Group: Malware file
Last Updated: February 17, 2015

%PROGRAMFILES%\nicenFRee\Q9DJ9n8pu0lK6O.dll

File name: Q9DJ9n8pu0lK6O.dll
Size: 560.12 KB (560128 bytes)
MD5: c78061fa7da05714b422e37496fdfd10
Detection count: 7
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\nicenFRee
Group: Malware file
Last Updated: February 17, 2015

%ALLUSERSPROFILE%\nicenfoRRee\BGVqF4Y9chb9al.x64.dll

File name: BGVqF4Y9chb9al.x64.dll
Size: 706.56 KB (706560 bytes)
MD5: 4e312d6fa6ce92a5cd5c19abfd61f532
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\nicenfoRRee
Group: Malware file
Last Updated: February 17, 2015

C:\Users\<username>\appdata\roaming\mozilla\firefox\profiles\user.default\extensions\g@laelejb.com\install.rdf

File name: C:\Users\<username>\appdata\roaming\mozilla\firefox\profiles\user.default\extensions\g@laelejb.com\install.rdf
MD5: e7b3e72303bc5fda8f01818fded4669d
Mime Type: unknown/rdf
Group: Malware file

Additional Information

The following directories were created:

%ALLUSERSPROFILE%\nicenfree%PROGRAMFILES%\nicenfree%PROGRAMFILES(x86)%\nicenfree