Okay. I decided to uninstall this program. It did not remove the Firefox extension. I have it disabled. It left many traces in the registry which I have removed one by one. Hopefully I have all this crap removed. I may uninstall Firefox and reinstall it to see if I can get rid of that plugin. I'm inclined to believe Soundfrost is wrought with spyware.
Adware problems since installing SoundFrost? - FIX's now documented see pg 2
(62 posts) (27 voices)-
Tigrisan
MemberI looked at this program yesterday and after a lot of consideration, did not install it only because I didn't feel I would use it enough to justify it. However, I'm only asking this question because I read all the time that it is the cureall for almost any program with rogue elements inadvertently installed.
Has anyone used the system restore to a point prior to installing the program and still had the same problems once they rebooted?
Also, Geek Uninstaller is a free program that is the best I've found at uninstalling even hidden programs but allows you to search for items as well. I don't know if it will help in this case, but I'm just mentioning it.
Posted 11 years ago # -
1dustpelt
MemberA few days after I installed SoundFrost, Bing and Google links have been redirecting to random sites on Firefox. My GOTD download button was also changed to a green button as others have mentioned.
I have realized that this only affects the following browsers:
Mozilla Firefox
Google Chrome
Comodo DragonMy Internet Explorer 10 has been working just fine as normal. This is because that their malware browser extension is not compatible with it.
Posted 11 years ago # -
afawley
Elric of MelnibonéI wondered what was causing me to go to pages when I clicked on normal links, including GOTD. After reading WhiteRabbit's post about it being Soundfrost I checked and sure enough it had added a plugin to my Firefox will check out my other browsers. This is the first time I have ever had a problem with anything I got from GOTD.
Posted 11 years ago # -
gonwk
MemberHi folks,
I thought WhiteRabbit and GOTD Team always Claim that Programs Offered have always been checked Thoroughly and have NOOO MALWARE what-so-ever! So, What Happened!
But I have to give it to WR and GOTD that at least they are WARNING people in a Timely Manner so at least their PCs and Accounts don't get Toasted.
G!:)
Posted 11 years ago # -
Reality Check
MemberI've noticed a huge problem with both IE and FF redirecting to all sorts of random ad sites. I also notice that whenever I do a search on google or bing, my browser opens
AN ADDITIONAL TAB FOR something called hotstartsearch.com.I've had IE freeze up and crash so much on me since then that I've been using Firefox almost exclusively now. I would be using Firefox right this minute except I'm downloading the update to the newest version to see if installing the newest version will help stop any of the problems I'm having.
The developer responsible for this current malware problem is more shrewd and their malware is more clever than most malware is at hiding itself.
I already had Microsoft Security Essentials on my laptop. It regularly updates itself and runs regular scans. IT'S SCANS TURNED UP CLEAN BEFORE AND AFTER THE PROBLEMS STARTED.
Since the problems started, I installed and ran Malware bytes. After that I installed and ran Spybot Search & Destroy. Both programs are generally very good at finding and eliminating malware.
Scans with Malwarebytes and Spybot Search and Destroy TURN UP CLEAN IN SPITE OF THESE PROBLEMS!
I also ran Ccleaner and had it thoroughly clean my laptop including browser caches etc. That failed to stop the problem.Following advice on Microsoft's security forums, I downloaded & tried Adwcleaner, Hitman Pro 64x, and WiseCare 365. (Each was downloaded after the prior application failed to fix the problem, I didn't download and run them all at the same time, for those of you who may be wondering...)
Adwcleaner claimed to find some problems and also claimed to have eliminated them, but did NOTHING to fix the problem. I also downloaded and activated the trial of Hitman Pro x64. It too claimed to find some problems, claimed to have successfully eliminated them, BUT THE PROBLEMS ALL MENTIONED ABOVE STILL PERSIST.Perhaps these malicious things that were likely sneaked into SoundFrost or other giveaway offered at about the same time. It's HIGHLY irregular for Microsoft Security Essentials, MalwareBytes, Spybot, Adwcleaner, Hitman Pro, etc ALL to fail to eliminate the malware. Off topic, does anybody else HATE it that Spybot changed its interface so you cannot access and view all the individual BHOs etc and delete unwanted BHOS etc anymore? With the older versions of Spybot, in advanced mode I was able to recognize and delete a number of troublemaker BHOs.
If a developer was able to sneak malicious apps past so many antivirus/antimalware/antispy etc progs them I'm sure they also could program the malware to start running at a later time instead of immediately running after installation. This would make it much more difficult to pinpoint the source of the malware and result in someone else getting the blame for the malware too.
If anybody finds something successful in removing these malicious troublemakers, please let everyone else know what finally worked to get rid of them.
Posted 11 years ago # -
CineDOG
MemberBefore download and run any malware killer, stop running soundfrost at the process list!
Soundfrost killed my Chrome any IE8. Working good only Opera web browser.
And this is real true:
I'm sure they also could program the malware to start running at a later time instead of immediately running after installation. This would make it much more difficult to pinpoint the source of the malware and result in someone else getting the blame for the malware too.
Posted 11 years ago # -
Antikitira
MemberWiterabbit
I had a problem on the site of Giweaway in which a pop up is not allowed to access the button “Go to the download page”, except after several attempts trying to be the fastest of adware.
In addition, another pop up on the page of ebay.it
I seem to have solved it by deleting the library soundfrost.dll.Posted 11 years ago # -
mikiem2
ModeratorI can't say I'll get to it, but if I have a chance I'll try to do some more extensive testing in my VMs, though anyone could play with this -- wouldn't be hard... Myself, I'd start with a fresh VM & add [but not run] Soundfrost, disable the group policy changes, enable the strictest browser settings, & disable the browser helper, monitoring the registry etc. to see what happened when I went online. Then I'd enable the helpers, & try the same thing.
OK, earlier I posted what I wanted to do... I restored my XP Mode VM, got Soundfrost working in it, tested it out, monitoring use of Internet Explorer & Soundfrost -- everything worked fine, though I couldn't figure out what good the plug-ins/add-ons did, or what they were for. Then I fired up Timefreeze, & unblocked the IP 217.23.8.104 Soundfrost wanted to connect to -- you need to connect to it for help, FAQ etc. as that's the Soundfrost.org site. Now the plug-in took effect, substituting links & link buttons on web pages visited, sometimes with hard coded links, sometimes with Flash buttons so you don't know where they're going. It would appear the plug-in gets instructions from that IP address, not doing much otherwise, with nothing unusual noticed running Soundfrost &/or Internet Explorer monitoring with Process Explorer &/or InstallWatch Pro whether the IP was blocked or not. Nothing was added, & no registry or other changes were made. Afterwards I ran a complete scan with Microsoft Security Essentials beta & it didn't find anything.
FWIW That's all the factual data I can report -- anything else is, would be a guess. I'd find it odd if the devs behind Soundfrost set their servers up to instruct their plug-in to do bad things, but they might have set it up to use SmartSuggester & got hacked themselves? Or SmartSuggester might have gotten hacked? I'd find it odd because SoundFrost had decent reviews, & it'd seem silly to throw all that away for a one-shot attempt at infamy, but like anything else it's possible. That's not to say having a plug-in that redirects via SmartSuggest is great, but like any of the more common toolbars & such, there is a difference between that sort of thing and a virus or root kit. And disabling a plug-in is not hard -- it's easier than getting rid of a toolbar.
I did not see any evidence of SoundFrost adding anything bad, be it a keylogger or anything else -- if someone got anything like that perhaps it's from clicking on one of the replaced links? That's not to say that all the SoundFrost code is clean -- they'd have to submitt their source to whatever security experts to parse through for anyone to know 100% -- but rather it didn't do anything like that when I was monitoring it.
Posted 11 years ago # -
mikiem2
Moderator"today, i realised that a extension had been added by SoundFrost to chrome that was doing this.
THIS IS NOT ACCEPTABLE !
If they have BAD REPUTATION, it is obvious !
Hijacking web page buttons by any company is DEFINITELY something that should blacklist a company.
GOTD Team should POST a warning to ALL USERS that this happened and not ignore something like this.""Soundfrost has a keylogger and screenlogger on it and they did it in purpose. "
" I use Firefox and found that SoundFrost installed an extension add-on to Firefox that was the culprit. I disabled it and that stopped the redirects. It also installed a BHO and Run item that HijackThis detected. I removed those. If I find anymore malware from this program, I'm removing it and all traces of SoundFrost."
You may not like things like toolbars & plug-ins, but they're a fact of life nowadays -- look through all the game discussions & warnings that some installs [not from GOTD] will often ask you to install a helper or toolbar etc., the difference being Soundfrost didn't give the option to decline. It's not great, but it's not a virus or mal-ware either, e.g. I'd hardly call the Bing Bar from Microsoft mal-ware. And while it might be nice to think about toolbars & resetting home pages could be banned, you'd then have to ban a pretty large percent of the shareware & freeware available -- that's how & why it's free in many cases.
"Okay. I decided to uninstall this program. It did not remove the Firefox extension. I have it disabled. It left many traces in the registry which I have removed one by one. Hopefully I have all this crap removed. I may uninstall Firefox and reinstall it to see if I can get rid of that plugin."
If you want to see what changes are made to Windows by adding SoundFrost, best way AFAIK is to monitor the installation in a safe environment, e.g. a VM or with a virtualization app running etc. In an earlier post I listed the CLSIDs etc. to search on in Regedit if you want to take my word for it. That said, it didn't make *that* many changes, didn't add that many registry entries. Whether removing Firefox would remove the plug-in is hard to say unless you monitor installation in Windows with F/Fox installed, which sadly I didn't. Autoruns should be able to pinpoint it though for you.
"I thought WhiteRabbit and GOTD Team always Claim that Programs Offered have always been checked Thoroughly and have NOOO MALWARE what-so-ever! So, What Happened!"
As far as anyone has been able to tell so far, Soundfrost contains zero mal-ware. In fact I expect it's been virus scanned by now more than most any app, ever. What's happening as far as I can tell is people are having their browsers re-directed to pages that aren't safe, but the instructions to redirect to those sites are on-line themselves -- as far as has been reported, unless or until you download & run something bad there is no mal-ware from Soundfrost on your system. That's why blocking 217.23.8.104 would work -- it can't get any directions on what to redirect to.
The developer responsible for this current malware problem is more shrewd and their malware is more clever than most malware is at hiding itself.
Not necessarily -- if their plug-in did something like reported the page you were viewing back to a server running SmartSuggestor, then received a url back with a modified page, there's nothing at that point added or modified, & so nothing for any AV app to find.
"If anybody finds something successful in removing these malicious troublemakers, please let everyone else know what finally worked to get rid of them."
Simply disable the browser plug-in. Blocking access to 217.23.8.104 also seems to work. Removing the plug-in itself would work, as would removing the helper in the registry -- Autoruns can help do both. Note that if you downloaded & ran an exploit because of the plug-in, removing or disabling the plug-in won't get rid of that exploit or anything it's done.
Posted 11 years ago # -
Idunnobutiwastold
Gaming AcolyteIn a fit of desperation, I used Revo Uninstaller set to the aggressive "Advanced" mode to uninstall SoundFrost. The third-party uninstaller found some registry entries, which I promptly deleted.
I do not know if deleting those entries will negatively impact other programs on my PC; so if you choose this route, proceed with caution.I also deleted
SoundFrost.dllandSoundFrost.xpithat were located inC:\Programs Files\SoundFrost
As far as I can tell, this appears to have worked for me, without rebooting the computer.As a side note, I'm inclined to agree with Mikiem2's suggestion.
[The developers] might have [gotten] hacked themselves?
Posted 11 years ago # -
mikiem2
ModeratorThe third-party uninstaller found some registry entries, which I promptly deleted.
I do not know if deleting those entries will negatively impact other programs on my PC; so if you choose this route, proceed with caution.I monitored the install, activation, & 1st run with InstallWatch Pro in my XP Mode VM for both the trial & GOTD downloads. If you're interested, in an earlier post I listed everything I found in my records to search on in regedit to find the added keys, e.g. 081524f7-7ed8-43ff-b01e-915c410a9cbe might show up in a few places with the GOTD version.
That said, what bothered me, & still bothers me more are the changes to Windows Group Policy. Deleting the Soundfrost folder should take care of things because I didn't record any files added anywhere else, & the registry can call or try to start whatever it want, if the file's gone it can't very well do anything. I'm afraid changing Group Policy could loosen security enough that something else might slip by in the future.
Posted 11 years ago # -
Idunnobutiwastold
Gaming AcolyteThanks Mikiem2.
I'll take a closer look at the listing you posted and the other changes mentioned.EDIT: By the way, uninstalling SoundFrost from my PC did not get rid of the re-direction problems.
EDIT 2: Rebooting, running Ccleaner and disabling the Soundfrost Extension in Chrome seem to have helped.
Posted 11 years ago # -
Shauna
MemberAs I mentioned way back in the beginning of Page 1, disabling the SoundFrost extension in Chrome, IE and Firefox has removed all links and redirect issues. I have continued to use SoundFrost without it re-enabling or having any more issues so if you have installed and like the program, just disable the extensions and you should be fine.
Posted 11 years ago # -
mikiem2
ModeratorIf it helps...
The browser plug-in/add-on/helper should be SoundFrost.dll with registry keys listing CLSID 081524f7-7ed8-43ff-b01e-915c410a9cbe for the GOTD, d997c836-ff82-4519-b459-1482ba942a4f for the trial -- search for those in Regedit.. Look for C:\WINDOWS\system32\GroupPolicy\User\Registry.pol -- it may be under SysWOW64 in 64 bit Windows rather than System32 -- & C:\Documents and Settings\UserName\ntuser.pol -- it may be under Users\ UserName in Vista/7/8 -- you probably didn't have those before & can delete them but if you want to be safest move or rename them to something like .po_ -- you can also open them in Notepad & compare them to what Soundfrost added for me, & if you've got more than that try deleting the Soundfrost portion. Those .pol files should have added a registry value named "IgnoreFrameApprovalCheck"=dword:00000001 -- you don't want that... as I understand it that prevents the browser from telling you something's installing a plug-in. You might also block the IP the helper connects to, either with Windows Firewall, in your security software, or by editing Windows Hosts file -- for me that ip was 217.23.8.104
http://www.howtogeek.com/112564/how-to-create-advanced-firewall-rules-in-the-windows-firewall/
http://www.ehow.com/how_5422923_block-ip-address-computer.htmlTrial Added files -- GOTD same with no MyPrintScreen.exe [Firefox & Chrome not installed]C:\Documents and Settings\All Users\Desktop\SoundFrost.lnk 1KB A 5/20/2013 11:45:17 AM
C:\Documents and Settings\All Users\Start Menu\Programs\SoundFrost 1KB D
C:\Documents and Settings\All Users\Start Menu\Programs\SoundFrost\How to use SoundFrost.url 1KB A 5/20/2013 11:45:16 AM
C:\Documents and Settings\All Users\Start Menu\Programs\SoundFrost\SoundFrost.lnk 1KB A 5/20/2013 11:45:16 AM
C:\Documents and Settings\All Users\Start Menu\Programs\SoundFrost\Uninstall SoundFrost.lnk 1KB A 5/20/2013 11:45:17 AM
C:\Documents and Settings\XPMUser\ntuser.pol 1KB RHSA 5/20/2013 11:45:18 AM
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat 295KB A 5/20/2013 11:45:46 AM
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\52Y76SFS 1KB D
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\52Y76SFS\desktop.ini 1KB HS 5/20/2013 11:49:03 AM
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\ACKQDODE 1KB D
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\ACKQDODE\desktop.ini 1KB HS 5/20/2013 11:49:03 AM
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\RIVD6NMI 1KB D
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\RIVD6NMI\desktop.ini 1KB HS 5/20/2013 11:49:03 AM
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\RVVQ7NVF 1KB D
C:\Documents and Settings\XPMUser\Local Settings\Temporary Internet Files\Content.IE5\RVVQ7NVF\desktop.ini 1KB HS 5/20/2013 11:49:03 AM
C:\Documents and Settings\XPMUser\My Documents\Downloads 1KB D
C:\Documents and Settings\XPMUser\My Documents\Downloads\SoundFrost 1KB D
C:\Program Files\SoundFrost 1KB D
C:\Program Files\SoundFrost\ffmpeg 1KB D
C:\Program Files\SoundFrost\ffmpeg\avcodec-53.dll 5,711KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\avdevice-53.dll 19KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\avfilter-2.dll 379KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\avformat-53.dll 977KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\avutil-51.dll 145KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\ffmpeg.exe 133KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\ffprobe.exe 56KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\flac.exe 1,434KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libmp3lame-0.dll 347KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libogg-0.dll 70KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libpthread-2.dll 70KB A 5/30/2012 6:14:54 PM 2, 8, 0, 0
C:\Program Files\SoundFrost\ffmpeg\libtheora-0.dll 344KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libtheoradec-1.dll 112KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libtheoraenc-1.dll 286KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libvorbis-0.dll 184KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libvorbisenc-2.dll 1,635KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\libvorbisfile-3.dll 56KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\postproc-51.dll 39KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\swscale-2.dll 226KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\x264.exe 1,259KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\ffmpeg\xvidcore.dll 762KB A 5/30/2012 6:14:54 PM
C:\Program Files\SoundFrost\helper.dat 2KB A 5/20/2013 11:45:19 AM
C:\Program Files\SoundFrost\imageformats 1KB D
C:\Program Files\SoundFrost\imageformats\qgif4.dll 27KB A 11/26/2012 12:31:46 PM 4.8.4.0
C:\Program Files\SoundFrost\imageformats\qico4.dll 29KB A 11/26/2012 12:31:58 PM 4.8.4.0
C:\Program Files\SoundFrost\imageformats\qjpeg4.dll 202KB A 11/26/2012 12:31:44 PM 4.8.4.0
C:\Program Files\SoundFrost\imageformats\qmng4.dll 223KB A 11/26/2012 12:31:50 PM 4.8.4.0
C:\Program Files\SoundFrost\imageformats\qsvg4.dll 22KB A 11/26/2012 12:31:52 PM 4.8.4.0
C:\Program Files\SoundFrost\imageformats\qtga4.dll 20KB A 11/26/2012 12:32:00 PM 4.8.4.0
C:\Program Files\SoundFrost\imageformats\qtiff4.dll 288KB A 11/26/2012 12:31:56 PM 4.8.4.0
C:\Program Files\SoundFrost\libvlc.dll 112KB A 12/13/2012 2:12:58 AM 2.0.2
C:\Program Files\SoundFrost\libvlccore.dll 2,287KB A 12/13/2012 2:13:36 AM 2.0.2
C:\Program Files\SoundFrost\main.dat 17KB A 5/20/2013 11:49:08 AM
C:\Program Files\SoundFrost\msvcp100.dll 422KB A 6/11/2011 1:58:52 AM 10.00.40219.325
C:\Program Files\SoundFrost\msvcr100.dll 774KB A 6/11/2011 1:58:52 AM 10.00.40219.325
C:\Program Files\SoundFrost\MyPrintScreen.exe 232KB A 4/26/2013 4:20:58 PM
C:\Program Files\SoundFrost\plugins 1KB D
C:\Program Files\SoundFrost\plugins\access 1KB D
C:\Program Files\SoundFrost\plugins\access\libaccess_http_plugin.dll 92KB A 12/13/2012 2:13:04 AM
C:\Program Files\SoundFrost\plugins\audio_filter 1KB D
C:\Program Files\SoundFrost\plugins\audio_filter\liba52tofloat32_plugin.dll 69KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\liba52tospdif_plugin.dll 35KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libaudiobargraph_a_plugin.dll 42KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libaudio_format_plugin.dll 46KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libchorus_flanger_plugin.dll 40KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libcompressor_plugin.dll 43KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libconverter_fixed_plugin.dll 37KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libdolby_surround_decoder_plugin.dll 37KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libdtstofloat32_plugin.dll 183KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libdtstospdif_plugin.dll 37KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libequalizer_plugin.dll 47KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll 42KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libkaraoke_plugin.dll 35KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libmono_plugin.dll 43KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libmpgatofixed32_plugin.dll 136KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libnormvol_plugin.dll 38KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libparam_eq_plugin.dll 39KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libsamplerate_plugin.dll 1,519KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libscaletempo_plugin.dll 41KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libsimple_channel_mixer_plugin.dll 39KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libspatializer_plugin.dll 108KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libspeex_resampler_plugin.dll 47KB A 12/13/2012 2:13:20 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll 37KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_filter\libugly_resampler_plugin.dll 36KB A 12/13/2012 2:13:18 AM
C:\Program Files\SoundFrost\plugins\audio_mixer 1KB D
C:\Program Files\SoundFrost\plugins\audio_mixer\libfixed32_mixer_plugin.dll 35KB A 12/13/2012 2:13:24 AM
C:\Program Files\SoundFrost\plugins\audio_mixer\libfloat32_mixer_plugin.dll 34KB A 12/13/2012 2:13:24 AM
C:\Program Files\SoundFrost\plugins\audio_output 1KB D
C:\Program Files\SoundFrost\plugins\audio_output\libadummy_plugin.dll 35KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\audio_output\libamem_plugin.dll 37KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\audio_output\libaout_directx_plugin.dll 50KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\audio_output\libaout_file_plugin.dll 39KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\audio_output\libwaveout_plugin.dll 52KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec 1KB D
C:\Program Files\SoundFrost\plugins\codec\liba52_plugin.dll 41KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libadpcm_plugin.dll 43KB A 12/13/2012 2:13:28 AM
C:\Program Files\SoundFrost\plugins\codec\libaes3_plugin.dll 38KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libaraw_plugin.dll 52KB A 12/13/2012 2:13:24 AM
C:\Program Files\SoundFrost\plugins\codec\libavcodec_plugin.dll 9,264KB A 12/13/2012 2:13:28 AM
C:\Program Files\SoundFrost\plugins\codec\libcc_plugin.dll 45KB A 12/13/2012 2:13:28 AM
C:\Program Files\SoundFrost\plugins\codec\libcdg_plugin.dll 39KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libcrystalhd_plugin.dll 41KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libcvdsub_plugin.dll 41KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libddummy_plugin.dll 36KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libdmo_plugin.dll 55KB A 12/13/2012 2:13:24 AM
C:\Program Files\SoundFrost\plugins\codec\libdts_plugin.dll 44KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libdvbsub_plugin.dll 155KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libedummy_plugin.dll 34KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libfaad_plugin.dll 373KB A 12/13/2012 2:13:28 AM
C:\Program Files\SoundFrost\plugins\codec\libflac_plugin.dll 266KB A 12/13/2012 2:13:28 AM
C:\Program Files\SoundFrost\plugins\codec\libfluidsynth_plugin.dll 264KB A 12/13/2012 2:13:24 AM
C:\Program Files\SoundFrost\plugins\codec\libkate_plugin.dll 103KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\liblibass_plugin.dll 1,889KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\liblibmpeg2_plugin.dll 167KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\liblpcm_plugin.dll 44KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libmpeg_audio_plugin.dll 42KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libopus_plugin.dll 311KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libpng_plugin.dll 186KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libquicktime_plugin.dll 39KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\librawvideo_plugin.dll 38KB A 12/13/2012 2:13:24 AM
C:\Program Files\SoundFrost\plugins\codec\libschroedinger_plugin.dll 1,319KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libspeex_plugin.dll 155KB A 12/13/2012 2:13:24 AM
C:\Program Files\SoundFrost\plugins\codec\libspudec_plugin.dll 43KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libstl_plugin.dll 37KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libsubsdec_plugin.dll 47KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libsubsusf_plugin.dll 46KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libsvcdsub_plugin.dll 39KB A 12/13/2012 2:13:28 AM
C:\Program Files\SoundFrost\plugins\codec\libt140_plugin.dll 35KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libtheora_plugin.dll 387KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\plugins\codec\libtwolame_plugin.dll 155KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libvorbis_plugin.dll 1,720KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libx264_plugin.dll 1,216KB A 12/13/2012 2:13:30 AM
C:\Program Files\SoundFrost\plugins\codec\libzvbi_plugin.dll 1,399KB A 12/13/2012 2:13:32 AM
C:\Program Files\SoundFrost\QtCore4.dll 2,604KB A 2/4/2013 12:03:20 PM 4.8.4.0
C:\Program Files\SoundFrost\QtGui4.dll 8,577KB A 11/26/2012 10:46:22 AM 4.8.4.0
C:\Program Files\SoundFrost\QtNetwork4.dll 1,053KB A 11/26/2012 10:22:22 AM 4.8.4.0
C:\Program Files\SoundFrost\QtScript4.dll 1,342KB A 11/26/2012 10:56:52 AM 4.8.4.0
C:\Program Files\SoundFrost\QtWebKit4.dll 13,111KB A 11/26/2012 12:28:46 PM 4.9.3.0
C:\Program Files\SoundFrost\QtXml4.dll 357KB A 11/26/2012 10:21:24 AM 4.8.4.0
C:\Program Files\SoundFrost\SoundFrost.dll 90KB A 5/20/2013 11:45:18 AM 3.6.2.0
C:\Program Files\SoundFrost\SoundFrost.exe 1,784KB A 5/20/2013 3:00:46 PM
C:\Program Files\SoundFrost\SoundFrostService.exe 349KB A 5/20/2013 3:00:26 PM
C:\Program Files\SoundFrost\unins000.dat 34KB A 5/20/2013 11:45:17 AM
C:\Program Files\SoundFrost\unins000.exe 1,427KB A 5/20/2013 11:45:01 AM
C:\Program Files\SoundFrost\vlc-qt.dll 207KB A 2/4/2013 6:41:48 PM
C:\WINDOWS\system32\GroupPolicy\User\Registry.pol 1KB A 5/20/2013 11:45:17 AM
ntuser.pol contents in NotepadPReg [ S o f t w a r e \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s \ G r o u p P o l i c y O b j e c t s \ L o c a l G r o u p P o l i c y ; * * C o m m e n t : G P O N a m e : L o c a l G r o u p P o l i c y ; ; ; ] [ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x t ; I g n o r e F r a m e A p p r o v a l C h e c k ; ; ; ]
Registry.pol contents in NotepadPReg [ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x t ; I g n o r e F r a m e A p p r o v a l C h e c k ; ; ; ]
Posted 11 years ago # -
Mavadelo
Memberthe culprit is definately soundfrost.dll, already had the program uninstalled (installed from giveaway...NOT the trial) but had the browser addon s for chrome and internet explorer still there but in chrome disabled (I never use internet explorer unless I have no choice)
I enabled the extension and immidiatly my browser acted weird with the advertisements randomly inserted etc as described by others already, after disabling it again and reloading same page the effects disappeared/Checked Internet Explorer and had the same weird links, checked extensions and lo and behold... soundfrost was there and enabled. could not disable it from within the extension screen but it made me look in my all programs folder and there ws the soundfrost folder with the soundfrost.dll though I am sure Iobit Uninstaller should have removed it after uninstalling soundfrost. Manually removing seems to have done the trick although I have to check after my next reboot.
For Windows 8 users.... did anyone noticed problems with the update function (both system and apps) like not able to connect to the update server although the app store displayed fine? Because I had that problem and it disappeared as well after removing said folder.
Posted 11 years ago # -
ip
MemberIf I had any problems since installing Soundfrost? Well...
* The link http://www.giveawayoftheday.com/Flower-Clock-3D-Screensaver is absent from the page http://www.giveawayoftheday.com so I have had to guess its URL from the text "Flower Clock 3D Screensaver"
* All original advertisement from the page http://www.giveawayoftheday.com disappers and instead of the link mensioned above there is a blinking advertizement that in enlish translation (from swedish) says "This is no joke. You are our 100 000 visitor. Click here!"
* On the page http://www.giveawayoftheday.com/Flower-Clock-3D-Screensaver/ the big advertizement (for an aqarium screensaver) disappeares within a fraction of a second.
* Links are changed to a page that says they are redirected, then the browser is redirected to pages belonging to domains: globalget.net gget.net tlbsearch.com ask.com admarketplace.net
Posted 11 years ago # -
CineDOG
Memberwords, words, words.... soundfrost got something bad. If you really can uninstall, and delete all the things what this program bring us our computer and in our web browser, the problem will end. No more gget.net and other link or banner or button changing.
Soundfrost is not a reliable software. I dont know its got a backdoor or just got a malware.
But must 100% delete from our computers.Posted 11 years ago # -
mikiem2
ModeratorChecked Internet Explorer and had the same weird links, checked extensions and lo and behold... soundfrost was there and enabled. could not disable it from within the extension screen but it made me look in my all programs folder and there ws the soundfrost folder with the soundfrost.dll though I am sure Iobit Uninstaller should have removed it after uninstalling soundfrost. Manually removing seems to have done the trick although I have to check after my next reboot.
Apparently if you've got other browsers besides Internet Explorer installed soundfrost.dll may have been copied to their folders -- wouldn't hurt to search your drive/partition to make sure you got them all. Not sure it's necessary by any means, but when you're talking about a potential mal-ware threat, everyone has to decide for themselves how much effort is too much. Early on I posted a few links re: drive-by exploits -- while no one has so far posted evidence that Soundfrost is doing more than re-directing browsers, even if you didn't download anything with the plug-in enabled it wouldn't hurt to do an AV scan as well, just in case something snuck by while one of those altered pages was open in your browser. As far as the Iobit Uninstaller goes, please don't think any uninstaller is perfect by any means. Double checking & going about it manually when/if necessary was very much the right thing to do IMHO.
For Windows 8 users.... did anyone noticed problems with the update function (both system and apps) like not able to connect to the update server although the app store displayed fine? Because I had that problem and it disappeared as well after removing said folder.
Win8 & the latest Internet Explorer have more security features than earlier versions, & my guess is it just blocked everything when it detected something amiss.
"words, words, words.... soundfrost got something bad. If you really can uninstall, and delete all the things what this program bring us our computer and in our web browser, the problem will end. No more gget.net and other link or banner or button changing.
Soundfrost is not a reliable software. I dont know its got a backdoor or just got a malware.
But must 100% delete from our computers. "Yes, there's a little repetition, but that's true in many threads in many forums -- that's just the way it is I guess. Some of the discussion I think is because many people like Soundfrost, & would like to keep using it but without the problems -- while you're right, that the problems go away if you undo all the changes installing Soudfrost made, some people would like to keep the program itself. Others I think might be unsure just how to make it all go away, since apparently a simple uninstall won't always do that.
Posted 11 years ago # -
Whiterabbit-uk
Games GuruThat's odd, one of my posts seems to have disappeared. ?when i try to see the two that have been deleted (I'm able to do that as an admin), I still can't see them. I posted shortly after Mikiem did on the first page saying that there are usually upwards of 50 thousand downloads, so the numbers reporting this (at the time on several community members), it would seem reasonable to assume that it may not be Sound Frost, tohugh since i posted a lot more community members have joined it.
I've deleted the program, but not finished clearing out my computer and registry. will report back once i've done it to let you know whether I my computer is cured. :)
Posted 11 years ago # -
ibwebb
MemberI want to apologize for taking so long to came back. I wanted to make sure that I had really found something that fixed it. My friend .... the anonymous one.. we will call him 'Steve' just for a name. Anyway, he has many many years of programming and IT that he does professionally. He told me it was hokey and was looking at all of it. FIRST AND FOREMOST I want to stress.. STRESS that he said this DID NOT look like something that SoundFrost would have known about and he said that he REALLY REALLY doubted that GOTD would have been able to find it unless they had time and access to crawl through the code. Steve believes that besides us there are probably others that have unfortunately gotten this do to a hacker attack... per say ... in theory. So, you have the main program, the add on to any and all internet browsers you have and several reg entries (at least). Here is what he had me do and it cleared it up and cured (I believe) me:
First run a scan from your Antivirus. I have AVG. Then something like CCleaner and/or I have Advance SystemCare 6 that he highly recommended (he had me run both, but run what you have that might be an equivalent). Then it was suggested to run Malwarebytes (sp?) and lastly.. and this on took some time and stuck waiting for .. it is an online antivirus scan. You DO NOT have to buy anything and after it scans it DOES clean up/destroy any problems. It is call 'ESET'. It took my very larfe HD about 5 hours (I let it scan EVERYTHING). My fiancee let it scan all of hers and it took only about an hour. After it is done it does ask if you want to buy the program, but if you say no then it uninstalls itself and all is good in the world. I would give you the link to 'eset' but I believe it is against rules here to pass on .com addresses but I am sure that you can figure out that the .com for ESET is easy to find.
Best wishes to all!
ibwebbPosted 11 years ago # -
mikiem2
ModeratorI've deleted the program, but not finished clearing out my computer and registry. will report back once i've done it to let you know whether I my computer is cured.
Once you get things squared away, WR, I know you like the app, so if you want I can PM or otherwise try to get you what you need to run it without the plug-ins etc.
Posted 11 years ago # -
Whiterabbit-uk
Games GuruNice one mikiem. Thanks.
Not finished sorting the problem out. I've been so busy with the new house and all the latest game releases that I've been selecting my old Win 7 installation, which was installed with what turned out to be a non genuine key (took Microsoft nearly 18 months to tell me after initially validating it - which in turn prompted me to purchase another 3 or 4 keys, all of which turned out to be rip offs).
It still works but I get reminders every 20 mins or so that the installation isn't using a genuine key; otherwise it works fine and I don't get any of the constant browser redirects and pop ups that i now get on my Win 8 installation becasue of Sound Frost.
I'll get it sorted soon hopefully. I've got a few other 'personal' issues to sort at the moment.
Posted 11 years ago # -
ibwebb
MemberWhiterabbit-uk,
I know my way sounds really (REALLY) long, but it works. neither my fiancee or myself have had anymore problems at all. I also know that you are busy, but once you get to the final part that I posted you can just leave it and go do other things. I know that I did. I hope all your other things clear up and things are all going well!Posted 11 years ago # -
Whiterabbit-uk
Games Guru
A Fix for the SoundFrost Debacle.... :)Hi Gregg, Thanks for your efforts, much appreciated.
That said I manged to fix it early this morning with virtually no effort involved; but only because Microsoft Security Essentials popped up with a warning yesterday evening.
I can't even remember installing Security Essentials (does it come as standard with Win 8?).
Anyway, I initially deleted Sound Frost, then using Security Essentials I did a deep scan of my C drive (where I have Win 8 installed) and it cleared the problem (so far it seems totally). No browser redirects, no Sound Frost references on You Tube, no annoying hyperlinks added randomly to blog sites or anywhere there's text, which, when you pass your mouse over them, they open pop-up's. Also other annoying problems like not being able to place the cursor on a url but having to use the cursor keys to move the cursor instead of just a mouse click, or the Download link on both the giveaway site, gamegiveaway site and otrher sitess changing in less than a second to download links for rubbish........ALL GONE.
I've not done a manual scan of the registry yet to see if any of the key words that have been bandied around in this thread are still present. I'll do that before I turn the computer off (just in case there's a nasty registry entry that helps install the thing again. (I'm paranoid now, lol).
It's such a relief that it wasn't a major job. :)
Yeaaaaaah!.... :) Posted 11 years ago # -
mikiem2
ModeratorI can't even remember installing Security Essentials (does it come as standard with Win 8?).
Yes, though it's renamed as Windows Defender.
http://www.microsoft.com/security/pc-security/windows8.aspx#antivirus
http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1report_no=130597
Glad everything's squared away.
Posted 11 years ago # -
ibwebb
MemberCongrats Stephen! That is great. You know I never thought of that. Someone at sometime told me to turn that off since I was running AVG and now I am wondering if that was good advice. Wish I could remember who. Anywho, I am turning it on to see if it finds and residual stuff.
Posted 11 years ago # -
Whiterabbit-uk
Games GuruActually things aren't totally sorted yet. I happened to visit a facebook page topday and got the same issue a sbefore. A message popping up saying there had been an attempted phishing attack and that Facebooks anti phishing software had stopped code being injected.
There's no hyperlinks or pop ups appearing since running Security Essentials and my browser is behaving normally. I've also just checked You Tube again and everything seems okay.
Next thing to do is delete the Sound Frost dll and then read Greggs post above. :) I'll sort the registry tomorrow. :)
I'll report back any more findings. :)
Posted 11 years ago #
Reply »
You must log in to post.