PC Hell: What is the Bloodhound.Exploit.6 and How Do You Remove it

Bloodhound.Exploit.6 Virus Information and Removal

What the Bloodhound.Exploit.6?

The Bloodhound.Exploit.6 virus is a Microsoft Internet Explorer/Outlook Express vulnerability discovered in February 2004. The vulnerability results from the incorrect handling of HTML files embedded in CHM files. (CHM is the Microsoft-compiled HTML help format.) However, because of Norton Antivirus' (and other antivirus programs) ability to detect virus patterns, this heuristic detection of viruses can sometimes lead to false positives.

In most cases the antivirus program detects the virus in Temporary Internet files that have been downloaded from a web page. Such as:

C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\Content.IE5\KXURSTI7\10523[1].htm

In these cases, the Bloodhound.Exploit.6 ends up being a false positive detection of a virus. It looks like a virus to the scanner, but in reality it isnt. Now although the exploit is a real threat and can cause damage to a system, these false positive diagnoses from the antivirus software usually are the cause. I have had web pages and even corrupted Hijackthis logs cause this false positive from the antivirus program.

If Norton Antivirus' AutoProtect Settings are set to High for Bloodhound, the program will produce false positives for many files. The default level is recommended for most protection.

bloodhound.jpg (16801 bytes)

How to Clean/Delete the Bloodhound.Exploit.6 virus?

First of all, since this exploit is a real threat be sure your Windows software is up-to-date and patched with all the current critical updates from Microsoft. This will protect your system from other problems as well as this exploit.

1) Open Internet Explorer and type the following in the Address bar

http://windowsupdate.microsoft.com

2) Follow the on screen prompts to download and install any critical updates that are not loaded on your computer.

You can read more about the specific patch for this Microsoft vulnerability by clicking on the link below

http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx

Now that your system is patched against this exploit, you'll want to remove the file that triggered the virus notice. In the majority of cases, these files are stored in the Temporary Internet Files or Temp folder of the computer. Follow these directions to clean out these files.

For Internet Explorer 5 and above, you can follow these directions to clear out temporary files and delete cookies.

1) Open Internet Explorer and click on Tools
2) Click on Internet Options
3) On the General Tab, in the middle of the screen, click on Delete Files
4) You may also want to check the box "Delete all offline content"
5) Click on OK and wait for the hourglass icon to stop after it deletes the temporary internet files
6) You can now click on Delete Cookies and click OK to delete cookies that websites have placed on your hard drive.

To clean up other temporary files on your computer in Windows 98 or higher:

1) Click Start, Programs (or All Programs), Accessories, System Tools, Disk Cleanup
2) Choose the correct drive usually C:\
3) Check the boxes in the list and delete the files

You can learn more information about deleting these Temporary Internet Files, cookies, and more by visiting this page

Lastly, run a thorough virus scan of your system or visit Trend Micro Housecall to make sure your system is clean.