Adware.SoundFrost

Posted: August 26, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	5,821
Threat Level:	1/10
Infected PCs:	135,460

First Seen:	August 26, 2013
Last Seen:	March 4, 2025
OS(es) Affected:	Windows

SoundFrost is a Potentially Unwanted Program that, along with its sound file-related functions, hijacks your browser to redirect you away from unrelated sites towards its affiliated links. Besides its hijacks, SoundFrost also installs a separate PUP that may be used maliciously and is developed by a company of the same name with a heavily suspicious background in software marketing. Even though the current evidence doesn't support SoundFrost being rated as a threat, malware researchers still urge you to use the highest caution when interacting with the SoundFrost's company, and to remove SoundFrost software with strong anti-malware products whenever the program's presence is unwanted.

SoundFrost: The Sound of Your Control Over Your Searches Freezing Solid

SoundFrost is a standard type of unwanted program with a slightly non-standard history and may be installed either by itself (through the Soundfrost.org site or a general freeware domain) or in a bundle with other programs. Although SoundFrost's marketing claims that SoundFrost is a free utility for downloading, playing and converting popular formats of music/sound files (such as MP3), malware experts noted a red flag when SoundFrost's marketing didn't mention that its 'free' version actually is a temporary trial that expires in thirty days. Permanent use of SoundFrost requires the purchase of one of two versions of its premium software, despite these other versions being absent from mention in the actual SoundFrost website.

Additional issues arose when SoundFrost appeared to install a browser-hijacking component that modifies the Web browser's hyperlinks to promote sites affiliated with the company. These modifications are made automatically.

A last, damning detail to SoundFrost is that SoundFrost also installs one more program, the screen-capturing utility MyPrintScreen. Although this program, in theory, has benign uses, it also could easily be abused to steal private information through screenshots. When accompanied with the other inauspicious behavior from SoundFrost's company, malware researchers aren't inclined to recommend that you trust SoundFrost to use MyPrintScreen only for legal purposes.

Thawing the Sound of Your Browser Being Exploited

Very few browser hijackers offer any kind of useful features for your PC, and although SoundFrost is one of those few, its drawbacks also are far above those of most other Potentially Unwanted Programs that malware researchers have examined to date. Deleting SoundFrost should be considered the usual and preferable response to its installation, and any interaction you take with this software or its company should be considered at your own risk.

Removing SoundFrost by normal methods doesn't remove MyPrintScreen and is unlikely to reverse the effects on your browser. Because SoundFrost's installation is an issue of multiple PUPs and multiple system changes, malware researchers always would consider using the system scans of good anti-malware programs to be best for removing SoundFrost and preventing any future hyperlink hijacks.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\Users\<username>\AppData\Local\ContentSinder.exe

File name: ContentSinder.exe
Size: 176.64 KB (176640 bytes)
MD5: a8445949ac5105686bfe169734f1fa33
Detection count: 8,380
File type: Executable File
Mime Type: unknown/exe
Path: C:\Users\<username>\AppData\Local\ContentSinder.exe
Group: Malware file
Last Updated: September 25, 2024

C:\Qoobox\Quarantine\C\Users\<username>\AppData\Local\ContentAgent.exe.vir

File name: ContentAgent.exe.vir
Size: 124.92 KB (124928 bytes)
MD5: 0e60c09c199b60ccfb7efc5043f12e9c
Detection count: 4,928
Mime Type: unknown/vir
Path: C:\Qoobox\Quarantine\C\Users\<username>\AppData\Local\ContentAgent.exe.vir
Group: Malware file
Last Updated: October 12, 2022

C:\System Volume Information\_restore{58FE075A-2C9F-40CF-8977-BE07310315B5}\RP911\A0297813.exe

File name: A0297813.exe
Size: 232.44 KB (232448 bytes)
MD5: e749273baa493d1fb92db5c5aa6d52d9
Detection count: 3,506
File type: Executable File
Mime Type: unknown/exe
Path: C:\System Volume Information\_restore{58FE075A-2C9F-40CF-8977-BE07310315B5}\RP911\A0297813.exe
Group: Malware file
Last Updated: May 4, 2023

%PROGRAMFILES%\SoundFrost\SoundFrost.dll

File name: SoundFrost.dll
Size: 89.08 KB (89088 bytes)
MD5: bb56ce8eec2dbedd1688f556c060a8a9
Detection count: 1,117
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\SoundFrost
Group: Malware file
Last Updated: November 2, 2020

C:\Program Files (x86)\MyPrintScreen\MyPrintScreen.exe

File name: MyPrintScreen.exe
Size: 231.93 KB (231936 bytes)
MD5: cdf91b235d8a0b2cddcb32ace101057f
Detection count: 1,045
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\MyPrintScreen\MyPrintScreen.exe
Group: Malware file
Last Updated: September 2, 2023

C:\Windows.old.000\Users\<username>\AppData\Local\ContentFinder.exe

File name: ContentFinder.exe
Size: 148.99 KB (148992 bytes)
MD5: 0d05fbd5e8c88de19094993d9341f14f
Detection count: 269
File type: Executable File
Mime Type: unknown/exe
Path: C:\Windows.old.000\Users\<username>\AppData\Local\ContentFinder.exe
Group: Malware file
Last Updated: August 30, 2021

%PROGRAMFILES(x86)%\SoundFrost\SoundFrostService.exe

File name: SoundFrostService.exe
Size: 338.94 KB (338944 bytes)
MD5: b689752ba089140e9a61f5026215de92
Detection count: 101
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\SoundFrost
Group: Malware file
Last Updated: December 27, 2013

%PROGRAMFILES(x86)%\SoundFrost\SoundFrost.exe

File name: SoundFrost.exe
Size: 2.09 MB (2097152 bytes)
MD5: 311e1130651ddca61a3451292db3bf6f
Detection count: 89
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\SoundFrost
Group: Malware file
Last Updated: August 23, 2018

%SYSTEMDRIVE%\Users\<username>\OneDrive\Área de Trabalho\Backup - CCE\Windows7\Program Files\Baixar Musicas Gratis\MyPrintScreenHelper.exe

File name: MyPrintScreenHelper.exe
Size: 6.85 MB (6855168 bytes)
MD5: 768d0af65a165a618b5f94c1294a5363
Detection count: 30
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\OneDrive\Área de Trabalho\Backup - CCE\Windows7\Program Files\Baixar Musicas Gratis\MyPrintScreenHelper.exe
Group: Malware file
Last Updated: August 30, 2022

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{081524f7-7ed8-43ff-b01e-915c410a9cbe}{7ACA7342-3323-4B4A-A4E2-1D1F140A71DE}{d997c836-ff82-4519-b459-1482ba942a4f}File name without pathSoundFrost.lnkHKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\soundfrostSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{081524f7-7ed8-43ff-b01e-915c410a9cbe}SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d997c836-ff82-4519-b459-1482ba942a4f}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{081524F7-7ED8-43FF-B01E-915C410A9CBE}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{081524F7-7ED8-43FF-B01E-915C410A9CBE}Software\Microsoft\Windows\CurrentVersion\Run\Jap.fmSoftware\Microsoft\Windows\CurrentVersion\Run\MyPrintScreenSoftware\Microsoft\Windows\CurrentVersion\Run\SoundFrostSoftware\Microsoft\Windows\CurrentVersion\Run\SoundFrost ServiceSoftware\Mozilla\Firefox\Extensions\jid1-BPkqJiAqSvlIBQ@jetpackSoftware\Mozilla\Firefox\Extensions\SoundFrost@helper.comSoftware\SoundFrost CompanySoftware\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\SoundFrostSoftware\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Program Files (x86)\SoundFrostSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{081524f7-7ed8-43ff-b01e-915c410a9cbe}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d997c836-ff82-4519-b459-1482ba942a4f}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}SoundFrost_is1

Additional Information

The following directories were created:

%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\SoundFrost%ProgramFiles%\SoundFrost%ProgramFiles(x86)%\SoundFrost

The following URL's were detected:

SoundFrost