Some reading: http://symantec.com/avcenter/venc/data/bloodhound.exploit.56.html#removalinstructions
Update Norton. Run a scan in Safemode: Turn on the computer.
Immediately begin tapping the F8 key (or F5 on some computers)
Use the arrow keys to highlight Safe Mode and press the Enter key.
Then let Norton scan.
You also might want to try Ewido:
Please follow the instructions provided. You may want to print out these instructions and use them as a reference.
Please download Ewido Anti-Malware it is a trial version of the program.
[*]Install ewido security suite
[*]When installing, under ''Additional Options'' uncheck ''Install background guard'' and ''Install scan via context menu''.
[*]Launch Ewido, there should be an icon on your desktop double-click it.
[*]The program will now go to the main screen
You will need to update Ewido to the latest definition files.
[*]On the left hand side of the main screen click update
[*]Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
ewido manual updates
Once the updates are installed do the following:[list]
Please reboot into Safemode:
Turn on the computer.
Immediately begin tapping the F8 key (or F5 on some computers)
Use the arrow keys to highlight Safe Mode and press the Enter key.
Open Ewido again.
*Click on scanner
Then select ''Settings''
Under the bottom section ''What to Scan?'' make sure ''Scan every file'' is checked.
Select ''OK'' and you will return to scanning options.
*Click on Complete System Scan and the scan will begin.
This scan can take quite a while to run, so please be patient .
While the scan is in progress, you will be prompted to clean the first infected file it finds. Choose Clean. Then put a check next to 'Perform action on all infections' . Doing this, enables the scan to proceed automatically until its completion. Click OK
*Note: Ewido is a free trial product for 14 days. After that you can purchase it for full features OR you can also keep the free version to use as an on-demand scanner (recommended).
You will still be able to manually update Ewido using the *update* button
Thank you! to anybody willing to read this and help me out, I am not nearly skilled enough to figure this out myself. Sorry if I wrote more info than necessary, just want to be thorough.
I am running Windows XP with Norton Internet Security (firewall and automatic liveupdates) on a Dell desktop Pentium 4 with a cable modem connection. I use Internet Explorer.
I was closing down my applications today when I found a message from Norton saying that it had found a virus named bloodhound, but it said it could not access the file. I closed the message and ran a complete virus scan after live update and found nothing.
Then I went to look at Norton's log viewer and found some things like this:
ALERTS: I found a LONG list of these stating "Unauthorized access logged" which seemed to be coming a few times a day in batches of about 6-20 hits within a minute. They all say "unauthorized access stopped". The actor and target were not always the same. For example:
Actor: C:\WINDOWS\system32\lsass.exe (PID=756)
Target: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
Actor:C:\WINDOWS\system32\winlogon.exe (PID=700)
Target: C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
Target: C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
There are more, but I'm not going to post all of them.
In the FIREWALL section I've got a ton of these messages:
Unused port blocking has blocked communications. Inbound TCP connection.
An instance of "C:\WINDOWS\system32\lsass.exe" is preparing to access the Internet
An instance of "C:\Program Files\Norton Internet Security\Norton AntiVirus\navw32.exe" is preparing to access the Internet.
In the SECURITY RISKS section I've got these three messages:
Source: C:\Documents and Settings\Jeremy\Local Settings\Temporary Internet Files\Content.IE5\W14X6RS9\wmf_dcode[1].wmf
Click for more information about this risk : Bloodhound.Exploit.56
Action taken: Repair failed
Action taken: Access denied
Source: Manual Scanner
Risk category: Adware
Click for more information about this risk : Adware.180Search
Action taken: Removed
Source: C:\Documents and Settings\Jeremy\Local Settings\Temporary Internet Files\Content.IE5\MXW5UXCT\bridge-c8[1].cab
Risk category: Adware
Click for more information about this risk : Adware.180Search
Action taken: Detected
All the other messages in other categories seem pretty standard to me.
Other facts:
My windows security is up to date
Not sure if it is relevant, but when I first got my computer I was constantly getting a message from Norton saying that some Win32 program was trying to make a connection and I kept manually blocking it, but it would pop up every 5 minutes and when I permanently blocked it, I could no longer connect to the internet. So my firewall has since been permitted to always use Microsoft Generic Host Process for Win32. Not that I know what that means.
I am always running msconfig to shut down the automatic startup of anything I don't recognize.
I often delete all cookies and temporary internet files.
I have a few programs with access in my firewall configuration that I don't recognize such as "aswapp" "GLBA4," "GLBBD, "GLBC8," and "Active Worlds AutoUpdate Utility."
My firewall level is set on High and my Internet Explorer security is set to some custom level that I believe was created when I loaded Norton onto my computer.
That's it. Thanks!

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic