ClearSearch.net

[rada44]

A SpyBot scan keeps showing ClearSearch.net as a problem. The repair does not work. It keeps reappearing. I have followed Symantec's instructions for removal. The automatic removal tool says I don't have ClearSearch and I don't seem to have any of the registration keys that the article refers to. I also can't seem to locate any of the things referred to in the article on this site. Norton and Ad-Aware scans also say I'm clean.

SpyBot lists HKE_USER\S-1-5-21.....1006\Software\Microsoft\Windows\Current Version\Run\MicrosoftUpdateDetection as the sub-branch under ClearSearch.net. I can locate this in the registry. Does anybody know what I've got? Should I manually remove this key?

I am not having any overt problems but I obviously don't want my internet comings and going tracked.

Thanks for any help,
Robin

[jholland1964]

Give us a HiJackThis log and we can better see what we may need to look for or where to look.
Do these steps first;
Make sure you have NO startups disabled via msconfig.
Go to start, run and type in msconfig. Go to the start up tab and make certain there are checkmarks in everything there.

Enable Viewing of Hidden Files and Folders

Download HiJackThis

Create a new file folder;
For Windows XP users, here is one way to do that:

To create a new folder:
Click START > My Computer > Local Disc C: > Program Files
Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and Click ENTER.

To Extract HijackThis:
Now, RightClick your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder (C:\Program Files\HijackThis)and click Next.

It is EXTREMELY important that HijackThis be properly located before you use it!
Now with ALL other programs closed including Spybot Teatimer, browsers, mail programs, AIM, etc., run HJT and save the scan as a text file and then post it here. We will take a look.

[rada44]

Attached is the HijackThis log.

Your instructions were slightly confusing given past practice and current results. HJT has always lived on my desktop so I had to send it to a zip file so I could extract it, etc., etc. The results were identical to those gotten from the desktop site. Only comment if you have time after dealing with the primary problem, ClearSearch.

I have also noticed that googling clearsearch turns up comment, including your article, for clearsearch.com. My clearsearch is clearsearch.net and I get no hits when I google it that way.

Thanks for the quick reply,
Robin

[jholland1964]

Your version of HiJackThis is way out of date. You are showing version v1.97.7 the newest version is 1.99.1. Please download the newest version and give me a new scan.

The reason for locating HiJackThis to it's own folder and not just the desktop is IF fixes are made with HiJackThis which then must be restored the restore files are stored in the HiJackThis folder. They cannot be stored on the desktop.

[rada44]

Here's the latest.

[jholland1964]

You are still running HJT from a temp file. Note entries;
C:\DOCUME~1\Robin\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\DOCUME~1\Robin\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
HJT must be moved to it's own folder, not a temp file. Also delete the older version of HJT. It is no longer needed.
Also the browser was open durning the scan and Spybot TeaTimer was also running. Close ALL unnecessary programs before running HJT;
DirectCD
Messenger
Works Update
Real Player
Win Amp
Eraser
Adobe Speed Reader
Spybot TeaTimer
Netscape

ClearSearch.net is an "adult" search page...if you get my drift.

[rada44]

Attached is the latest and, hopefully, correct and useful log. I had already figured out how to move HJT to the assigned folder and did delete the old version. Yes, I do get your drift and it is undoubtedly so.

Is there any reason not to delete the indicated registry key? Is that alone likely to be the end of it?

Thanks for your patience,
Robin

[Gizmokid2005]

Robin, Adobe Speed reader launch is NOT causing this...that is a known good program that is Acrobat Reader for pdf files.

[jholland1964]

Robin,
Why would you think this file is showing in your log here;
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

As Gizmokid points out this IS a legitimate entry, nothing unusual about it. It is seen daily in many, if not most HJT logs.
Can you do another Spybot scan and post the log for us? or at least give us the exact wording of each item found?
You never mentioned Clearsearch, and now you say it finds it everytime too...

while it is scanning CoolWWWSeach files...

where does it find it? There should not be ANY CoolWWWSearch Files on the computer. Nothing like that is showing in your HJT log. Any of your logs.
None of these items are showing in your logs.

[jholland1964]

Download WPFind
Usage Instructions: Download WinPFind.zip and extract it to your C:\ folder. This will create a folder called WinPFind in the C:\ folder. Inside c:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

When it is done, it will show the results of the scan. Click on the Copy to Clipboard button and then paste the contents of the log in your clipboard as a reply back here.

Note: It is important to note that not all files found with this program are necessarily bad. Please use extreme caution when deleting these files as it may cause problems with applications running on your machine.