ClearSearch.net

[rada44]

A SpyBot scan keeps showing ClearSearch.net as a problem. The repair does not work. It keeps reappearing. I have followed Symantec's instructions for removal. The automatic removal tool says I don't have ClearSearch and I don't seem to have any of the registration keys that the article refers to. I also can't seem to locate any of the things referred to in the article on this site. Norton and Ad-Aware scans also say I'm clean.

SpyBot lists HKE_USER\S-1-5-21.....1006\Software\Microsoft\Windows\Current Version\Run\MicrosoftUpdateDetection as the sub-branch under ClearSearch.net. I can locate this in the registry. Does anybody know what I've got? Should I manually remove this key?

I am not having any overt problems but I obviously don't want my internet comings and going tracked.

Thanks for any help,
Robin

[jholland1964]

Give us a HiJackThis log and we can better see what we may need to look for or where to look.
Do these steps first;
Make sure you have NO startups disabled via msconfig.
Go to start, run and type in msconfig. Go to the start up tab and make certain there are checkmarks in everything there.

Enable Viewing of Hidden Files and Folders

Download HiJackThis

Create a new file folder;
For Windows XP users, here is one way to do that:

To create a new folder:
Click START > My Computer > Local Disc C: > Program Files
Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and Click ENTER.

To Extract HijackThis:
Now, RightClick your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder (C:\Program Files\HijackThis)and click Next.

It is EXTREMELY important that HijackThis be properly located before you use it!
Now with ALL other programs closed including Spybot Teatimer, browsers, mail programs, AIM, etc., run HJT and save the scan as a text file and then post it here. We will take a look.

[rada44]

Attached is the HijackThis log.

Your instructions were slightly confusing given past practice and current results. HJT has always lived on my desktop so I had to send it to a zip file so I could extract it, etc., etc. The results were identical to those gotten from the desktop site. Only comment if you have time after dealing with the primary problem, ClearSearch.

I have also noticed that googling clearsearch turns up comment, including your article, for clearsearch.com. My clearsearch is clearsearch.net and I get no hits when I google it that way.

Thanks for the quick reply,
Robin

[jholland1964]

Your version of HiJackThis is way out of date. You are showing version v1.97.7 the newest version is 1.99.1. Please download the newest version and give me a new scan.

The reason for locating HiJackThis to it's own folder and not just the desktop is IF fixes are made with HiJackThis which then must be restored the restore files are stored in the HiJackThis folder. They cannot be stored on the desktop.

[rada44]

Here's the latest.

[jholland1964]

You are still running HJT from a temp file. Note entries;
C:\DOCUME~1\Robin\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\DOCUME~1\Robin\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
HJT must be moved to it's own folder, not a temp file. Also delete the older version of HJT. It is no longer needed.
Also the browser was open durning the scan and Spybot TeaTimer was also running. Close ALL unnecessary programs before running HJT;
DirectCD
Messenger
Works Update
Real Player
Win Amp
Eraser
Adobe Speed Reader
Spybot TeaTimer
Netscape

ClearSearch.net is an "adult" search page...if you get my drift.

[rada44]

Attached is the latest and, hopefully, correct and useful log. I had already figured out how to move HJT to the assigned folder and did delete the old version. Yes, I do get your drift and it is undoubtedly so.

Is there any reason not to delete the indicated registry key? Is that alone likely to be the end of it?

Thanks for your patience,
Robin

[jholland1964]

Well I have not found any trace of it in your logs, any of them. If you are comfortable with editing the registry then do so.
One thing you didn't say you did and that was set a new restore point after removal. Try that first.
Run your Spybot again, remove the offender. THEN go to My Computer, Right Click, choose Properties. System Properties will open then choose the System Restore Tab. Place a checkmark in Turn it off. Click OK. You will get a message saying it is being turned off and say ok.
Then reboot.
Run a new Spybot scan and see if it turns up again. If it DOES then fix the reg key. If it doesn't then you will know it isn't necessary and therefore you can re-enable System Restore knowing that your computer is clean.

[rada44]

The offending reg key does, in fact, show up in the log. It is third entry from the bottom of the 04 section just above Global Startup: Adobe Reader Speed Launch....

I have now removed the key using Spybot, HJT and manually. After rebooting with System Restore turned off it returned each time. Something else that is curious, SpyBot turns up ClearSearch while it is scanning CoolWWWSeach files, although all attempts to find those files (with Show Hidden Files checked) turn up nothing.

I suppose it's time to download an updated version of CWShredder. Mine is also ancient.

Robin

[Gizmokid2005]

Robin, Adobe Speed reader launch is NOT causing this...that is a known good program that is Acrobat Reader for pdf files.