Guys,

Sorry if I'm being confusing. I am referring to the entry above Global Startup....As I mentioned in my initial post it is HKE_USER\s-1-5-21....1006\Software\Microsoft\Windows\Current Version\Run\
Microsoft Update Detection and it is definitely associated with ClearSearch. I guess the thread is getting a little long but I also mentioned ClearSearch as the start of the problem in my first post and that's ClearSearch.net not .com. To recap ClearSearch.net is the result of a SpyBot scan. It branches down to the above mentioned reg key which also appears as an 04 item (above Global Startup) in the HJT scan.

jholland, I haven't had time yet to do WPFind scan that you recommend but will do and send.

Thanks again for the time and patience,
Robin