ClearSearch.net

[rada44]

Attached is the WPFind log. I had to delete a bit to get it within the allowed limits. I hope I didn't cut anything essential.

The Microsoft reg key in question is most definitely involved. It may well be a legitimate key and ClearSearch is hitching a ride. The reason I am so sure is that the SpyBot scan turns up ClearSearch in red (as in bad) and when you click on it for more info it branches down to the key in question. When you tell SpyBot to fix is removes that key until you reboot. It undoubtedley recreates itself through Microsoft's endless powers and it takes ClearSearch right along with it.

Robin

[jholland1964]

Attached is the WPFind log. I had to delete a bit to get it within the allowed limits. I hope I didn't cut anything essential.

The Microsoft reg key in question is most definitely involved. It may well be a legitimate key and ClearSearch is hitching a ride. The reason I am so sure is that the SpyBot scan turns up ClearSearch in red (as in bad) and when you click on it for more info it branches down to the key in question. When you tell SpyBot to fix is removes that key until you reboot. It undoubtedley recreates itself through Microsoft's endless powers and it takes ClearSearch right along with it.

Robin

Robin, I don't even see the reg key HKEY_USER\S-1-5-21.....etc. even IN your WPFind log. You must have cut it out when you "deleted a bit". I don't see ClearSearch anywhere in the portion of the log that you posted.
Have looked again at your HJT log, and I still don't see anything...however, your browser was running, your Messenger was running and SpyBot TeaTimer was running during the HJT scan. Close down ALL UNNECESSARY programs and run the HJT scan again. These all can interfere with getting an accurate scan.

[bryanpweaver]

In my case I ran spybot and came up with the clearsearch.net errors after reportedly fixing them. I could instantly run spybot again and get the same error time after time.

I expanded the spybot error report so I could see the registry value then I double clicked the registry value and it pointed to my hklm....run. I opened the IMONTRAY entry in my registry and it was pointing to a directory C:\Program Files\Intel\Intel(R) Active Monitor\IMONTRAY.EXE.

I dont have that directory anymore since I uninstalled the Intel Active Monitor so I think spybot is errantly reporting clearsearch.net spybot for a ghost entry in my registry to a file that doesn't exist.

To get around spybot showing the error I reinstalled the Intel Active Monitor and all is well with the world.

http://www.intel.com/design/motherbd/active.htm

Hope that helps your problem too.

Bryan

[jholland1964]

Hi bryan,
Thanks for your input. I must say I have been a bit remiss in not checking back into this thread since Sept. 1st and the original poster, rada44, has not been back since Aug. 16. The second poster, CharlesP, has not come back since Aug. 31. One thing I finally found, which I believe actually would have solved the problem for CharlesP at least, is this; the version of SpyBot Search & Destroy that he, was using was out of date. Note here from his above post;

--- Spybot - Search && Destroy version: 1.3 ---

This false postive became a known issue with version 1.3 and WAS corrected with the newest version which is 1.4.

I do not know what version the original poster rada44 was using and since she never returned I have no way of knowing. I can assume, since no evidence was found in any of her logs that this may also be the case, also since her original HJT log was also an out of date version of that program.

This is why one of the things we always stress here is be sure each program used is the very latest version. There are always changes and adjustments being done, this is why new versions and updates are always ocurring.

Thanks again for your input bryan.
Judy

[rada44]

Judy and everyone else who's chimed in,

Actually, I did come back after August 16th, several times, but since I didn't get any response to my last post I just assumed the novelty had worn off. In the meantime I went to Microsoft's virus, etc. number which is free and now fairly straight forward, unlike the pre-SP2 days. I got somebody that was fairly knowledgeable right off the bat and he gave me two pieces of useful information. He said that Clearsearch.net was a variant of CoolWebSearch and that my problem seemed to be a false positve and I should just instruct Spybot to ignore. I'm running CWShredder 2.19 which I think is the latest version and it does not scan for Clearsearch.net.

I thought I had downloaded the latest version of Spybot as per your instructions, but, in fact, I am running 1.3 (will update). I was originally uncomfortable with the "ignore" solution but since both Microsoft and you agree about the false postive I feel better about it.

Thanks again for the help.

Robin