ClearSearch.net

[jholland1964]

Attached is the WPFind log. I had to delete a bit to get it within the allowed limits. I hope I didn't cut anything essential.

The Microsoft reg key in question is most definitely involved. It may well be a legitimate key and ClearSearch is hitching a ride. The reason I am so sure is that the SpyBot scan turns up ClearSearch in red (as in bad) and when you click on it for more info it branches down to the key in question. When you tell SpyBot to fix is removes that key until you reboot. It undoubtedley recreates itself through Microsoft's endless powers and it takes ClearSearch right along with it.

Robin

Robin, I don't even see the reg key HKEY_USER\S-1-5-21.....etc. even IN your WPFind log. You must have cut it out when you "deleted a bit". I don't see ClearSearch anywhere in the portion of the log that you posted.
Have looked again at your HJT log, and I still don't see anything...however, your browser was running, your Messenger was running and SpyBot TeaTimer was running during the HJT scan. Close down ALL UNNECESSARY programs and run the HJT scan again. These all can interfere with getting an accurate scan.