Can't remove Spyware

DesertHeat · Aug 23, 2006

First post...ever. I'm using XP sp2. Newbie, computer Novice.

Spybot S&D keeps finding "ClearSearch.net" says its under "Autorun Settings Microsoft Works Update Detection" then gives an HKEY_ with a bunch of numbers and then again Microsoft Works Update Detection.

I have gone to MS Works and turned OFF the Update Detection, but Spybot keeps finding this during every scan. I recheck it and its indeed still turned Off in MS Works itself.

I have even turned OFF my System Restore after deleting ClearSearch.net from Spybot and turning Off the Works Update Detection....but its back again, immediately after Reboot.

When doing a Spybot scan during Safe Mode, it is not found.
Soon as I Reboot, it's back again.

I just did a computer Search for the word "Clear" on my system and this is what was found ...
"ClearSearchNet.zip" and 11 more of them, numbered "ClearSearchNet.zip
1 - 11.
Says its located in Folder C:\Documents & Settings\ApplicationData\Spybot-Search&Destroy\Recovery

Can ANYONE tell me what's going on and how to get rid of this??
Thanks in advance.

DesertHeat · Aug 23, 2006

P.S. I already got stuck on READ ME #1, regarding System Restore, seeing I had been advised (by someone ((not here))a week ago) to turn it Off after deleting ClearSearch.net with Spybot, and then turn it back On.

So seeing I'd deleted ClearSearch.net from Spybot and somewhere along the way have turned System Resotore Off & On a number of times, before finding this Website, what do I do with Step #1 regarding Disabling/Enabling System Restore?

Thanks

DesertHeat · Aug 23, 2006

Nevermind. - This is all too hard for a Novice, without some Help.
Got no answer on the System Restore thing so continued on and then got stuck at "Upload the runkeys.txt file here as an attachment". Upload? Upload how? Here? Here where?
This would take forever without help. I tried by myself, really did. Thanks anyway.

DavidGP · Aug 23, 2006

Hi

In regards to Safe Mode, do not turn it off until all malware is removed, why if things go wrong, you have no restore point to recover too, even a malware infested one is better than a full reinstall and loss of important data, SO in Step #1 it says Do Not turn off System Restore until told to do so or your deemed malware free.

as to "Got no answer", you'll apprieciate that we are all volunteers and devote as much of our spare time to help unpaid/freely.. and we love to help, but it can take longer than 45min+ to reply, especially in this the Malware forum as some cases can take longer than usual to resolve, plus as the Malware experts always go from the oldest post that needs help first, bumping yours to the top can get it missed a few times, but we do get to all.

as to GetRunkeys and ShowNew, When you run GetRunKey it will close once run and save a TXT file in this location C:\runkeys.txt thats the TXT doc you attach, and its the same for ShowNew it will also save a TXT file in this location C:\newfiles.txt

its those plus the other requested logs you attach to your next posts once all the steps in the guide have been followed, here is some guidance on HOW TO: Attach Items To Your Post

Log in or Sign up

Can't remove Spyware

DesertHeat Private E-2

DesertHeat Private E-2

DesertHeat Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member