What is C:\Program Files\ClearSearch\loader.exe? It's trying to access the Internet from my machine.

[Muse]

I run Zonealarm firewall and it's telling me that Loader (loader.exe, version 1,0,0,2) is trying to access the Internet. I never used to get this and I figured that it was something I picked up browsing a website. I ran AdAware 6.0 around a week ago and it didn't pick it up and I don't see it in Add/Remove programs. What should I do?

My options as I see it:

Tell Zonealarm to never let it access the Internet, or to always let it access the Internet. Or I could just tell ZA to not let it access this time, like I did last time.

Search for loader.exe and delete it.

Edit: I see this file:

C:\Program Files\ClearSearch\loader.exe

I think that's it. It was created on 8/26/03. I see no "ClearSearch" in my Add/Remove Programs. Thing is I ran AdAware the next day and it didn't remove it. I think it's spyware. I'm running Win2000 SP3.

 

[Mark R]

It's part of a program called 'clearseach' which is basically an advert pop-up program.

It looks like accessing a web page installed the 'loader.exe' which trys to download the rest of the program slowly over a few days (so you don't notice something taking all your bandwidth).

Adaware is not updated very frequently. Try a different product.

 

[Muse]

Originally posted by: Mark R
It's part of a program called 'clearseach' which is basically an advert pop-up program.

It looks like accessing a web page installed the 'loader.exe' which trys to download the rest of the program slowly over a few days (so you don't notice something taking all your bandwidth).

Adaware is not updated very frequently. Try a different product.

I could swear I deleted Loader.exe the other day. I think there's something that's reinstalling it! Suggestions for that "different product?" I'm running AdAware freeware.

 

[Lonyo]

Open regedit (start->run->regedit)
Search for Clearsearch, and delete anything pertaining to it. Might help get rid of it trying to reinstall. Maybe search by date for anything created on the same day which might be bringing it back?

 

[Muse]

Originally posted by: Lonyo
Open regedit (start->run->regedit)
Search for Clearsearch, and delete anything pertaining to it. Might help get rid of it trying to reinstall. Maybe search by date for anything created on the same day which might be bringing it back?

I just did and found one entry and deleted it. I also deleted the directory and loader.exe. What I'm not doing is telling Zonealarm to always ignore it. That way I'll know if it comes back.

 

[Jeff7]

Originally posted by: Muse

Originally posted by: Mark R
It's part of a program called 'clearseach' which is basically an advert pop-up program.

It looks like accessing a web page installed the 'loader.exe' which trys to download the rest of the program slowly over a few days (so you don't notice something taking all your bandwidth).

Adaware is not updated very frequently. Try a different product.

I could swear I deleted Loader.exe the other day. I think there's something that's reinstalling it! Suggestions for that "different product?" I'm running AdAware freeware.

Spybot S&D - fairly frequent updates.

 

[Muse]

Originally posted by: Jeff7

Originally posted by: Muse

Originally posted by: Mark R
It's part of a program called 'clearseach' which is basically an advert pop-up program.

It looks like accessing a web page installed the 'loader.exe' which trys to download the rest of the program slowly over a few days (so you don't notice something taking all your bandwidth).

Adaware is not updated very frequently. Try a different product.

I could swear I deleted Loader.exe the other day. I think there's something that's reinstalling it! Suggestions for that "different product?" I'm running AdAware freeware.

Spybot S&D - fairly frequent updates.

Thanks for the link. This looks very interesting. I'm unsure if Spybot S&D protects against ClearSearch. It's not in their extensive list of threats.

 

[styrafoam]

It is a browser search hijacker, see here.

 

[Muse]

Originally posted by: styrafoam
It is a browser search hijacker, see here.

That looks spot-on. Thanks!