Spyware, viruses, & security forum: help: Claro virus downloaded from CNET downloader

familiarize yourself with what a virus is and what it isn't. At most Claro-search.com could be classes as a search hijacker.

Since it is a search engine that many use by choice (see for yourself at http://www.claro-search.com/ ) it is often offered as an included download that you can AT YOUR OPTION install with the utility you actually wanted. During installation, YOU, the installer, can easily opt to NOT install the additional software but there is the assumption that you are paying attention to EXACTLY what you are doing rather than blindly clicking buttons. Yahoo, Ask, and Google as well as Bing all do the same thing and are offered up in the same way.

Here is a handy link demonstrating how to remove it if you don't want it -
http://www.im-infected.com/hijacker/claro-search-com.html

As a teacher you should be instructing your students to pay attention to what they are doing at all times (attention to detail) AND you should test things before assigning them to be done by students. For instance if you had gone to download.com and searched for ERASER you would have got this page and the green download link is a direct link:
http://download.cnet.com/1770-20_4-0.html?tag=pfindersrch&searchtype=downloads&query=eraser&filter=platform=Windows|&filterName=platform=Windows|

If you had the students look at the ERASER page here http://download.cnet.com/Eraser/3000-2092_4-10231814.html?tag=mncol;5 you would be seeing the green Download button which also indicates that it is CNET Installer enabled and has a handy little Info icon that tells you about the offering of additional software. Then just below that green download button it doesn't even take a really sharp eye to see the words DIRECT DOWNLOAD LINK

You do not mention what you teach but let us hope that it is not computer science at ANY LEVEL!

CLARO is bad malware - that's all there is to it. Try a system restore in windows.

Claro is limited to hijacking your search page and installing an unwanted toolbar - it does not verge into the realm of keylogging or other surreptitious spying. And while it's not a virus, it is malware and a PUP (potentially-unwanted program).

For removal of browser hijackers, HiJackThis is a lightweight security app from Trend Micro that I continue to recommend. And for a broader cleaner that's not limited to hijackers, MBAM has a free version with full removal capabilities. Either one should be able to remove Claro in its entirety.

Finally, regarding the download that started this all, always use the "direct download" link that CNET offers under the large download button. (If there is no "direct download" link, the download button should provide the download without the CNET Installer, with the program's developer having opted-out of the 'wrapper.') There have been numerous thread on the subject, but I would classify nearly all of the offers from CNET Installer to be PUPs (and sometimes worse) and strongly recommend avoiding it.

Regards,
John

.
It is simply untrue to say that when you 'OPT OUT' of having the bundle of other software with your download that it doesn't install, because it does, every single time, even when I have opted out and clicked all 3 boxes to opt out and just have my download.

Another little trick that occurs I have noticed is that when you are agreeing /confirming to uninstall, a small (already ticked) box is just under the 'yes' to uninstall box, that asks if you want to confirm the addition of further add ons..it could and does go on forever..the clean up after using CNet on clean fresh installs today on 3 computers, has taken me all night with 2 different progs, as they all pick up extra parts of these hard to unistall add ons that come bundled with the software you wanted.

I chose to not have ANY of them but still ended up with all of them!

I never noticed the direct uninstall link on any of the downloads, so maybe it should be larger as when you see a large green 'DOWNLOAD' sign you don't look for another way to download as usually its not needed!

The worst to get rid of was 'Funmoods' which came bundled with something from CNet.

I thought I had eventually cleared all traces of it but no..it kept showing up after being cleaned over and over..very hard to get rid of and I use Iobit uninstaller which also clears all the remnants it can find after an uninstall, but still it would show up in repeated registry cleans etc.
I also downloaded AOL 7 desktop for my daughter and 3 times, on a clean installation, it wouldn't open after the installation. It downloads then gets so far then closes down. It also had so much spyware with it that it maybe lost parts of it in the cleaning the PC process.

I have got so wary of downloading due to these problems from Cnet I am now going elsewhere. I will though try the 'direct download' link now I know about it!

I could always rely on Cnet in the past..I never downloaded from anywhere else.

Personally I would rather PAY a small sum for a currently free download than have to clean all these 'extras' off every time I download.

Thank you, I will let moderators know in future which downloads fail the 'opt out ' tick boxes (it seemed like MOST of them!) and downloaded the add on's.

It is not that they are malicious but tenacious and when I have just used DBan to wipe the drives, it's frustrating to have things on there I have no purpose for and cannot easily remove. Installing on 3 computers I lost track and didn't know I would find this page!

I have now had to install on another Pc and used CNet, and looked for the 'direct download' link which appears under some of the downloads, not all, and my experience has been much improved.. it also seems that CNet have more downloads with fewer bundled accompanying software..would that be the case?

It seems that more progs downloaded without, this time around, though not all, and I am having a problem losing 'Feedsnap-Do' on my Google address bar..came bundled with something from CNet , said it would uninstall in add/remove progs which it does, but leaves behind its tracks all over.

Apologies for not making a note of all the progs as i downloaded them, but now I know of this forum I will. I looked for it because I was so p***ed off with CNet that night! LOL

Last night's experiences have been better..some 'opt out' boxes worked, others not, Wacom ( ? or similar) as well as Claro again and Feed Snap kept arriving despite me clicking to not install it!
I use Super Antispyware, AntiMalware Bytes, Spybot, Esset, Hitman Pro and Avast, CCleaner, WinAso, and as needed, Hitman Pro etc, but these blighters do resist all the usual removal softwares! I often end up going into the regsitry to delete them which is time that could be better spent!

Hey Wakeupstupid,
I don't think the people in this fourm are intentionally promoting their software to remove Claro.
Yet, all traditional methods of removing it simply fail. Norton, AVG, Malwaware bytes, etc...simply do nothing about this malware/ possible future spyware.

Sorry, I don't like to be rude, yet Mr. Edward, you are a donkey's behind.
It sounds as if you are promoting Claro.

In virtually ever persons eyes, Claro is the most destructive software in the last 5 years.
Why are you defending it?

I think I got rid of it but it took hours of my life, I'll never get back.
Complicating it for me is that I'm on Windows 8 and IE 10 did not behave as the posted removal suggestions expected - the "tools" function was grayed out. After 2 failed windows restore attempts, for some reason the "tools" function was again accessible. Firefox was easy to fix and I uninstalled and re-installed Chrome. Norton Internet Security version 20.2 did NOT catch this. After the fact I've also run Malwarebytes and it didn't find anything - HOPEFULLY it's gone.

I had the same Claro malware problem as everyone is talking about.
I've spent 5-6 hours of my life, much frustration and disbelief over CNET on this.

As for claro, its still the home page of most of my browsers. Otherwise, it seems to be mostly removed.
How could CNET get involved with this AND STILL BE INVOLVED is beyond me?
www.download.com will be a company of the past if they don't fix this soon. Yet, there doesn't seem to be any alternative sites that are trustworthy yet to get CNET like products.

I realize CNET is needing revenue, but this type of revenue is like chopping the head of the golden goose. Sure you might get a few golden eggs quick, yet they just killed the golden goose called download.com

I need some softeware right now from CNET, but I won't get it as I am terrified of Claro.