How To Remove The iSearch Claro Hijacker Virus (isearch.claro-search.com)

by usman on Aug 20, 2012 • Adware, Google, Hijacker, Spyware, System Restore, Trojan, WindowinShare

What Is The isearch.claro-search Virus?

Isearch.claro-search.com is often refereed to as iSearch, Claro malware, the iSearch redirection virus, and simply “Claro Search”. Claro Search is a dangerous internet browser hijacker (categorized as adware and spyware) which uses browser helper objects (BHOs) and configures host settings in order to redirect infected victims using the internet to their websites. In particular: isearch.claro-search.com.
Many internet users unknowingly suspect the isearch virus and isearch.claro-search.com as being a realistic browser helper object or website. For instance, search.claro-search.com looks and acts very similar to Google because of the white background and minimal appearance. Isearch.claro-search.com is not a realistic website and contains many trojans, rootkits, and viruses.

The isearch.claro-search.com website also displays realistic SERPs (search engine result pages) similar to Google’s developments.

iSearch is utilized by the use of backdoor processes or Trojans and can also leave room for more malware on a computer system such as rootkits, trojans, and other malware. If you are infected by iSearch you can experience symptoms which range from simple CPU usage drains to complete system crashes, to and array of internet browser setting changes and redirections.

Similar browser hijackers include: Mystart, Media Finder, MP3 Tube Toolbar, Text Enhance.

If isearch.claro-search.com is not removed from your computer:

• Your computer can become malformed and operate improperly.
• Your browser settings become corrupted and internet usage is taken hostage by a constant redirection setting to drive-by-download websites which can open the door for more infections, and over-all cause a wide range of operating system related issues associated with Trojans (Privacy threat).
• Computer accesses may become blocked or locked if not isearch.claro-search.com is not addressed, similar to ransomware.

What Are Symptoms Of The isearch.claro-search.com Virus?

Symptoms for the isearch.claro-search.com virus range. Some infected users may notice only a few symptoms, some may have severe issues, and some infected computer users may never detect any symptoms. All symptoms listed below occur without consent of the computer user.

• isearch.claro-search.com uses browser helper objects (in this case search tools) and infects some users by installing isearch.claro-search.com search toolbar into their internet browser which redirects internet users to isearch.claro-search.com. Some internet users are redirected for every search or webpage they visit.

• User initiated browsing and search is redirected to isearch.claro-search.com while using the internet

• High levels of CPU usage is used due to the iSearch (Claro) processes, which can cause systems to crash or become malformed.

How To Remove The isearch.claro-search.com Virus

There are many ways to remove the isearch.claro-search.com virus for different victims. After removal it is recommended to change the preference settings in each internet browser installed on your system which have been altered by Claro (such as home page settings).

Removal Options

Please click a link below to automatically scroll to the “in page” selected option (named anchor link).

1. Malware Removal Software
2. Disable Add-ons And Extensions
3. Manually Kill Processes, Delete Files, And Delete Values
4. Safe Mode With Networking
5. Restore Computer To Date And Time Before Infection

1. Malware Removal Software

The easiest way to remove isearch.claro-search.com is by utilizing the free version of Malwarebytes. Malwarebytes is proven to remove the iSearch Virus and has the largest sample rate of all removal software due to being the most downloaded Anti-Malware program of 2011 and 2012.

• Try Malwarebytes, the Leader in Malware Removal

Remove Malware

 

2. Disable Malicious Add-ons And Extensions

If isearch.claro-search.com is infecting your search tools by use of Browser Helper Objects, there is most likely an add-on or extension in your internet browser which must be disabled and removed. We will detail instructions for Mozilla Firefox first since FireFox is the most common browser infected by isearch.claro-search.com, then we will proceed to Google Chrome, Microsoft Internet Explorer, and Apple Safari.

Mozilla Firefox

Google Chrome

Microsoft Internet Explorer

Apple Safari

*Before you proceed to change your internet browser settings to normal, in most scenerios you must uninstall Claro Search from your computer before removal of “managed search” options, etc. are available.

• Navigate to Control Panel > Add or Remove Programs ( or Uninstall a program)
• Uninstall isearch.claro-search.com associated programs (Claro LTD Toolar).

Mozilla Firefox

This example shows the removal process for an extension named “incredibar”, which is a similar infection. Follow the steps to search through extensions for anything suspicious or which resembles isearch.claro-search.com. If internet settings have been compromised by browser helped type objects then conitnue to follow the instuctions prior to removing or searching for the isearch.claro-search.com extension. The isearch.claro-search.com may be titled something which resesembles isearch.claro-search.com, such as iSearch Toolbar, or Claro Search.
Step 1: Open Firefox and navigate to Tools > Add-ons (or Ctrl+Shift+A)

Step 2: Select Extensions, find the isearch.claro-search.com extension and click disable, then remove.

Step 3: Click on the magnifying glass search icon as shown in the image below and select Manage Search Engines…

In this case you will notice Claro Search on the list.

Step 4: Choose the suspicious Search from the list of search engine, click Remove to succesfully remove it. Proceed to click OK to save changes.

Step 5: Navigate to Tools > Options. Under the General tab reset the startup homepage or change it to your preferred search engine (ie: google.com, etc).

Step 6: In the URL address bar on Firefox, type: about:config and hit Enter.

Step 7: Finally click I’ll be careful, I promise! to continue.

Step 8: In the search filter at the top of Firefox, type: isearch.claro-search.com

Step 9: You should see all the preferences that were changed by IncrediBar toolbar. To complete the isearch.claro-search.com removal, right-click on the preference and select Reset to restore default value and continue to reset all found preferences!

Optional: Block isearch.claro-search.com Cookie (Firefox)

1. From the Tools menu, select Options
2. In the upper section of the Options window, click Privacy
3. In the Cookies tab, click Exceptions
4. In the new Exceptions – Cookies window, enter isearch.claro-search.com

Google Chrome

This example shows the removal process for an extension named “incredibar”, which is a similar infection. Follow the steps to search through extensions for anything suspicious or which resembles isearch.claro-search.com. If internet settings have been compromised by browser helped type objects then conitnue to follow the instuctions prior to removing or searching for the isearch.claro-search.com extension. The isearch.claro-search.com may be titled something which resesembles isearch.claro-search.com, such as iSearch Toolbar, or Claro Search.
Step 1: Open Chrome, click on the Settings Icon (wrench), and navigate to Tools > Extensions.

Step 2: Select the isearch.claro-search.com plugin from the list and click disable, then remove.

Step 3: Click on the wrench icon once again and select Settings.

Step 4: Click the Manage search engines… button.

Step 5: Select your preferred search engine from the list and make it your default search engine (ie: Google).

Step 6: Select the suspicious Search from the list and remove it by clicking the “X” mark as shown in the image below to finish the removal process.

• Please note: To search which extensions are currently running on Chrome navigate to Tools > Task Manager

Microsoft Internet Explorer

This example shows the removal process for an extension named “incredibar”, which is a similar infection. Follow the steps to search through extensions for anything suspicious or which resembles isearch.claro-search.com. If internet settings have been compromised by browser helped type objects then conitnue to follow the instuctions prior to removing or searching for the isearch.claro-search.com extension. The isearch.claro-search.com may be titled something which resesembles isearch.claro-search.com, such as iSearch Toolbar, or Claro Search.
Step 1: Open IE, click the Tools button and then select Manage Add-ons.

Step 2: Select Search Providers. Choose Bing or Live Search search engine and make it your default web search provider (Set as default).

Step 3: Remove isearch.claro-search.com Web Search engine providers and close the window.

Step 4: Finally navigate to Tools > Internet Options. Select the General tab and click the “use default” button or enter your preferred homepage, such as google.com instead of isearch.claro-search.com. Click OK to save the final changes.

Optional: Block isearch.claro-search.com Cookie (IE)

1. From the Tools menu of Internet Explorer, select Internet Options
2. Select the Privacy tab, and then click Sites. The Per site privacy actions window will be displayed
3. In the Per site privacy actions window, enter isearch.claro-search.com in the Address of Web site field.
4. Click Block

Optional: Restricted site option (IE)

1. Access: Tools(Alt-x) > Internet Options> Security > Restricted sites
2. Click the “Sites” button and enter:  isearch.claro-search.com

Apple Safari

This example shows the removal process for an extension named “incredibar”, which is a similar infection. Follow the steps to search through extensions for anything suspicious or which resembles isearch.claro-search.com. If internet settings have been compromised by browser helped type objects then conitnue to follow the instuctions prior to removing or searching for the isearch.claro-search.com extension. The isearch.claro-search.com may be titled something which resesembles isearch.claro-search.com, such as iSearch Toolbar, or Claro Search.
Step 1: Open Safari, go to Preferences and click Extensions.
Step 2: Remove/Disable the isearch.claro-search.com extension.

3. Manually Remove isearch.claro-search.com

First remove the program using the Uninstaller, then proceed to kill the process, delete files, and remove registries.

• Navigate to Control Panel > Add or Remove Programs ( or Uninstall a program)
• Uninstall isearch.claro-search.com associated programs (Claro LTD Toolar).

1. Kill the isearch.claro-search.com processes

• Open Window’s task manager Ctrl+Shift+Esc (or Ctrl+Alt+Delete > Task Manager)
• Click the “Processes” tab, browse for the isearch.claro-search.com processes (below), right-click each and select “End Process”. (random characters: unknown letter and or number sequences). The process may also be titled clarosearch.exe and clarosearch.dll.

(random characters).exe

Fake svchost.exe

2. Delete the associated isearch.claro-search.com files

Access Window’s Start Menu and search for each file or type %systemroom%, %windows%, %appdata%, and %temp% into the search query individually followed by Enter to immediately enter the associated folders (example pictured below).

C:\Windows\SysWOW64\WScript.exe "%1" %*

%SystemRoot%\SysWow64\CScript.exe "%1" %*

%SystemRoot%\SysWow64\CScript.exe "%1" %*

%Windows%\system32\DRIVERS\[random].sys

%Windows%\system32\fake consrv.dll

%Windows%\system32\fake svchost.exe

%AppData%\(random).exe

%Temp%\(random).class

3. Remove related isearch.claro-search.com registry values

To access Window’s Registry Editor click the “Start” menu and  type regedit in the search field, then press Enter.

While the Registry Editor is open, search and delete the following registry entries listed below by right clicking them and selecting delete.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\(random).exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch=(site address)

HKEY_CLASSES_ROOT\Interface\[random]

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(random)

4. Safe Mode With Networking

For users needing access to the Internet or the network they’re connected to because the virus has malformed settings. This mode is helpful for when you need to be in Safe Mode to troubleshoot but also need access to the Internet for updates, drivers, removal software, or other files to help troubleshoot your issue.

• This mode will also bypass any issues where Antivirus or Anti Malare applications have been affected/malfunctioning because of the infection’s progression.

The plan with this option is to enter your computer in “safe mode with network” and install anti-malware software. Proceed to scan, and remove  malicious files, or manually remove files.
1. Reboot your computer in “Safe Mode with Networking”. As the computer is booting (when it reaches the manufacture’s logo) tap and hold the “F8 key” continuously to reach the correct menu. On the Advanced Boot Options screen, use your keyboard to navigate to “Safe Mode with Networking” and press Enter. Shown below.

• Make sure to log into an account with administrator rights.

The screen may appear black with the words “safe mode” in all four corners. Click your mouse where windows start menu is to bring up necessary browsing.

2. Now, either search for and remove the files manually or use software to scan and remove the infection. If internet connection is still compromised please proceed to the instructions below.
3. If you still can’t access the Internet after restarting in safe mode, try resetting your Internet Explorer proxy settings. These 2 separate options and following steps will reset the proxy settings in the Windows‌ registry so that you can access the Internet again.

How To Reset Internet Explorer Proxy Settings

Option 1
In Windows 7, click the Start button . In the search box, type run, and then, in the list of results, click Run.
-or-
In Windows Vista, click the Start button , and then click Run.
-or-
In Windows XP, click Start, and then click Run.
Copy and paste or type the following text in the Open box in the Run dialog box and click OK:

reg add “HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /v ProxyEnable /t REG_DWORD /d 0 /f

In Windows 7, click the Start button . In the search box, type run, and then, in the list of results, click Run.
-or-
In Windows Vista, click the Start button , and then click Run.
-or-
In Windows XP, click Start, and then click Run.
Copy and paste or type the following text in the Open box in the Run dialog box and click OK:

reg delete “HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings” /v ProxyServer /f

Restart Internet Explorer and follow the steps listed previously to run the scanner.
Option 2
Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab.
Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.

4. It is now recommended to download Malwarebytes (free or paid version) and run a full system scan to remove the iSearch Claro Hijacker Virus.

5. Restore Computer To Date And Time Before Infection

Restoring your Window’s computer to a date and time before you computer was infected by the isearch.claro-search.com viruse will ensure the safety of your internet browser if orchestrated correctly. We have provided instructions for a simple restore for victims who are able to access their desktops correctly, as well as instructions to restore for victims who can not access their operating systems.

Start Menu Restore

Standard directions to quickly access Window’s System Restore Wizard.
1. Access windows Start menu and click All Programs.
2. Click and open Accessories, click System Tools, and then click System Restore.‌
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
3. Restore your computer to a date and time before infection.

Safe Mode With Command Prompt Restore

If you can not access your operating system, this is the suggested step.
1. Restart/reboot your computer system. Unplug if necessary.
2. Enter your computer in “safe mode with command prompt”. To properly enter safe mode,repeatedly pressF8 upon the opening of the boot menu.

3. Once the Command Prompt appears type “explorer” .

4. Once Windows Explorer shows up browse to:

• Win XP: C:\windows\system32\restore\rstrui.exe and press Enter
• Win Vista/Seven: C:\windows\system32\rstrui.exe and press Enter

5. Follow all steps to restore or recover your computer system to an earlier time and date, before infection to complete.

Window’s Restore Information: http://botcrawl.com/how-to-restore-microsoft-windows-vista-microsoft-windows-xp-and-microsoft-windows-7/