Spyware, Viruses, & Security forum


help: Claro virus downloaded from CNET downloader

by jassure / December 7, 2012 7:44 AM PST

This is an alert, question, and rant! At my direction (!), my students downloaded the Claro Search virus from CNET downloader while installing some other software (Eraser). They use Chrome. They have deleted browser add-ons installed by Claro, de-selected Claro as the default browser, and run Malwarebytes. Apparently Malwarebytes did not detect the virus, though other forums have recommended it as fixing the problem. Students have been unable to uninstall Claro: it still shows up in the Windows 7 uninstaller program list. Also, there is concern about what Claro is doing behind the scenes since they are unable to delete it. Any advice on how to get rid of it for good, including from the list of programs in Windows 7 uninstaller? Any knowledge about what malicious activity Claro may do, aside from being hard to get rid of? For the rant part, I'm so disappointed in CNET and will no longer direct students to this site, or download software from it myself. I am embarrassed that I have been telling students for some years that CNET is a safe site to download software. Why would CNET allow software like Claro to be bundled in the Downloader?

Discussion is locked
You are posting a reply to: help: Claro virus downloaded from CNET downloader
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: help: Claro virus downloaded from CNET downloader
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
As a teacher you should FIRST ...
by Edward ODaniel / December 7, 2012 12:20 PM PST

familiarize yourself with what a virus is and what it isn't. At most Claro-search.com could be classes as a search hijacker.

Since it is a search engine that many use by choice (see for yourself at http://www.claro-search.com/ ) it is often offered as an included download that you can AT YOUR OPTION install with the utility you actually wanted. During installation, YOU, the installer, can easily opt to NOT install the additional software but there is the assumption that you are paying attention to EXACTLY what you are doing rather than blindly clicking buttons. Yahoo, Ask, and Google as well as Bing all do the same thing and are offered up in the same way.

Here is a handy link demonstrating how to remove it if you don't want it -

As a teacher you should be instructing your students to pay attention to what they are doing at all times (attention to detail) AND you should test things before assigning them to be done by students. For instance if you had gone to download.com and searched for ERASER you would have got this page and the green download link is a direct link:

If you had the students look at the ERASER page here http://download.cnet.com/Eraser/3000-2092_4-10231814.html?tag=mncol;5 you would be seeing the green Download button which also indicates that it is CNET Installer enabled and has a handy little Info icon that tells you about the offering of additional software. Then just below that green download button it doesn't even take a really sharp eye to see the words DIRECT DOWNLOAD LINK

You do not mention what you teach but let us hope that it is not computer science at ANY LEVEL!

Collapse -
reply to ODaniel
by jassure / December 8, 2012 1:21 AM PST

Thank you for your reply. Just to clarify, I have used Eraser for 2-3 years now, and I have downloaded many tools from CNET for years. So, I have installed and used software that I have passed on to students. I realize that Claro is technically not a virus since it does not replicate. However, it has been referred to as a virus in several other web forums (including the one you sent a link to on im-infected....note the word "infected"), likely because it behaves in an unexpected manner, and it is very difficult to uninstall. It has also been referred to in other forums as a browser hijacker. If Claro were merely a search engine tool, it would not be a serious challenge to get rid of it. Given it's persistence, I believe it is not as innocent of a utility as your post suggests.

Regarding the im-infected.com link, the students tried the suggestions on that site, and still see Claro show up in the Microsoft program uninstaller list. So, aside from your comments being unnecessarily harsh, they didn't even answer my question on how to delete it out of Microsoft program uninstaller.

While it is true that one should pay attention while installing software, the reality is that a person can inadvertently click on Continue during an installation and install a utility by accident, as these 2 students did. I would not expect CNET to bundle software that is so hard to uninstall, and that has been nicknamed a virus, regardless of its technical classification. As harsh as your reply is, even the site you recommended to me calls Claro a virus, likely because of its strange behavior and persistence in trying to remove it.

Collapse -
Exactly right
by clarovictim / December 10, 2012 8:22 AM PST
In reply to: reply to ODaniel

CLARO is bad malware - that's all there is to it. Try a system restore in windows.

Collapse -
help from anyone else?
by jassure / December 8, 2012 1:41 AM PST

Claro is persistent and unpredictable spyware. So aside from wanting to know how to remove it so that it no longer shows up in the Windows uninstaller list, I would also like to know if its spying activities are constrained to only when a user uses it search engine. In other words, how damaging is it?

Collapse -
It's minimal...
by John.Wilkinson / December 8, 2012 1:35 PM PST
In reply to: help from anyone else?

Claro is limited to hijacking your search page and installing an unwanted toolbar - it does not verge into the realm of keylogging or other surreptitious spying. And while it's not a virus, it is malware and a PUP (potentially-unwanted program).

For removal of browser hijackers, HiJackThis is a lightweight security app from Trend Micro that I continue to recommend. And for a broader cleaner that's not limited to hijackers, MBAM has a free version with full removal capabilities. Either one should be able to remove Claro in its entirety.

Finally, regarding the download that started this all, always use the "direct download" link that CNET offers under the large download button. (If there is no "direct download" link, the download button should provide the download without the CNET Installer, with the program's developer having opted-out of the 'wrapper.') There have been numerous thread on the subject, but I would classify nearly all of the offers from CNET Installer to be PUPs (and sometimes worse) and strongly recommend avoiding it.


Collapse -
Thank you!
by jassure / December 9, 2012 5:13 PM PST
In reply to: It's minimal...

Thank you John. This was really helpful information.

Collapse -
Hijack This didn't work
by Newtire / March 5, 2014 2:18 AM PST
In reply to: It's minimal...

I got ahold of the Claro Toolbar somehow and it was particularly troublesome in that it cost me lots of work-time on my computer, costing me money and giving me headaches. No matter what you want to call it, it is one giant PITA and I would love to meet this idiot who set this thing up and give them a taste of my own form of justice. Oh well, if wishes were horses ...I tried all the usual stuff starting with system restore and going thru all the advice given so far in this thread to no avail. The IT guy at the company I work for installed Hijack This remotely and that didn't help. I finally ran across a program called Hitman Pro and that killed it.

What I wonder is, why isn't there something we can all do legally against these clowns? I really really doubt that anyone uses this program as a search function unless they are complete novices.

I myself am not a genius nor am I an idiot and I'll bet most of us here are in the same boat but still, we couldn't get rid of this thing on our own. It is a bad thing if it costs other people money don't you think?

Collapse -
Hijackthis is a tool.
by R. Proffitt Forum moderator / March 5, 2014 2:20 AM PST

One of many. PLEASE START A NEW DISCUSSION as this old post is closing.

Then we can discuss tools we use today.

Collapse -
I just wanted to clarify.....
by Saysi / December 8, 2012 2:02 PM PST
In reply to: help from anyone else?

It is simply untrue to say that when you 'OPT OUT' of having the bundle of other software with your download that it doesn't install, because it does, every single time, even when I have opted out and clicked all 3 boxes to opt out and just have my download.

Another little trick that occurs I have noticed is that when you are agreeing /confirming to uninstall, a small (already ticked) box is just under the 'yes' to uninstall box, that asks if you want to confirm the addition of further add ons..it could and does go on forever..the clean up after using CNet on clean fresh installs today on 3 computers, has taken me all night with 2 different progs, as they all pick up extra parts of these hard to unistall add ons that come bundled with the software you wanted.

I chose to not have ANY of them but still ended up with all of them!

I never noticed the direct uninstall link on any of the downloads, so maybe it should be larger as when you see a large green 'DOWNLOAD' sign you don't look for another way to download as usually its not needed!

The worst to get rid of was 'Funmoods' which came bundled with something from CNet.

I thought I had eventually cleared all traces of it but no..it kept showing up after being cleaned over and over..very hard to get rid of and I use Iobit uninstaller which also clears all the remnants it can find after an uninstall, but still it would show up in repeated registry cleans etc.
I also downloaded AOL 7 desktop for my daughter and 3 times, on a clean installation, it wouldn't open after the installation. It downloads then gets so far then closes down. It also had so much spyware with it that it maybe lost parts of it in the cleaning the PC process.

I have got so wary of downloading due to these problems from Cnet I am now going elsewhere. I will though try the 'direct download' link now I know about it!

I could always rely on Cnet in the past..I never downloaded from anywhere else.

Personally I would rather PAY a small sum for a currently free download than have to clean all these 'extras' off every time I download.

Collapse -
If you find the OPT OUT fails. Tell us.
by R. Proffitt Forum moderator / December 9, 2012 2:07 AM PST

Be exact and supply the link on the one that failed. The moderators will kick it up for you.

And we (moderators) often try it for folk that are willing to engage in a dialog about it.

Collapse -
Thanks for response by Mods, will keep a note next time
by Saysi / December 18, 2012 4:58 AM PST

Thank you, I will let moderators know in future which downloads fail the 'opt out ' tick boxes (it seemed like MOST of them!) and downloaded the add on's.

It is not that they are malicious but tenacious and when I have just used DBan to wipe the drives, it's frustrating to have things on there I have no purpose for and cannot easily remove. Installing on 3 computers I lost track and didn't know I would find this page!

I have now had to install on another Pc and used CNet, and looked for the 'direct download' link which appears under some of the downloads, not all, and my experience has been much improved.. it also seems that CNet have more downloads with fewer bundled accompanying software..would that be the case?

It seems that more progs downloaded without, this time around, though not all, and I am having a problem losing 'Feedsnap-Do' on my Google address bar..came bundled with something from CNet , said it would uninstall in add/remove progs which it does, but leaves behind its tracks all over.

Apologies for not making a note of all the progs as i downloaded them, but now I know of this forum I will. I looked for it because I was so p***ed off with CNet that night! LOL

Last night's experiences have been better..some 'opt out' boxes worked, others not, Wacom ( ? or similar) as well as Claro again and Feed Snap kept arriving despite me clicking to not install it!
I use Super Antispyware, AntiMalware Bytes, Spybot, Esset, Hitman Pro and Avast, CCleaner, WinAso, and as needed, Hitman Pro etc, but these blighters do resist all the usual removal softwares! I often end up going into the regsitry to delete them which is time that could be better spent!

Collapse -
crooked posters in this forum re: claro and funmoods
by wakeupstupid / March 1, 2013 1:43 AM PST

Like the poster I am responding to, I too unchecked the boxes that would have been responsible for funmoods getting into my computer. To the forum people who chastise people for downloading it, I question your ethics. I wonder if you are not paid in some way to defend these companies. None of your suggestions to remove it work.
Lastly I ask this to the defenders in this forum: Why, with search engines like Google out there would anybody in their right mind choose to install funmoods or Claro, or whatever scumbag company is the evil creator of this. Shame on all of you.

Collapse -
claro is an evolving nightmare

Hey Wakeupstupid,
I don't think the people in this fourm are intentionally promoting their software to remove Claro.
Yet, all traditional methods of removing it simply fail. Norton, AVG, Malwaware bytes, etc...simply do nothing about this malware/ possible future spyware.

Collapse -
CLARO is awful malware.
by clarovictim / December 10, 2012 8:19 AM PST

I am not alone in thinking CLARO is a nasty piece of malware. It is impossible to remove and updates itself to combat the latest suggestions regarding said removal. CNET has disappointed severely over this one.

Collapse -
Your a donkeys behind
by Claro_Victim_from_CNET / March 7, 2013 4:18 PM PST

Sorry, I don't like to be rude, yet Mr. Edward, you are a donkey's behind.
It sounds as if you are promoting Claro.

In virtually ever persons eyes, Claro is the most destructive software in the last 5 years.
Why are you defending it?

Collapse -
Another Claro victim here I'm afraid
by clarovictim / December 10, 2012 8:17 AM PST

I too unwittingly downloaded Claro from CNET and I am appalled and disgusted that this once trusted site could have sunk so low. A quick google search of cnet and claro will reveal a tide of opinion damning CNET and this practice. I was really surprised that CNET could do this....Claro is a nasty piece of malware full stop and is time consuming to remove. It is not a case of downloader beware with regards to being careful on what links to press. There simply should be no malign links available. Again, I am appalled by this and will not be going to CNET for software or any other service. Why did they do this? I'm still aghast.

Collapse -
by rhallman02 / December 16, 2012 10:41 PM PST

I think I got rid of it but it took hours of my life, I'll never get back.
Complicating it for me is that I'm on Windows 8 and IE 10 did not behave as the posted removal suggestions expected - the "tools" function was grayed out. After 2 failed windows restore attempts, for some reason the "tools" function was again accessible. Firefox was easy to fix and I uninstalled and re-installed Chrome. Norton Internet Security version 20.2 did NOT catch this. After the fact I've also run Malwarebytes and it didn't find anything - HOPEFULLY it's gone.

Collapse -
by giedmaja / December 17, 2012 7:31 PM PST
In reply to: Ditto

The removal of claro search is much simpler if you uninstall everything you installed in the same day you started seeing it on your PC.
The problem is, differently from most toolbars, it gets reinstalled right away if you try changing search providers. So scanning with anti-malware programs might not always help.
Best things to try is Adwcleaner from bleepingcomputer for such add-ons, though once you uninstall everything, simple change of search provider will work to get rid of claro :
On Internet explorer:
Click arrow on the right of search box
Do following: On IE8-9 choose Manage Search providers,
On ie7 click change search defaults.
Delete Claro Search from the list
Reset home page as well
On Firefox :Enter "about:config" in url bar.
Type "Keyword.url" in the search box. Right click it & reset it.
Type "browser.search.defaultengine" in the search box.
Right click it & reset it.Type "browser.search.selectedengine" in the search box.
Right click it & reset it.
Search for 'browser.newtab.url'. Right-click and reset.

Note: This post was edited by a forum moderator to remove questionable link that maybe harmful to others on 12/18/2012 at 9:54 AM PT

Collapse -
Wow, I'm NOT the only one

I had the same Claro malware problem as everyone is talking about.
I've spent 5-6 hours of my life, much frustration and disbelief over CNET on this.

As for claro, its still the home page of most of my browsers. Otherwise, it seems to be mostly removed.
How could CNET get involved with this AND STILL BE INVOLVED is beyond me?
www.download.com will be a company of the past if they don't fix this soon. Yet, there doesn't seem to be any alternative sites that are trustworthy yet to get CNET like products.

I realize CNET is needing revenue, but this type of revenue is like chopping the head of the golden goose. Sure you might get a few golden eggs quick, yet they just killed the golden goose called download.com

I need some softeware right now from CNET, but I won't get it as I am terrified of Claro.

Popular Forums
Computer Help 49,613 discussions
Computer Newbies 10,349 discussions
Laptops 19,436 discussions
Security 30,426 discussions
TVs & Home Theaters 20,308 discussions
Windows 10 360 discussions
Phones 15,802 discussions
Windows 7 7,351 discussions
Networking & Wireless 14,641 discussions


Free trip to the Grand Prix

Don't miss your chance to win a trip to the Formula 1 Grand Prix in Monaco for you and a plus-one.