SRCHASST parasite hijacker

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

This is BY FAR the most annoying bug I have ever gotten
and unless microsoft or another spyware company steps up,
I'll be formatting soon. I have tried everything I can
find to fix this Search Assistant (srchasst) parasite and
NONE of it works. I still have spysubtractor warnings
about Browser changes all the time. Spyhunter, CW
SHREDDER/SPY SUBTRACT, and microsoft have all proven (as
have I)incapable of dealing with this bug. I also just
scanned with symantac online and again nothing. In
windows\srchasst there are 4 files I believe are primarily
responsible:
msgr3en.dll
nls302en
srchctls.dll
srchui.dll
ALSO
It adds atleast one value in the registry in:
HKEY_CURRENT_USER - Software\Microsoft\Internet
Explorer\Main

but there are probably others...

When I delete that value or one of the afore mentioned 4
files they will reappear within seconds. (Does anyone know
How I could go about deleting them - I don't see anything
in task manager processes I believe to be responsible).
This SearchAssistant bug is driving me crazy!!! In
addition to the other symptoms I listed in previous
threads on the spyware beta newsgroup - general site, here's the newest
ones: Web browsing is way too
slow, I have tons of popups, and it creates new values
each time my computer reboots in the Favorites.
While I can't find a way to get this thing off of here, I
found a site that suggests this is the (THERE AREN'T
ADJECTIVES VULGAR ENOUGH) company responsible:
Registrant:
Odysseus Marketing, Inc.
8721 Santa Monica Blvd #409
Los Angeles, CA 90069-4507

Domain Name: SEARCHASSISTANT.NET
Administrative Contact:
Jones, Ed hostmaster@odysseusmarketing.com
Odysseus Marketing, Inc.
8721 Santa Monica Blvd #409
Los Angeles, CA 90069-4507

213-947-1271
Record expires on 01-May-2006.
Record created on 29-Sep-2003.
Database last updated on 12-Jan-2004 21:59:36 EST.
Domain servers in listed order:
NS.SERVINT.COM 209.50.225.13
NS2.SERVINT.COM 209.50.225.12
NS01.BACKUPDNS.COM 199.242.242.199

If someone's aware of a law they're breaking, please
either report them or let me know and I will.

I doubt this works and it for sure won't delete this thing, but I just
dumped the actual program srchasst from windows... by:
To remove/block srchasst
On the "Run" line type "Regedit"
Go to HKEY_CURRENT_USER \Software\Microsoft\ Windows \
CurrentVersion \ Explorer \ CabinetState \
Right-click an empty space in the right pane and select
New > String Value
Name the new value Use Search Asst
Double-click this new value, and enter no as it's Value
data
Close the registry editor

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Try the following:

Microsoft Windows AntiSpyware (Beta)
http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.mspx

------------------------------------------------------------------------------

"HELP ME" wrote:

| This is BY FAR the most annoying bug I have ever gotten
| and unless microsoft or another spyware company steps up,
| I'll be formatting soon. I have tried everything I can
| find to fix this Search Assistant (srchasst) parasite and
| NONE of it works. I still have spysubtractor warnings
| about Browser changes all the time. Spyhunter, CW
| SHREDDER/SPY SUBTRACT, and microsoft have all proven (as
| have I)incapable of dealing with this bug. I also just
| scanned with symantac online and again nothing. In
| windows\srchasst there are 4 files I believe are primarily
| responsible:
| msgr3en.dll
| nls302en
| srchctls.dll
| srchui.dll
| ALSO
| It adds atleast one value in the registry in:
| HKEY_CURRENT_USER - Software\Microsoft\Internet
| Explorer\Main
|
| but there are probably others...
|
| When I delete that value or one of the afore mentioned 4
| files they will reappear within seconds. (Does anyone know
| How I could go about deleting them - I don't see anything
| in task manager processes I believe to be responsible).
| This SearchAssistant bug is driving me crazy!!! In
| addition to the other symptoms I listed in previous
| threads on the spyware beta newsgroup - general site, here's the newest
| ones: Web browsing is way too
| slow, I have tons of popups, and it creates new values
| each time my computer reboots in the Favorites.
| While I can't find a way to get this thing off of here, I
| found a site that suggests this is the (THERE AREN'T
| ADJECTIVES VULGAR ENOUGH) company responsible:
| Registrant:
| Odysseus Marketing, Inc.
| 8721 Santa Monica Blvd #409
| Los Angeles, CA 90069-4507
|
| Domain Name: SEARCHASSISTANT.NET
| Administrative Contact:
| Jones, Ed hostmaster@odysseusmarketing.com
| Odysseus Marketing, Inc.
| 8721 Santa Monica Blvd #409
| Los Angeles, CA 90069-4507
|
| 213-947-1271
| Record expires on 01-May-2006.
| Record created on 29-Sep-2003.
| Database last updated on 12-Jan-2004 21:59:36 EST.
| Domain servers in listed order:
| NS.SERVINT.COM 209.50.225.13
| NS2.SERVINT.COM 209.50.225.12
| NS01.BACKUPDNS.COM 199.242.242.199
|
| If someone's aware of a law they're breaking, please
| either report them or let me know and I will.
|
| I doubt this works and it for sure won't delete this thing, but I just
| dumped the actual program srchasst from windows... by:
| To remove/block srchasst
| On the "Run" line type "Regedit"
| Go to HKEY_CURRENT_USER \Software\Microsoft\ Windows \
| CurrentVersion \ Explorer \ CabinetState \
| Right-click an empty space in the right pane and select
| New > String Value
| Name the new value Use Search Asst
| Double-click this new value, and enter no as it's Value
| data
| Close the registry editor
|

 

[Dave]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

it may not show in task manager, go to the services control panel and see if
there are any services you don't recognize running. that is a common way
for some of those worms to 'repair' themselves, they install a service that
monitors their running process and files and replaces or restarts them as
needed. check carefully, they also do things like imitate common names so
they may look 'normal' at first glance but may be one letter off from a real
service or exe.

"HELP ME" <HELP ME@discussions.microsoft.com> wrote in message
news:507661A5-5F94-4D4A-8431-AA62A3E6AFAF@microsoft.com...
> This is BY FAR the most annoying bug I have ever gotten
> and unless microsoft or another spyware company steps up,
> I'll be formatting soon. I have tried everything I can
> find to fix this Search Assistant (srchasst) parasite and
> NONE of it works. I still have spysubtractor warnings
> about Browser changes all the time. Spyhunter, CW
> SHREDDER/SPY SUBTRACT, and microsoft have all proven (as
> have I)incapable of dealing with this bug. I also just
> scanned with symantac online and again nothing. In
> windows\srchasst there are 4 files I believe are primarily
> responsible:
> msgr3en.dll
> nls302en
> srchctls.dll
> srchui.dll
> ALSO
> It adds atleast one value in the registry in:
> HKEY_CURRENT_USER - Software\Microsoft\Internet
> Explorer\Main
>
> but there are probably others...
>
> When I delete that value or one of the afore mentioned 4
> files they will reappear within seconds. (Does anyone know
> How I could go about deleting them - I don't see anything
> in task manager processes I believe to be responsible).
> This SearchAssistant bug is driving me crazy!!! In
> addition to the other symptoms I listed in previous
> threads on the spyware beta newsgroup - general site, here's the newest
> ones: Web browsing is way too
> slow, I have tons of popups, and it creates new values
> each time my computer reboots in the Favorites.
> While I can't find a way to get this thing off of here, I
> found a site that suggests this is the (THERE AREN'T
> ADJECTIVES VULGAR ENOUGH) company responsible:
> Registrant:
> Odysseus Marketing, Inc.
> 8721 Santa Monica Blvd #409
> Los Angeles, CA 90069-4507
>
> Domain Name: SEARCHASSISTANT.NET
> Administrative Contact:
> Jones, Ed hostmaster@odysseusmarketing.com
> Odysseus Marketing, Inc.
> 8721 Santa Monica Blvd #409
> Los Angeles, CA 90069-4507
>
> 213-947-1271
> Record expires on 01-May-2006.
> Record created on 29-Sep-2003.
> Database last updated on 12-Jan-2004 21:59:36 EST.
> Domain servers in listed order:
> NS.SERVINT.COM 209.50.225.13
> NS2.SERVINT.COM 209.50.225.12
> NS01.BACKUPDNS.COM 199.242.242.199
>
> If someone's aware of a law they're breaking, please
> either report them or let me know and I will.
>
> I doubt this works and it for sure won't delete this thing, but I just
> dumped the actual program srchasst from windows... by:
> To remove/block srchasst
> On the "Run" line type "Regedit"
> Go to HKEY_CURRENT_USER \Software\Microsoft\ Windows \
> CurrentVersion \ Explorer \ CabinetState \
> Right-click an empty space in the right pane and select
> New > String Value
> Name the new value Use Search Asst
> Double-click this new value, and enter no as it's Value
> data
> Close the registry editor
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

AHHH, I'm having the same problem... It's such a pain in the ass... this
is the only thing i can find on it, so far... please help. I know this
is an old topic, but still...


--
Puzzlerf