SRCHASST fightin' the "format"

[HELP ME]

Ok This is BY FAR the most annoying bug I have ever gotten
and unless microsoft or another spyware company steps up,
I'll be formatting soon. I have tried everything I can
find to fix this Search Assistant (srchasst) parasite and
NONE of it works. I still have spysubtractor warnings
about Browser changes all the time. Spyhunter, CW
SHREDDER/SPY SUBTRACT, and microsoft have all proven (as
have I)incapable of dealing with this bug. I also just
scanned with symantac online and again nothing. In
windows\srchasst there are 4 files I believe are primarily
responsible:
msgr3en.dll
nls302en
srchctls.dll
srchui.dll
ALSO
It adds atleast one value in the registry in:
HKEY_CURRENT_USER - Software\Microsoft\Internet
Explorer\Main

but there are probably others...

When I delete that value or one of the afore mentioned 4
files they will reappear within seconds. (Does anyone know
How I could go about deleting them - I don't see anything
in task manager processes I believe to be responsible).
This SearchAssistant bug is driving me crazy!!! In
addition to the other symptoms I listed in previous
threads, here's the newest ones: Web browsing is way too
slow, I have tons of popups, and it creates new values
each time my computer reboots in the Favorites.
While I can't find a way to get this thing off of here, I
found a site that suggests this is the (THERE AREN'T
ADJECTIVES VULGAR ENOUGH) company responsible:
Registrant:
Odysseus Marketing, Inc.
8721 Santa Monica Blvd #409
Los Angeles, CA 90069-4507

Domain Name: SEARCHASSISTANT.NET
Administrative Contact:
Jones, Ed (e-mail address removed)
Odysseus Marketing, Inc.
8721 Santa Monica Blvd #409
Los Angeles, CA 90069-4507

213-947-1271
Record expires on 01-May-2006.
Record created on 29-Sep-2003.
Database last updated on 12-Jan-2004 21:59:36 EST.
Domain servers in listed order:
NS.SERVINT.COM 209.50.225.13
NS2.SERVINT.COM 209.50.225.12
NS01.BACKUPDNS.COM 199.242.242.199

If someone's aware of a law they're breaking, please
either report them or let me know and I will.

Don't Know if this'll work, but I just dumped the actual
program srchasst from windows...
To remove/block srchasst
On the "Run" line type "Regedit"
Go to HKEY_CURRENT_USER \Software\Microsoft\ Windows \
CurrentVersion \ Explorer \ CabinetState \
Right-click an empty space in the right pane and select
New > String Value
Name the new value Use Search Asst
Double-click this new value, and enter no as it's Value
data
Close the registry editor

 

[Guest]

I had the same problem last month and I used
Spywareblaster 3.2 and Hijackthis v1.99 to get rid of
this. The "srchasst" Folder and some of the files are
made when you install windowsXP. But it seems the
SpyWare attachs it's self to this Directory. I wish you
the best of luck on getting it off your system. It took
me 5 days to get it out and there is lots of info on the
net to help you out. Oh ya, there is more then one
version of this sypware. I couldn't figure out which one
I had!!!

John

 

[Steve Wechsler [MVP]]

The files you listed are system files that will be replaced by WFP every
time you delete them. Not quite certain which parasite has infested the
system, but here's a step by step methodology for removing
Home Search Assistant/Home Search :
http://www.bleepingcomputer.com/forums/topict3341.html

If a different variant is the culprit, please identify specifically
which one it is .

Steve Wechsler (akaMowGreen)
MVP Windows Server - Software Distribution
Windows - Security