2 Cool Fishing Forum banner
1 - 3 of 3 Posts

·
Registered
Joined
·
17,210 Posts
Discussion Starter · #1 ·
Have you ever heard of Shopathome spyware. I got it and can't get rid of it. I have used Spybot and it will almost remove all of it but tells me than parts of it can't be removed till I restart. I restart them it tells me there are nothing there. When I restart the puter back and run Spybot again it is there again in full. I even tried to remove it in safe mode. It just keeps comming back. I went regedit and removed the files there for it. Still keeps comming back. Any more ideals?
 

·
Premium Member
Joined
·
40,471 Posts
SAHAgent

It's sometimes called Golden retreiver.

How to Remove SAHAgent ?
SAHAgent is a Winsock2 Layered Service Provider. If you merely delete registry entries and files, you stand a good chance of losing your network and Internet connections.

Follow these removal instructions to remove SAHAgent from your computer:

  1. Click Start > Settings > Add/Remove Programs > Control Panel, and select the entry 'ShopAtHomeSelect Agent' and click 'Remove' to remove the software.
  2. Reboot your Windows.
  3. Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
  4. If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start > Run > regedit) and deleting the key:
    'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'.
If the above procedures do not work for any reason, you may manually remove SAHAgent, but at great risk of losing your network and Internet connections:

  1. Open the registry editor (click Start > Open > regedit ).
  2. Navigate to the key : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

    In the right pane delete the 'SAHAgent' entry.
  3. Deregister the LSP part of ShopAtHomeSelect.
    In the registry editor, find the key
    HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WinSock2 \ Parameters \ Protocol_Catalog9
    . For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
  4. Open a DOS command prompt window (from Start > Programs > Accessories) and enter these commands:

    cd "%WinDir%\System"
    regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
    cd "..\Downloaded Program Files"
    del WEBinstaller.dll
    del SAH*.exe
    del setup.inf
    del xmlparse_.inf
    del xmltok_.inf
    del C:\sahagent.log
    Note: %WindDir% is a variable, by default this is c:\windows on Windows 95/98/Me/XP or c:\winnt on windows 2000/NT.
  5. Restart the computer.
  6. Open the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP), delete the following files:
    'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe', 'SahAgent.exe' and 'SAHhtml.exe'
  7. Open Windows folder, delete the file SAHUninstall.exe.
  8. Delete the following registry keys to clean up:

    HKEY_LOCAL_MACHINE\SOFTWARE\VGroup
    HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2\Layered Provider Sample (or the
    entire Winsock2 key since it is a duplicate of the real key)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
    Management\ARPCache\ShopAtHomeSelect Agent
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S
    hopAtHomeSelect Agent
 

·
Registered
Joined
·
17,210 Posts
Discussion Starter · #3 ·
It worked its gone
 
1 - 3 of 3 Posts
Top