Overview
Summary:
Alias:
See Also:
Category:
Spyware: Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior. Many spyware products will collect referrer info (information from your web browser which reveals what URL you linked from), your IP address (a number that is used by computers on the network to identify your computer), system information (such as time of visit, type of browser used, the operating system and platform, and CPU speed.) Spyware products sometimes wrap other commercial products, and are introduced to machines when those commercial products are installed. See also Adware.
Variants:
Similar Pests:
Origins
Group:
By This Group:
Mailing Address:
Phone:
EMail:
URL:
Date of Origin:
Distribution
Distribution:
Prevalence:
Clot Factor:
The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.
Growth:
Operation
Advertising:
Storage Required:
Risks
Privacy Issues:
Privacy Policy:
"ShopAtHomeSelect.com may also collect certain information online and offline deriving from your navigation of ShopAtHomeSelect.com and our Affiliate Merchants, including but not limited to the number and type of offers you have responded to and completed, so that we can make future relevant and personalized offers to you.
"ShopAtHomeSelect.com uses cookie technology to understand general information on site traffic trends such as most frequently visited pages or Affiliate Merchants."
from http://www.shopathomeselect.com/privacy.asp
Security Issues:
Stability Issues:
Detection and Removal
Caution!!!:
Automatic Removal:
PestPatrol detects this.
PestPatrol removes this.
Manual Removal:
Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry (Start->Run->regedit) and deleting the key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopAtHomeSelect Agent'.
If the above procedures do not work for any reason, you may remove SAHAgent manually, but at great risk of losing your network and Internet connections.
Open the registry (Start->Open->regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run . Delete the 'SAHAgent' entry.
Next, deregister the LSP part of ShopAtHomeSelect. Run 'regedit' and find the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 . For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
Next, open a DOS command prompt window (from Start->Programs->Accessories) and enter these commands:
cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
cd "..\Downloaded Program Files"
del WEBinstaller.dll
del SAH*.exe
Restart the computer and you should be able to delete the files 'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe' and 'SahAgent.exe' from the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP).
You can also delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\VGroup to clean up if you like. PestPatrol 4.3 provides CleanSAHAgent.exe to perform this removal automatically.
Kill these running processes with Task Manager:
Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ap9h4qmo , delete it and reboot the machine immediately.
If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\gah95on6, delete it and reboot the machine immediately.
If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\sahagent, delete it and reboot the machine immediately.
If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\sahbundle, delete it and reboot the machine immediately.
Unregister these DLLs with Regsvr32, then reboot:
Remove these registry items (if present) with RegEdit:
Remove these files (if present) with Windows Explorer:
Research
File Analyses:
- SAHAgent: 70tovmto.exe · a95kfrhe.exe · ap9h4qmo.exe · ap9h4qmo.ini · bundle.exe · cleansahagent.dof · cleansahagent.exe · gah95on6.exe · goldenretrievereula.txt.lnk · lsp.dll · lsp_.dll · mailpart1 · messagebody.txt · messagehistory.txt · ntmsjrnl · pestinfoimportme.txt · q17i9a4j.exe · qh4mkbv9.dll · sahagent.exe · sahagent.log · sahagent_.exe · sahagent-cdt1004.exe · sahhtml.exe · sahhtml_.exe · sahpackage.exe · sahuninstall.exe · sahuninstall_.exe · setup.inf · shopathome.lnk · shopathomememberagreement.txt.lnk · shopathomeprivacy.txt.lnk · tmpmpt1.tmp · v.dat · vg.dat · vp.dat · webinstaller.dll
- ShopAtHomeSelect: a95kfrhe.exe · ap9h4qmo.exe · apphelp3.exe · info.txt · installer_marketing12.exe · mailpart1 · messagebody.txt · messagehistory.txt · pcsync.exe · ucmoreiex.exe