Help! I have begin2search toolbar AND SAHagent!

By DGutierrez32
Mar 17, 2005
  1. Hi everyone. For some reason my computer has recently acquired both the toolbar, as well as the SAHagent (shopathome). The toolbar is highlighting certain words (i.e. "search", "virus scan", "e-mail", "download", "link", etc.) in Internet Explorer, and I believe it is the SAHagent that is bombarding me with pop ups every time I open IE. I am 99.9% sure that I have not downloaded anything that I shouldn't have, although I share this computer, so it could have been someone else. I have tried running Ad-Aware and Spybot S&D several times but I still get the tracking cookies that I believe are associated with the SAHagent.

    Although the "" toolbar no longer shows up as an option under IE>View>Toolbars, I still get the highlighted words. I have read the sticky on fully removing the "" toolbar, and I will try it as soon as I'm finished with this post.

    As for the SAHagent, I had a program on my computer called "Shop At Home Select Cash Back" which I quickly uninstalled. I also went to the registry and deleted the "SAH" entry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

    I'm trying to follow instructions on removing SAHagent from the website However, I am unfamiliar as to what these specific instructions mean:

    "Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
    If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start > Run > regedit) and deleting the key:
    'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'."

    Specifically, I don't know where the "Downloaded Program Files" folder is (I'm assuming it's not the same as C:program Files). Also, I don't see "SAHUninstall.exe" in C:WINDOWS or "SahAgent.log" in C: drive.

    I'm also puzzled on what to do based on these instructions:

    "In the right pane delete the 'SAHAgent' entry.

    Deregister the LSP part of ShopAtHomeSelect.
    In the registry editor, find the key
    HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WinSock2 \ Parameters \ Protocol_Catalog9. For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.

    Open a DOS command prompt window (from Start > Programs > Accessories) and enter these commands:

    cd "%WinDir%\System"
    regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
    cd "..\Downloaded Program Files"
    del WEBinstaller.dll
    del SAH*.exe
    del setup.inf
    del xmlparse_.inf
    del xmltok_.inf
    del C:\sahagent.log
    Note: %WindDir% is a variable, by default this is c:\windows on Windows 95/98/Me/XP or c:\winnt on windows 2000/NT.

    Restart the computer.

    Open the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP), delete the following files:
    'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe', 'SahAgent.exe' and 'SAHhtml.exe'
    Open Windows folder, delete the file SAHUninstall.exe.
    Delete the following registry keys to clean up:

    HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2\Layered Provider Sample (or the
    entire Winsock2 key since it is a duplicate of the real key)
    Management\ARPCache\ShopAtHomeSelect Agent
    hopAtHomeSelect Agent"

    I get to the second step in the command prompt instructions and I get this message: "Load Library("..\Downloaded Program Files\WEBinstaller.dll") failed -The specified module could not be found.

    I've looked in the registry for the keys to delete but I don't see any of them there.

    My computer is a Pentium 4, 1.6 GHz

    512 MB pc2100 ddr total system memory

    C: Drive - 70.5 GB Total, 49.7 GB Available
    D: (SYSTEM_SAV) Drive - 3.98 GB Total, 1.12 GB Available

    NVIDIA 64 MB GeForce2 MX 200 Video Card

    Another thing I'd like to get rid of is the message that pops up everytime Windows starts.

    "Error loading C:\Program Files\Wild Tangent\Apps\CDA\cdaEngine0400.dll
    The specified module could not be found." ​

    Is there a way to make this problem go away without harming my computer?

    I would like some advice on possibly getting rid of some programs that I don't use very often. But I don't know what I can remove without harming my computer or making other programs fail to function properly.

    Attached is my hijack this log. Any type of help or advice would be greatly appreciated.
  2. tbrunt3

    tbrunt3 TS Rookie Posts: 313

    Hello Welcome to Techspot

    This will help you how to remove cool web

    How to post your hijackthis log and what do I need can be found here
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...