DGutierrez32
Posts: 18 +0
Hi everyone. For some reason my computer has recently acquired both the begin2search.com toolbar, as well as the SAHagent (shopathome). The begin2search.com toolbar is highlighting certain words (i.e. "search", "virus scan", "e-mail", "download", "link", etc.) in Internet Explorer, and I believe it is the SAHagent that is bombarding me with pop ups every time I open IE. I am 99.9% sure that I have not downloaded anything that I shouldn't have, although I share this computer, so it could have been someone else. I have tried running Ad-Aware and Spybot S&D several times but I still get the tracking cookies that I believe are associated with the SAHagent.
Although the "begin2search.com" toolbar no longer shows up as an option under IE>View>Toolbars, I still get the highlighted words. I have read the sticky on fully removing the "begin2search.com" toolbar, and I will try it as soon as I'm finished with this post.
As for the SAHagent, I had a program on my computer called "Shop At Home Select Cash Back" which I quickly uninstalled. I also went to the registry and deleted the "SAH" entry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
I'm trying to follow instructions on removing SAHagent from the website
www.spyany.com/program/article_spy_rm_SAHAgent.html. However, I am unfamiliar as to what these specific instructions mean:
"Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start > Run > regedit) and deleting the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'."
Specifically, I don't know where the "Downloaded Program Files" folder is (I'm assuming it's not the same as C
rogram Files). Also, I don't see "SAHUninstall.exe" in C:WINDOWS or "SahAgent.log" in C: drive.
I'm also puzzled on what to do based on these instructions:
"In the right pane delete the 'SAHAgent' entry.
Deregister the LSP part of ShopAtHomeSelect.
In the registry editor, find the key
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WinSock2 \ Parameters \ Protocol_Catalog9. For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
Open a DOS command prompt window (from Start > Programs > Accessories) and enter these commands:
cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
cd "..\Downloaded Program Files"
del WEBinstaller.dll
del SAH*.exe
del setup.inf
del xmlparse_.inf
del xmltok_.inf
del C:\sahagent.log
Note: %WindDir% is a variable, by default this is c:\windows on Windows 95/98/Me/XP or c:\winnt on windows 2000/NT.
Restart the computer.
Open the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP), delete the following files:
'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe', 'SahAgent.exe' and 'SAHhtml.exe'
Open Windows folder, delete the file SAHUninstall.exe.
Delete the following registry keys to clean up:
HKEY_LOCAL_MACHINE\SOFTWARE\VGroup
HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2\Layered Provider Sample (or the
entire Winsock2 key since it is a duplicate of the real key)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
Management\ARPCache\ShopAtHomeSelect Agent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S
hopAtHomeSelect Agent"
I get to the second step in the command prompt instructions and I get this message: "Load Library("..\Downloaded Program Files\WEBinstaller.dll") failed -The specified module could not be found.
I've looked in the registry for the keys to delete but I don't see any of them there.
My computer is a Pentium 4, 1.6 GHz
512 MB pc2100 ddr total system memory
C: Drive - 70.5 GB Total, 49.7 GB Available
D: (SYSTEM_SAV) Drive - 3.98 GB Total, 1.12 GB Available
NVIDIA 64 MB GeForce2 MX 200 Video Card
Another thing I'd like to get rid of is the message that pops up everytime Windows starts.
[CENTER]"Error loading C:\Program Files\Wild Tangent\Apps\CDA\cdaEngine0400.dll
The specified module could not be found." [/CENTER]
Is there a way to make this problem go away without harming my computer?
I would like some advice on possibly getting rid of some programs that I don't use very often. But I don't know what I can remove without harming my computer or making other programs fail to function properly.
Attached is my hijack this log. Any type of help or advice would be greatly appreciated.
Although the "begin2search.com" toolbar no longer shows up as an option under IE>View>Toolbars, I still get the highlighted words. I have read the sticky on fully removing the "begin2search.com" toolbar, and I will try it as soon as I'm finished with this post.
As for the SAHagent, I had a program on my computer called "Shop At Home Select Cash Back" which I quickly uninstalled. I also went to the registry and deleted the "SAH" entry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
I'm trying to follow instructions on removing SAHagent from the website
www.spyany.com/program/article_spy_rm_SAHAgent.html. However, I am unfamiliar as to what these specific instructions mean:
"Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start > Run > regedit) and deleting the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'."
Specifically, I don't know where the "Downloaded Program Files" folder is (I'm assuming it's not the same as C
rogram Files). Also, I don't see "SAHUninstall.exe" in C:WINDOWS or "SahAgent.log" in C: drive. I'm also puzzled on what to do based on these instructions:
"In the right pane delete the 'SAHAgent' entry.
Deregister the LSP part of ShopAtHomeSelect.
In the registry editor, find the key
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WinSock2 \ Parameters \ Protocol_Catalog9. For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
Open a DOS command prompt window (from Start > Programs > Accessories) and enter these commands:
cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
cd "..\Downloaded Program Files"
del WEBinstaller.dll
del SAH*.exe
del setup.inf
del xmlparse_.inf
del xmltok_.inf
del C:\sahagent.log
Note: %WindDir% is a variable, by default this is c:\windows on Windows 95/98/Me/XP or c:\winnt on windows 2000/NT.
Restart the computer.
Open the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP), delete the following files:
'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe', 'SahAgent.exe' and 'SAHhtml.exe'
Open Windows folder, delete the file SAHUninstall.exe.
Delete the following registry keys to clean up:
HKEY_LOCAL_MACHINE\SOFTWARE\VGroup
HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2\Layered Provider Sample (or the
entire Winsock2 key since it is a duplicate of the real key)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
Management\ARPCache\ShopAtHomeSelect Agent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S
hopAtHomeSelect Agent"
I get to the second step in the command prompt instructions and I get this message: "Load Library("..\Downloaded Program Files\WEBinstaller.dll") failed -The specified module could not be found.
I've looked in the registry for the keys to delete but I don't see any of them there.
My computer is a Pentium 4, 1.6 GHz
512 MB pc2100 ddr total system memory
C: Drive - 70.5 GB Total, 49.7 GB Available
D: (SYSTEM_SAV) Drive - 3.98 GB Total, 1.12 GB Available
NVIDIA 64 MB GeForce2 MX 200 Video Card
Another thing I'd like to get rid of is the message that pops up everytime Windows starts.
[CENTER]"Error loading C:\Program Files\Wild Tangent\Apps\CDA\cdaEngine0400.dll
The specified module could not be found." [/CENTER]
Is there a way to make this problem go away without harming my computer?
I would like some advice on possibly getting rid of some programs that I don't use very often. But I don't know what I can remove without harming my computer or making other programs fail to function properly.
Attached is my hijack this log. Any type of help or advice would be greatly appreciated.
