Golden Retriever

Discussion in 'Tech Talk' started by Griz, Apr 6, 2005.

  1. Griz

    Griz Arizona member Millennium Member

    Messages:
    38
    Likes Received:
    0
    Joined:
    Sep 20, 1999
    Location:
    Jackass Flat, AZ
    I keep getting a small window that pops up every so often*, about some eula sign off. It says it is from:
    624791 Canada Inc.
    It says something about being for Golden Retriever?
    Any ideas how to get rid of it or what it is?

    * every 5 to 10 minutes

    Thanks, Griz
     
  2. David_G17

    David_G17 /\/\/\/\/\/\/\/

    Messages:
    2,046
    Likes Received:
    7
    Joined:
    Oct 7, 2002

  3. Washington D.C.

    Washington D.C.

    Messages:
    5,218
    Likes Received:
    1
    Joined:
    Oct 13, 2003
    Location:
    Woestyn Kusdorp
    SAHAgent (aka Golden Retriever, ShopAtHome and ShopAtHomeSelect). Ed English, CEO of InterMute, which publishes a spyware-removal utility called SpySubtract, tells me that the latest version of SAHAgent installs under Windows as a Winsock 2 Layered Service Provider (LSP) and does sneaky things such as redirect browsers to merchant sites to generate affiliate fees.

    So let's say you find SAHAgent installed and you want to get rid of it. But wait a minute - there's no uninstall routine. And if you try to delete SAHAgent's registry entries and files, you will probably find your network connections no longer function because SAHAgent is an LSP, something that is pretty tricky to remove.
     
  4. Washington D.C.

    Washington D.C.

    Messages:
    5,218
    Likes Received:
    1
    Joined:
    Oct 13, 2003
    Location:
    Woestyn Kusdorp
    SAHAgent is a Winsock2 Layered Service Provider. If you merely delete registry entries and files, you stand a good chance of losing your network and Internet connections.

    Follow these removal instructions to remove SAHAgent from your computer:

    1. Click Start > Settings > Add/Remove Programs > Control Panel, and select the entry 'ShopAtHomeSelect Agent' and click 'Remove' to remove the software.
    2. Reboot your Windows.
    3. Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
    4. If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start > Run > regedit) and deleting the key:
    'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'.


    If the above procedures do not work for any reason, you may manually remove SAHAgent, but at great risk of losing your network and Internet connections:

    1. Open the registry editor (click Start > Open > regedit ).
    2. Navigate to the key : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

    In the right pane delete the 'SAHAgent' entry.
    3. Deregister the LSP part of ShopAtHomeSelect.
    In the registry editor, find the key
    HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WinSock2 \ Parameters \ Protocol_Catalog9. For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
    4. Open a DOS command prompt window (from Start > Programs > Accessories) and enter these commands:

    cd "%WinDir%\System"
    regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
    cd "..\Downloaded Program Files"
    del WEBinstaller.dll
    del SAH*.exe
    del setup.inf
    del xmlparse_.inf
    del xmltok_.inf
    del C:\sahagent.log
    Note: %WindDir% is a variable, by default this is c:\windows on Windows 95/98/Me/XP or c:\winnt on windows 2000/NT.
    5. Restart the computer.
    6. Open the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP), delete the following files:
    'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe', 'SahAgent.exe' and 'SAHhtml.exe'
    7. Open Windows folder, delete the file SAHUninstall.exe.
    8. Delete the following registry keys to clean up:

    HKEY_LOCAL_MACHINE\SOFTWARE\VGroup
    HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2\Layered Provider Sample (or the
    entire Winsock2 key since it is a duplicate of the real key)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
    Management\ARPCache\ShopAtHomeSelect Agent
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S
    hopAtHomeSelect Agent
     
  5. Washington D.C.

    Washington D.C.

    Messages:
    5,218
    Likes Received:
    1
    Joined:
    Oct 13, 2003
    Location:
    Woestyn Kusdorp
    http://www.spywareguide.com/spydet_700_shopathomeselect.html Manual removal: There should be an entry in the Control Panel's Add/Remove Programs entry for 'ShopAtHomeSelect Agent'. Use it to remove the software then restart the computer.

    Be very carefull when manually removing this software because it hooks into the "LSP stack" and can cause your internet connection to fail.
    Removal tools: List of products that detect/remove/protect against ShopAtHomeSelect:
    # X-Cleaner
    # RegBlock
    # PestPatrol
    # Ad-Aware
    It looks like Ad-Aware is what you want to use.