SahAgent

[Tarnishedwisdom]

Just thought I would give you guys a heads up about this thing. I was on Yahoo's site a while ago and all of a sudden my browser quit working (it gave me the page cannot be displayed page whenever i clicked on links). I noticed some new links on my favorites that I didn't add, and there was some sort of screen saver program that had been installed, as well as a few new icons on my desktop. All of this happened within a few seconds and I was unable to access the internet because it gave me the page cannot be displayed thing. So I did some digging and found a thing called SahAgent that had been installed...I deleted it and all is well. Have you guys heard of this? How can I prevent it in the future?

 

[MFDnNC]

SpywareBlaster

 

[Tranquility]

SahAgent comes with Kazaa.

 

[lovujules]

Is all forms of sahagent from kazaa? My uncle has two files left on his pc i am trying to remove. I dont' think he has kazaa so was wondering if that is the only way to get it or some other download? I better go call and ask. ha,,
He has the sahhtml_.exe and the sahagent.exe. You delete and they come back with restore off.

 

[Cheeseball81]

Remove SAHAgent

http://www.spyany.com/program/article_spy_rm_SAHAgent.html

 

[lovujules]

Well just called him and before he called me for help he had run spybot and i just asked him to search kazaa and they were quarantined. So yes he had kazaa on his pc. So my next question is, can it get put on ur pc without you manually installing it? Cause he says he didn't install it but yet he might not know exactly what he was doing? Just curious, thanks,,,

 

[lovujules]

Thanks for the link. He says he didn't download it. I wonder if it definitely has to be downloaded or bundled with some other download and you aren't aware of it? Just to prevent this from happening again. Alot of problems with this kazaa thing. thanks for info....

 

[Cheeseball81]

Spyware is always installing without you knowing it. And some particular programs have it loaded with their software. Half the time you don't realize until you go back later and look.

P2P programs, like Kazaa especially, is bundled with spyware.
He should definitely get rid of Kazaa.

 

[lovujules]

Thanks for the info. Kazaa is deleted. I am going up to visit him and will remove the last of the sahagents. It's hard telling him over the phone what to do. haha,,,Take care!!

 

[Cheeseball81]

You too

Let us know how it goes in case you need anymore help

Might wanna run these programs on his system:

Ad-Aware: http://www.lavasoftusa.com/support/download/

SpyBot: http://majorgeeks.com/download2471.html

Make sure you check for updates first before running them

Delete whatever Ad-Aware finds
Fix all Problems SpyBot finds

 

[lovujules]

http://forums.techguy.org/t314010.html

There is the link to his hijack and all. We thought it was clean. Then My uncle called me a few days later when norton ran and it found the sahagent. I don't think it showed in the beginning of this but I can't get rid of the last two sahagents. I don't see them in his new hijack but maybe there just dead files? We ran housecall and it said no sahagents. When we run norton it says, two. We run spybot,adaware,killbox,all updated and say clean. So who knows. I have his latest hijack if you want to take a peak?

 

[Cheeseball81]

Sure

 

[lovujules]

Logfile of HijackThis v1.98.2
Scan saved at 7:32:59 PM, on 1/5/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WUSB54G.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\LVComS.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\Documents and Settings\John & Luara\My Documents\HijackThis1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://free.grisoft.com/freeweb.php/doc/2/"); (C:\Documents and Settings\John & Luara\Application Data\Mozilla\Profiles\default\5k9rv4m3.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\John & Luara\Application Data\Mozilla\Profiles\default\5k9rv4m3.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Systray driver] Systray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab

 

[Cheeseball81]

Yes that does look clean

Have you tried deleting the files in Safe Mode?

 

[lovujules]

I know we went into safe mode for something but we did so much can't remember. So i am goin down next friday and fix it. He lives a few hours from me. So gonna visit and spend most infront of his pc. haha,,,So will try safe mode then. My concern is the warning of disabling network connection. He has wireless which i know nothing about and i don't know if these two files cause the affect or not? The last i saw they were in the downloaded program files folder and were sahagent.exe and sahhtml. So I will post back after i am done next week so you can see the outcome. thanks again.