1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

SahAgent

Discussion in 'Web & Email' started by Tarnishedwisdom, Sep 12, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. Tarnishedwisdom

    Tarnishedwisdom Thread Starter

    Joined:
    Mar 8, 2002
    Messages:
    108
    Just thought I would give you guys a heads up about this thing. I was on Yahoo's site a while ago and all of a sudden my browser quit working (it gave me the page cannot be displayed page whenever i clicked on links). I noticed some new links on my favorites that I didn't add, and there was some sort of screen saver program that had been installed, as well as a few new icons on my desktop. All of this happened within a few seconds and I was unable to access the internet because it gave me the page cannot be displayed thing. So I did some digging and found a thing called SahAgent that had been installed...I deleted it and all is well. Have you guys heard of this? How can I prevent it in the future?
     
  2. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    SpywareBlaster
     
  3. Tranquility

    Tranquility

    Joined:
    Sep 5, 2004
    Messages:
    88
    SahAgent comes with Kazaa.
     
  4. lovujules

    lovujules

    Joined:
    Aug 20, 2004
    Messages:
    213
    Is all forms of sahagent from kazaa? My uncle has two files left on his pc i am trying to remove. I dont' think he has kazaa so was wondering if that is the only way to get it or some other download? I better go call and ask. ha,,
    He has the sahhtml_.exe and the sahagent.exe. You delete and they come back with restore off.
     
  5. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
  6. lovujules

    lovujules

    Joined:
    Aug 20, 2004
    Messages:
    213
    Well just called him and before he called me for help he had run spybot and i just asked him to search kazaa and they were quarantined. So yes he had kazaa on his pc. So my next question is, can it get put on ur pc without you manually installing it? Cause he says he didn't install it but yet he might not know exactly what he was doing? Just curious, thanks,,,
     
  7. lovujules

    lovujules

    Joined:
    Aug 20, 2004
    Messages:
    213
    Thanks for the link. He says he didn't download it. I wonder if it definitely has to be downloaded or bundled with some other download and you aren't aware of it? Just to prevent this from happening again. Alot of problems with this kazaa thing. thanks for info....
     
  8. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    Spyware is always installing without you knowing it. And some particular programs have it loaded with their software. Half the time you don't realize until you go back later and look.

    P2P programs, like Kazaa especially, is bundled with spyware.
    He should definitely get rid of Kazaa.
     
  9. lovujules

    lovujules

    Joined:
    Aug 20, 2004
    Messages:
    213
    Thanks for the info. Kazaa is deleted. I am going up to visit him and will remove the last of the sahagents. It's hard telling him over the phone what to do. haha,,,Take care!!
     
  10. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
  11. lovujules

    lovujules

    Joined:
    Aug 20, 2004
    Messages:
    213
    http://forums.techguy.org/t314010.html

    There is the link to his hijack and all. We thought it was clean. Then My uncle called me a few days later when norton ran and it found the sahagent. I don't think it showed in the beginning of this but I can't get rid of the last two sahagents. I don't see them in his new hijack but maybe there just dead files? We ran housecall and it said no sahagents. When we run norton it says, two. We run spybot,adaware,killbox,all updated and say clean. So who knows. I have his latest hijack if you want to take a peak? ;)
     
  12. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
  13. lovujules

    lovujules

    Joined:
    Aug 20, 2004
    Messages:
    213
    Logfile of HijackThis v1.98.2
    Scan saved at 7:32:59 PM, on 1/5/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe
    C:\Program Files\WUSB54G Wireless-G Adapter\WUSB54G.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Netscape\Netscape\Netscp.exe
    C:\Program Files\Nikon\NkView6\NkvMon.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS\System32\LVComS.exe
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\Logitech\Video\LowLight.exe
    C:\Documents and Settings\John & Luara\My Documents\HijackThis1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://free.grisoft.com/freeweb.php/doc/2/"); (C:\Documents and Settings\John & Luara\Application Data\Mozilla\Profiles\default\5k9rv4m3.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\John & Luara\Application Data\Mozilla\Profiles\default\5k9rv4m3.slt\prefs.js)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [Systray driver] Systray.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
    O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
    O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
     
  14. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    Yes that does look clean

    Have you tried deleting the files in Safe Mode?
     
  15. lovujules

    lovujules

    Joined:
    Aug 20, 2004
    Messages:
    213
    I know we went into safe mode for something but we did so much can't remember. So i am goin down next friday and fix it. He lives a few hours from me. So gonna visit and spend most infront of his pc. haha,,,So will try safe mode then. My concern is the warning of disabling network connection. He has wireless which i know nothing about and i don't know if these two files cause the affect or not? The last i saw they were in the downloaded program files folder and were sahagent.exe and sahhtml. So I will post back after i am done next week so you can see the outcome. thanks again.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/273020

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice