Sick of Spam? Prepare for Adware

Wired News ^ | 5/7/2004 | Amit Asaravala

[holymoly]

I have been told that it's Internet Explorer that let's all this stuff in. Use something else.

Some of it is (Comet Cursor, etc.). However, in many cases, users install the adware/spyware themselves. This happens when they download & install freeware, shareware, etc., and do not carefully reading any agreement, EULA, etc. before clicking the "Accept" (or similar) button.

[justlurking]

In the last month, the majority of problems I've worked on were adware related, either directly from adware or the results from users trying to remove said adware. Surfing porn when one should be working is the biggest cause I've come across. You should see the employees cringe when I tell the owner or office manager that a porn site hijacked the workstation(s).

I don't do support "officially", but help friends, family, and even my girlfriend's clients when it doesn't require much of my time.

One was having problems with the computer dialing out for no apparent reason. About half of the time that someone picked up the phone, the computer had connected to something. I suspected a "porn dialer", and downloaded the most recent version of Ad-Aware to scan the system.

I was right. But, I never told anyone that knew the victim what had really happened. Apparently, he had unlimited long-distance service, so he didn't get a huge phone bill.

[since1868]

me too

[glorgau]

This is all just such a non-issue on the Mac.

[sarasota]

Thanks for that info. It helps keep the garbage out.

[Guillermo]

Bump

[Cicero]

Between them SpyBot, Ad-Aware, and SpywareBlaster take care of the problem very nicely, not only removing spyware but blocking new stuff from being installed if you take the trouble to regularly update and innoculate, and preventing your kids from visiting dangerous sites that will screw up your computer.

I also had a serious problem with my kids installing this stuff accidentally whenever my back was turned. I used to have to spend an hour every week removing it. That hasn't happened for months now I have these programs in place. And they are all free, although I believe that users really should make small donations to the proprietors.

[FLAMING DEATH]

SahAgent (Shop At Home Select) has to manually be removed from the registry - Spy Bot won't get it, and I don't think AdAware will either...if you go to Tech Guy Forums or Computing.net, you can find instructions for removing it. I had to do this after I installed IMesh. That thing is chock full o' junk.

[Yo-Yo]

The Windows Process Library helps sort it out what is going on in your processor's background, and Answers That Work also has loads of info including Task List Programs

THANK YOU THANK YOU THANK YOU! I have been looking for ages for a concise lise of task names and what they do!

[PianoMan]

One more reason to be happy about my MAC!

[FLAMING DEATH]

Here are the instructions that I used to remove SAHAgent:

"SAHAgent is a Winsock2 Layered Service Provider. As such, if you merely delete registry entries and files, you stand a good chance of losing your network and Internet connections.

Follow these removal instructions to remove SAHAgent from your computer:

1. Click Start > Settings > Add/Remove Programs > Control Panel, and select the entry 'ShopAtHomeSelect Agent' and click 'Remove' to remove the software.
2. Reboot your Windows.
3. Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
4. If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start->Run->regedit) and deleting the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'."


This was all the further I had to go, and after this, SahAgent never showed up again in my processes list. But, if it doesn't work, you'll have to go on:




"If the above procedures do not work for any reason, you may remove SAHAgent manually, but at great risk of losing your network and Internet connections:

1. Open the registry editor(Start->Open->regedit) and find the key :HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run . Delete the 'SAHAgent' entry.
2. Deregister the LSP part of ShopAtHomeSelect. Run 'regedit' and find the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 . For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
3. Open a DOS command prompt window (from Start->Programs->Accessories) and enter these commands:
cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
cd "..\Downloaded Program Files"
del WEBinstaller.dll
del SAH*.exe
4. Restart the computer.
5. Delete the files 'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe' and 'SahAgent.exe' from the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP).
6. You can also delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\VGroup to clean up if you like."


Of course, you do this at your own risk...

[Dementon]

I keep picking up a spyware called SahAgent that places itself in the registry.

Symantec has instructions for removal here.

[Lael]

This is all just such a non-issue on the Mac

I sure hope so!!!

[q_an_a]

many times just the fact that you visit the web site results in ad revenue for the person. This is how google and others have created their click to search. thus, if some syp guy wants to earn five cents a click he sends 1000 people an offer they can't avoid, then they go to twenty web sites even if they don't want to. The next step has them going back twenty times again. The hacker/spy earns 2,000 dollars and moves one to the next 1000, times 100,000 people. now does it make sense?

[El Gran Salseron]

This is nothing new. Adware, spyware and malware have been around for years. Ask WKB. :-)

Check out the following site to find out not only how to get rid of it but by preventing it in the first place.

http://home.houston.rr.com/computerdoc

[Howlin]

I have the freeware version of Adware. Does it pay to buy the upgrade?

[JerseyHighlander]

Check out http://www.winpatrol.com

Most useful "Task list" program I've found for win2000 or older versions of Windows. Will block programs at startup, and allows you to indentify programs that need removal with the above mentioned Adaware & Spybot Search and Destroy.

NAT firewall router, Zonealarm, Norton Antivirus, Spybot S&D, adaware, winpatrol, Spyware blaster. Place a Windows Update icon on the desktop, to keep older windows programs up to date.

Use Mozilla Phoenix browser and a stable Mozilla email build. NO problems for over a year.

[VOA]

bump

[clamper1797]

BTT for spyware

[MizSterious]

Ugh, yes, it does. They're vermin and parasites. Thanks for the explanation.