SAHAgent e Teknum system

[IronC]

Ogni giorno, dopo che lancio RegEdit, mi appaiono questi due voci dall'elenco dei sotware installati, anche se li cancello...
Qualcuno sa cosa sono e come posso rimuoverli?

[MrOZ]

Teknum Systems

The updater program made by Teknum is trying to update one of their products that is installed on your system (possibly Handybits or EasyCrypto). If you don't want he updater running at startup (and so Spybot will stop reporting it), download the updEnabler.exe program from Teknum. It will allow you to disable the update service. Here's the link you can get it from:

http://www.handybits.com/update_service.asp

If you don't want the Teknum product on your system, you should be able to simply uninstall it.



Handybits is a service for finding free utility programs for Windows. Never used it myself. Since you deleted the folder, run "Hijack This!" and have it fix this entry:

O4 - HKCU\..\Run: [Update Service] "C:\Program Files\Common Files\Teknum Systems\update.exe" /startup



"HandyBits ZipNGo

Integration with Windows Explorer - By this feature, you can do all you Zip work with one single mouse click right in Windows Explorer.

Enhanced Drag&Drop - You can add or extract files by using our advanced drag&drop feature.

History Lists - You can let Zip&Go remember the folders and files that you have most recently used. With this feature, you can navigate through all folders that contain Zip files just by one single mouse click.

My Zip Files folder - This feature helps you to organize all your Zip files in one place. It enables you to access any of your files with one single mouse click on your Desktop or Start menu.

New Zip file Wizard - This feature is particularly useful for those, who are not quite familiar with creating Zip files.
Zip & E-mail - This feature is particularly useful for those frequently sending Zip files by E-mail. Advanced temporary files management - By using the built-in Disk Cleanup feature, you can avoid wasted space on your hard drives. Persistent window appearance - You can set the Zip&Go to remember your preferred window layout, menu and toolbar appearance, list view columns, etc., so the product always appears to you the way you want it to."

--------------------------------------------------------------------------------------

Disabilita il system restore, fai uno scan con adaware6 aggiornato e poi procedi alla rimozione manuale se rimangono delle string orfane nel registro guardando quello che si dice qui:

http://www.wilderssecurity.com/archive/index.php/t-13100.html

[MrOZ]

SAHAgent

Process File: sahagent or sahagent.exe
Process Name: Sahagent
Description: Application that collects and combines user Internet browsing behavior and sends it to ShopAtHomeSelect servers.
Company: ShopAtHomeSelect.com
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

http://sarc.com/avcenter/venc/data/adware.sahagent.html

http://www.pestpatrol.com/pestinfo/s/sahagent.asp

Usa adaware6 x rimuoverlo, fai diverse scansioni e prova + volte l'eliminazione di ciò che adaware6 individua.

Altrimenti procedi con la rimozione manuale descritta qui sotto:

How to Remove SAHAgent ?

SAHAgent is a Winsock2 Layered Service Provider. If you merely delete registry entries and files, you stand a good chance of losing your network and Internet connections.

Follow these removal instructions to remove SAHAgent from your computer:

1. Click Start > Settings > Add/Remove Programs > Control Panel, and select the entry 'ShopAtHomeSelect Agent' and click 'Remove' to remove the software.
2. Reboot your Windows.
3. Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
4. If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start > Run > regedit) and deleting the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'.


If the above procedures do not work for any reason, you may manually remove SAHAgent, but at great risk of losing your network and Internet connections:

1. Open the registry editor (click Start > Open > regedit ).
2. Navigate to the key : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

In the right pane delete the 'SAHAgent' entry.
3. Deregister the LSP part of ShopAtHomeSelect.
In the registry editor, find the key
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WinSock2 \ Parameters \ Protocol_Catalog9. For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
4. Open a DOS command prompt window (from Start > Programs > Accessories) and enter these commands:

cd "%WinDir%\System"
regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
cd "..\Downloaded Program Files"
del WEBinstaller.dll
del SAH*.exe
del setup.inf
del xmlparse_.inf
del xmltok_.inf
del C:\sahagent.log
Note: %WindDir% is a variable, by default this is c:\windows on Windows 95/98/Me/XP or c:\winnt on windows 2000/NT.
5. Restart the computer.
6. Open the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP), delete the following files:
'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe', 'SahAgent.exe' and 'SAHhtml.exe'
7. Open Windows folder, delete the file SAHUninstall.exe.
8. Delete the following registry keys to clean up:

HKEY_LOCAL_MACHINE\SOFTWARE\VGroup
HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2\Layered Provider Sample (or the
entire Winsock2 key since it is a duplicate of the real key)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
Management\ARPCache\ShopAtHomeSelect Agent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S
hopAtHomeSelect Agent

[IronC]

grazie mille :)