ShopAtHome Spyware

[Dominus]

OK, I have a new computer with XP Media Center that came preloaded with McAfee Anti-Virus, Spyware, etc. I read in some magazine that ZoneAlarm Internet Suite was the best available program to use against malicious attacks etc. BUT it had a conflict with McAfee so I had to uninstall.

Did that. Things are working ok and the only program I downloaded from the web was 1ClickDVD, a program to copy DVDs which I paid $60. Program worked fine and then one day I reboot and Pure Networks (AOL utility that monitors my router) said I had an instance of ShopAtHome spyware on my system and it could not run effectively, etc.

I ran Webroot, ZoneAlarm and AOL SppyZapper to no avail. I still get the error message.

I have done the "sah" searches, nothing, Add/Remove Programs, nothing there referring to "SAH" or "Shop Anything."

What do you recommend? Does Spybot remove this booger? Reinstall McAfee?

Thanks for your help.

Dom

[md usa spybot fan]

Spybot-S&D checks for three different categories of problems associated with ShopAtHome:

• ShopAtHome - Cookies
• ShopAtHome - Hijackers
• ShopAtHome - Spybots

[Dominus]

Spybot-S&D checks for three different categories of problems associated with ShopAtHome:

• ShopAtHome - Cookies
• ShopAtHome - Hijackers
• ShopAtHome - Spybots

Thank you for your quick response. Cross my fingers this does it. I've always had great luck with SpyBot in the past.

[Dominus]

Spybot-S&D checks for three different categories of problems associated with ShopAtHome:

• ShopAtHome - Cookies
• ShopAtHome - Hijackers
• ShopAtHome - Spybots

OK, I downloaded and ran Spybot without a hitch. No threats were found. Rebooted and, again, Port Magic (AOL router monitor utility from Pure Networks) launches an error msg saying I have the spyware.

I think I may re-install McAfee which came pre-installed with the computer and see if it can find it. I have also run a "search" for all files "sah*.*" and "shop" and "webinstaller".

Can Pure Networks (Port Magic) have a conflict with, say, ZoneAlarm and "create" the error message? I'm wading in a pool of the unknown.

Thanks
Dom

[md usa spybot fan]

From the following Pure Networks article
Incompatible Application Information http://www.purenetworks.com/portmagic/badlsp.html

ShopAtHome Agent by ShopAtHomeConnect.com
ShopAtHome is an application that redirects visits to merchant sites in order to take the affiliate fees from them automatically. It can be installed as Golden Retriever, ShopAtHome, or ShopAtHomeSelect. ShopAtHome is a Spyware application (it uses your Internet connection in the background without your knowledge or consent.)

You may not have explicitly installed this application. It is commonly bundled when you install FreeWare or file sharing programs such as FavoriteMan, Grokster, IMesh, and KaZaa. It may be also installed with other programs, or as a standalone application.

To remove ShopAtHome from your computer, we recommend that you use a Spyware removal program such as AOL Spyware Protection, AdAware, Pest Patrol or Spybot SD. It is possible to manually remove this application; however it is difficult to fully remove and may affect your computer's networking if it is incompletely removed.

For more information on ShopAtHome, please see Pest Patrol's site.

From the eTrust Spyware Encyclopedia reference above it appears that Pure Networks thinks there is a Winsock Layered Service problem associated with SAHAgent.

[Corrine]

There have been problems with the SAH Agent in the past with winsock errors and loss of internet connection. Generally, this can be avoided by removing only SAH by itself and then removing any other objects after a shutdown/restart. (In the event of a lost connection, there are safe winsock fix programs available, one being LSP Fix available at Subratam.org (Direct download link: http://www.downloads.subratam.org/lspfix.zip ).

This program attempts to correct Internet connection problems resulting from buggy or improperly-removed Layered Service Provider (LSP) software. When you start LSP-Fix, it will read the list of LSP modules from the Windows registry and verify that each module is present. If a module is missing, it is placed on the "Remove" list for removal.