Follow:

 

Spyware:Win32/ShopAtHome


Spyware:Win32/ShopAtHome is a Web browser redirector that monitors your Web browsing behavior and online purchases. ShopAtHome - also known as GoldenRetriever and SelectRebates - claims to track points for your ShopAtHome rebates when you buy products directly from affiliated merchant Web sites without linking through the ShopAtHome Web site.


What to do now

Spyware:Win32/ShopAtHome may place an uninstaller entry in "Add or Remove Programs" in Control Panel. The entry may be named "Shopathomeselect Agent" or similar. If an uninstaller is not available or if you do not want to use the uninstaller that is provided, use Microsoft Windows Defender, Microsoft Security Essentials, the Microsoft Safety Scanner, or another up-to-date scanning and removal tool to detect and remove Spyware:Win32/ShopAtHome and other unwanted software from your computer. For more information, see http://www.microsoft.com/protect/products/computer/default.mspx.

Threat behavior

Spyware:Win32/ShopAtHome is a Web browser redirector that monitors your Web browsing behavior and online purchases. ShopAtHome - also known as GoldenRetriever and SelectRebates - claims to track points for your ShopAtHome rebates when you buy products directly from affiliated merchant Web sites without linking through the ShopAtHome Web site.
 
Please see our detailed Spyware:Win32/ShopAtHome.A analysis elsewhere in this encyclopedia for additional information.

Symptoms

System Changes
The following system changes may indicate the presence of Spyware:Win32/ShopAtHome:
  • The presence of the following name in "Add or Remove Programs" in Control Panel:
    "Shopathomeselect Agent"
  • The presence of the following registry subkeys:
    HKCU\Software\VGroup
    HKCU\Software\VGroup\SAHPopup
    HKCU\Software\VGroup\SAHAgent
    HKLM\Software\VGroup               
    HKLM\Software\VGroup\SAHPopup
    HKLM\Software\VGroup\SAHAgent
    HKLM\Software\Winsock2\Layered Provider Sample

Prevention


Alert level: High
This entry was first published on: Aug 12, 2005
This entry was updated on: Apr 17, 2011

This threat is also detected as:
  • Adware.Sahat.CD (other)
  • not-a-virus:AdWare.Win32.Sahat.cd (Kaspersky)
  • ADW_SAHAGENTBJ (Trend Micro)