The problem is caused by Microsoft's latest security patch. For further information, please read our support newsletter.

For home users:
To solve the problem, please click on the Start menu, then on Run..., then copy-paste the following the line:
regsvr32 /u "C:\Program Files\VirusBuster\Bin\shctxmnu.dll"
After copying the line, please press Enter.
If the modification has been successful, you will be informed in a pop-up message.

For corporate users (network resolution):
To resolve the problem, create a .reg file with the following content:
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{4A6E59F3-63EF-4A16-8D50-83D2F5639C8A}
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\{4A6E59F3-63EF-4A16-8D50-83D2F5639C8A}
HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\{4A6E59F3-63EF-4A16-8D50-83D2F5639C8A}

SAHAgent is an adware implemented as LSP (Winsock 2 Layered Service Provider). It redirects visits to merchant sites in order to take the affiliate fees from them automatically. SAHAgent adware is also known as Golden Retriever, ShopAtHome, ShopAtHomeSelect. It may slow Opera or other applications, particularly when accessing its servers.

Follow these removal instructions to remove SAHAgent from your computer:

• Click Start > Settings > Add/Remove Programs > Control Panel, and select the entry 'ShopAtHomeSelect Agent' and click 'Remove' to remove the software.
  
• Reboot your Windows.
  
• Once you have uninstalled via Add/Remove programs, you can delete the damaged '{30402FF4-3E71-4A1C-9B4B-1CD3486A9FB2}' entry inside your 'Downloaded Program Files' folder, the 'SAHUninstall.exe' file in the 'Windows' folder and 'SahAgent.log' in the root of the C: drive to clean up.
  
• If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can remove it by opening the registry editor (Start > Run > regedit) and deleting the key:
  'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ ShopAtHomeSelect Agent'.

If the above procedures do not work for any reason, you may manually remove SAHAgent, but at great risk of losing your network and Internet connections:

• Open the registry editor (click Start > Open > regedit ).
  
• Navigate to the key:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
  In the right pane delete the 'SAHAgent' entry.
  
• Deregister the LSP part of ShopAtHomeSelect.
  In the registry editor, find the key
  HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WinSock2 \ Parameters \ Protocol_Catalog9. For each key in Catalog_Entries, open the 'PackedCatalogItem' value and check if it starts with 'lsp.dll'. If it does delete that entry. Renumber the remaining keys so that they count up from 000000000001 one at a time, and set the 'Num_Catalog_Entries' value in Protocol_Catalog9 to the highest key number you have.
  
• Open a DOS command prompt window (from Start > Programs > Accessories) and enter these commands:
  cd "%WinDir%\System"
  regsvr32 /u "..\Downloaded Program Files\WEBinstaller.dll"
  cd "..\Downloaded Program Files"
  del WEBinstaller.dll
  del SAH*.exe
  del setup.inf
  del xmlparse_.inf
  del xmltok_.inf
  del C:\sahagent.log
  Note: %WindDir% is a variable, by default this is c:\windows on Windows 95/98/Me/XP or c:\winnt on windows 2000/NT.
  
• Restart the computer.
  
• Open the System folder (inside the Windows folder; called 'System' on Windows 95/98/Me or 'System32' under Windows NT/2000/XP), delete the following files:
  'tracking.tmp', 'vg.dat', 'v.dat', 'lsp.dll', 'SahDownloader.exe', 'SahAgent.exe' and 'SAHhtml.exe'
  
• Open Windows folder, delete the file SAHUninstall.exe.
  
• Delete the following registry keys to clean up:
  HKEY_LOCAL_MACHINE\SOFTWARE\VGroup
  HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2\Layered Provider Sample (or the
  entire Winsock2 key since it is a duplicate of the real key)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
  Management\ARPCache\ShopAtHomeSelect Agent
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S
  hopAtHomeSelect Agent

Free tool (use only for your own risk):
http://www.cexx.org/lspfix.htm

SAHAgent overview:
http://www.spyany.com/program/article_spy_rm_SAHAgent.html

If you use eval version product, when you launch the program it displays an extra panel with an 'Activation' button. If you want to use this - activation - function (to enter e-mail address, activation key) the operating system needs Rich Edit Control component to complete activation method.

The following table shows which dynamic-link library (DLL) corresponds with which version of Rich Edit.

Rich Edit Verzió 1.0 - Riched32.dll
Rich Edit Verzió 2.0 - Riched20.dll
Rich Edit Verzió 3.0 - Riched20.dll
Rich Edit Verzió 4.1 - Msftedit.dll

The following list describes which versions of Rich Edit are included in which releases of Microsoft Windows.

Windows XP SP1 - Includes Rich Edit 4.1, Rich Edit 3.0, and a Rich Edit 1.0 emulator.
Windows XP - Includes Rich Edit 3.0 with a Rich Edit 1.0 emulator.
Windows Me - Includes Rich Edit 1.0 and 3.0.
Windows 2000 - Includes Rich Edit 3.0 with a Rich Edit 1.0 emulator.
Windows NT 4.0 - Includes Rich Edit 1.0 and 2.0.
Windows 98 - Includes Rich Edit 1.0 and 2.0.
Windows 95 - Includes only Rich Edit 1.0. However, Riched20.dll is compatible with Windows 95 and may be installed by an application that requires it.

If the required dll is missing, you can get it from the operating system's install CD or installing MS Office or in case of Windows 95 you can use an additional pack. (Click on the InstMsiA.exe file on the bottom of page)

Run the InstMsiA.exe (unpack) to install the whole pack (msiinst.exe) or copy only the two requred files from the archive (riched20.dll and usp10.dll) into the windows\system folder.

For more information about Rich Edit Control click here.

Please perform the following steps to remove trojan:

1.
Close Internet connection!

2.
Disable resident protection (right mouse click on the VB icon of systray and select 'Disable Shield')!

3.
Windows NT/2000/XP: run Windows Task manager (right click on systray and select Task manager)!
Windows 9x/Me: press CTRL+ALT+DELETE buttons together to display running tasks!

4.
Find gmt.exe and/or cmesys.exe and stop it/them!

5.
Delete Program Files\Common Files\GMT and/or Program Files\Common Files\CMEII directory!

6.
Clean registry entries:
Enter the 'regedit' command into 'Run' menu item of the Start menu then press OK button. Search for gmt.exe, gator.com and cmesys.exe files separately in the Edit \ Search menu item and delete them.

7.
Restart computer then activate resident protection!

More information:
http://www.pchell.com/support/gator.shtml
http://www.claria.com/products/
http://www.pcpitstop.com/gator/default.asp

In this case try to change the sensivity from Extensive to Quick by choosing it from the drop down menu in the VBShield component/Scan method settings/Normal scan section.

If it doesn't help, try to set the printer spooling directory (Windows NT based systems - NT4.0, 2000, XP - c:\WINNT\System32\spool\PRINTERS; Windows 9x - 95, 98, Me - C:\WINDOWS\spool) as an excluded path under Exlueded paths settings in the same component. This way the shield won't scan this directory and won't be able to interfere with the printing.

You have to set the SMTP client in the Mailer/Mailing clients component to the following:

- you have to type the outgoing SMTP address, given by your internet service provider or the mail server address to the Server name.
- you have to put your name and e-mail address to the Sender.

Sometimes it happens that the Windows can't close the console fully and its .exe file "gets stuck".
Because there could only be one console running at a time on a computer, you have to stop the stuck .exe file before you would restart it. To do this start the Task Manager with the Ctrl+Alt+Del key combination and then, in case of 9x operating systems, stop the VBCons task, in case of NT/2000/XP systems, on the Processes tab choose Vbcons.exe and stop the process with the End Process key.

In this case the following message appears in the VirusBuster log, or would be forwarded by the Central alert component, to the given address:



The program will give this message, if the virus database has got damaged, then the shield icon becomes grey on your computer. A scheduled task will periodicly check the status of the VDB and if it finds that the damaged one has got replaced with a good one it will start the shield, if it still finds the damaged one it will send an error message again.

Check your computer if the VB shield is grey on the windows system tray and check the VDB details in the Virus database component on the console.
If you can see that the database is damaged, try to update it or try to copy manually another VDB file to the Program Files\VirusBuster\VirusDatabase directory.

If you don't want the files on the network to be scaned, you have to type the "\\" path into the Excluded paths box in VBShield module / Excluded paths settings. This will only work for the drives which are not mapped, therefore mapped drives have to be set separately as excluded paths (eg. "H:").

The cause of this could be that the virus database has got damaged during update or installation, or it couldn't be loaded in correctly.
To confirm this, check the date and version of the virus database on the Virus database component or by right clicking on the shield icon choosing Statistical information. If the version 0.000 and the date 1970 or 1969 then you can be certain there is a problem with the virus database.
In this case try to update your database either from the program or in this case might be better to try it with the seprarate virus database which can be downloaded from our hompage.
If it doesn't solve the problem, try to copy the database file (vbuster.vdb) into the Program Files\VirusBuster\VirusDatabase directory, with renaming the other file (eg. renaming it to Vbuster.old).
In case of access error, or if the program still hasn't recovered, the easiest way to solve the problem to reinstall the program.

These are only informative massages, because Windows didn't allow access to these files and directories. This could be eg. the pagefile.sys, which is a virtual memory file, or the hiberfil.sys which contains infromation on hibernating.

There could be several files and directories, in some cases Windows denies the access, but there could be some running applications which should be closed down.

Please update your Internet Explorer with the newest version, or if it's not possible please install the 401comupd.exe file from the REDIST\MICROSOFT\SYSTEM directory on the VirusBuster install CD. This contains the compcpl32.dll file which is missing from the earlier Windows versions.

There could be several reason for this:

- After installation you haven't restarted your machine or it hasn't even asked for a restart: in this case try to restart your computer, in according to this the registration changes can take affect and at start up the operating system can try to load the shield in.
- The computer is infected with a virus: unfortunately there are viruses, which stop the anti-virus scanners and their resident protection. In this case the solution is to disinfect your computer before installing the software.
- There aren't enough memory: to run the shield you need at least 32 Mb memory, then it will be able to start and ensure the resident protection of the machine. If you don't have that much, all you can do (without extending your memory) is to choose custom installation during installation and leave out the Shield component.
- There is another resident protection installed: if you have more virus scanner installed which have resident protection, then if it's possible only install/allow to run the resident protection of one of these programs, otherwise they can cause a lot of problem both in operation and virus detection.

The main task of the VirusBuster Central Alert Component - if it is activated - is to send e-mail messages to a given e-mail address on every log entry, which it is assigned to.
This could be helpfull, because you can set it to get information on a given computer without sitting in front of it.

The mail notifying function can be turned on/off with the Mail notifying switch. You can choose the types of log entries, which should be forwarded by the central alert, from the list of message type. The following messages can be selected:

- Virus found
- Suspicious file
- Configuration change
- Exception fault
- Warning
- Receipt
- Message
- Error
- Critical error

The enabled status of the option means that the central alert sends the detailed log entry too.
The addresses list, where the log entries must be sent can be added to the Addresses list. Type an e-mail address into the box labelled E-mail address and the address will be added to the list by clicking on the Add button. The added addresses can be stored by clicking on the Apply button.

If you would like to know exactly which computer has sent the message, then you have to fill in the Sender details in the Mailer component / Mailing clients / SMTP client. This contains the Name: and the E-mail address. The outgoing messages will contain these data in the sender name format. Both fields can contain the %u% (user name) or %m% (name of the computer) variables.

Eg. Name: %u%; E-mail address: %u%@%m%.mail.hu

Important!!! VirusBuster Mailer component is needed for the operation of VirusBuster Central Alert component.

You can do this in the Install copier component, by setting the update source.
When this has been done, you can set a scheduled task with any name in Tasks, where you can set the path, which components and when would be updated.

Important!!! You have to make sure that the target path is set to the install kit's directory - by default this is set to C:\Program Files\VirusBuster\Shared -, otherwise the update can't be executed. This update only applies to the install kits, the local programs and the shield's database won't be updated by it. To do this you have to use the Updater modul.

If you would like to install your program with certain settings - eg. with registration - you need to create a configuration file.

The simpliest way is to export the component which you want to install from an already installed program. For example, right click on the registration component in an installed program and choose Export settings, this can be saved as a cfg file.

Important!!! This file can only be used to register programs which run on the same platform. If you want to use one configuration file with all our programs, then you have to give these details for every product.


For example, the file will contain the following after the registration export:

[INST::Local:\Registration]
"#TypeID"=DWORD:"10000000"
"#classification"=DWORD:"00020001"
"#rights"=DWORD:"00000090"
"#display order"=DWORD:"0000000e"
"#version"=DWORD:"03003003"
"#date"=DWORD:"3c881b20"

[::Local:\Registration\Keys]

[::Local:\Registration\Keys\VBusterNTW]
"User name"=STRING:"--Your user name--"
"Type"=DWORD:"00000000"
"Key"=STRING:"--Your registration key--"

For example, this will only register NT workstation protections, therefore it has to be completed - simply by copying the section containing the registration key - with the following:

[::Local:\Registration\Keys\VBuster9x]
"User name"=STRING:"--Your user name--"
"Type"=DWORD:"00000000"
"Key"=STRING:"--Your registration key--"

[::Local:\Registration\Keys\VBusterNTS]
"User name"=STRING:"--Your user name--"
"Type"=DWORD:"00000000"
"Key"=STRING:"--Your registration key--"

[::Local:\Registration\Keys\VBusterNMS]
"User name"=STRING:"--Your user name--"
"Type"=DWORD:"00000000"
"Key"=STRING:"--Your registration key--"

[::Local:\Registration\Keys\VBSOffice]
"User name"=STRING:"--Your user name--"
"Type"=DWORD:"00000000"
"Key"=STRING:"--Your registration key--"

[::Local:\Registration\Keys\VBSOffice]
"User name"=STRING:"--Your user name--"
"Type"=DWORD:"00000000"
"Key"=STRING:"--Your registration key--"

[::Local:\Registration\Keys\VBRACS]
"User name"=STRING:"--Your user name--"
"Type"=DWORD:"00000000"
"Key"=STRING:"--Your registration key--"


If these are included in a configuration file, then that file can register all our products (except for the Personal version for home users which wasn't listed above).
You can do the same with other components too. All you have to do is to export the given component after the settings have been done.

Important!!! Don't forget that you have to export both from related components. For example, if you want to export a scheduled task, don't just export the task related component's settigns, but export the task manager's settings as well. In case of Central alert settings you will need Mailer component settings too.
Once these have been done, put all the exported settings into one cfg file, and copy that into the CMS Shared\Config directory. Now you can choose this file at the install templates settings.

I. When you install VirusBuster CMS first you have to decide if you only want CMS on the computer or you want to install VirusBuster shield as well and also if you want a simple or a multi CMS.
If you would like to install VirusBuster shield with it on the same machine, then first you have to install CMS and after the shield. In case of MultiCMS don't forget the multicms switch.

You have to set the following during installation:

- the location, where you want to install the program,
- location (Shared) of the install kits' directory (It's important, that these are in the program's directory!)
- program's folder
- SMTP settings (mail server, name, e-mail address)
- registration details (otherwise CMS won't manage the computers)
- the name of the managed domain and also for the managing you need the details of a user who has administrator rights
- handling machine assignement (in case of a new machine you could have it asseigned to the CMS or could be included with the not managed machines.It's better to leave this switched off and do the assignement later, manually.)
- install kits which will be installed (CMS will use these)

II. After installation a copier task will run, this will copy the install kits and the virus database into the Shared directory from the directory where we installed CMS from, these will be installed by CMS onto the given machines. If this task doesn't start immediately after installation or it has run, restart your computer - ift it's possible - or start the Windows Central Management service under Services (if it's not running yet).

III. After these have been done, create the configuration files needed for the installation and set the install templates. It's better also to set the install copier, which will update the install kits.

IV. If you install multiCMS, set the CMS structure in the CMS management component.

V. Now you can assign the machines to the management(s) in Machine management.