SAHAgent is an adware program that installs itself as LSP (Layered Service Provider) on the affected computer, in order to harvest users' information about their connection, such as Internet usage, pages viewed, phone connection details, inventory of the applications installed in the computer, etc; to modify the search results obtained through the web browser.
Additionally, it displays advertising pop-ups on screen.
SAHAgent can be installed in the affected computer without user consent, as it is automatically downloaded while accessing certain malicious websites that use vulnerability exploits in order to affect computers or it also can be bundled with certain Internet programs, such as peer-to-peer (P2P) file sharing networks, among others.
LSP (Layered Service Provider) is a Windows feature that allows to specify a number of programs, in order to process all the TCP/IP traffic taking place between Internet and the applications that are accessing Internet (such as the web browser, the email client, etc.).
For example, it could be specified a computer security program, which analyses the traffic in search for viruses or other threats before transferring it to the final application of the traffic.
However, this structure can also be used by adware and spyware programs, in order to intercept the communication across the Internet, and, what is worse, if they are deleted without taking precautions, the Internet connection will stop working indefinitely.