EHU is a potentially unwanted application.
EHU is a potentially unwanted application.
When the application is installed the following folders and files are created:
<Desktop>\Collections\
<Desktop>\Data\Discovery.dat
<Desktop>\Data\HostCache.dat
<Desktop>\Data\Library1.dat
<Desktop>\Data\TigerTree.dat
<Desktop>\Data\UploadQueues.dat
<Desktop>\Downloads\
<Windows>\ehu.exe
<Windows>\rsvpsp.dll
<System>\netshell.dll
<System>\svchost.exe
<Temp>\realsched.exe
The following registry entries are created to run EHU on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
LocalSystem
<System>\svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSService_v1.0
<Temp>\realsched.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MyShares
<program files>\<non roman characters>\MyShares.exe /tray
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Syss
<Temp>\ehuupdate.exe
The following registry entries are set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters
\FirewallPolicy\StandardProfile\AuthorizedApplications\List\<Temp>
realsched.exe
<Temp>\realsched.exe:*:Enabled:realsched.exe
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters
\FirewallPolicy\StandardProfile
DoNotAllowExceptions
0
Registry entries are created under:
HKCU\Software\MyShares\MyShares\User\
HKCU\Software\MyShares\MyShares\Settings\
HKCU\Software\MyShares\MyShares\MyShares\
HKLM\SOFTWARE\Magnet\Handlers\MyShares