EHU

Category: Adware and PUAsProtection available since:13 Jun 2006 00:00:00 (GMT)
Type: AdwareLast Updated:13 Jun 2006 00:00:00 (GMT)

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

EHU is a potentially unwanted application. EHU is a potentially unwanted application.

When the application is installed the following folders and files are created:

<Desktop>\Collections\
<Desktop>\Data\Discovery.dat
<Desktop>\Data\HostCache.dat
<Desktop>\Data\Library1.dat
<Desktop>\Data\TigerTree.dat
<Desktop>\Data\UploadQueues.dat
<Desktop>\Downloads\
<Windows>\ehu.exe
<Windows>\rsvpsp.dll
<System>\netshell.dll
<System>\svchost.exe
<Temp>\realsched.exe

The following registry entries are created to run EHU on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
LocalSystem
<System>\svchost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSService_v1.0
<Temp>\realsched.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MyShares
<program files>\<non roman characters>\MyShares.exe /tray

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Syss
<Temp>\ehuupdate.exe

The following registry entries are set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters
\FirewallPolicy\StandardProfile\AuthorizedApplications\List\<Temp>
realsched.exe
<Temp>\realsched.exe:*:Enabled:realsched.exe

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters
\FirewallPolicy\StandardProfile
DoNotAllowExceptions
0

Registry entries are created under:

HKCU\Software\MyShares\MyShares\User\
HKCU\Software\MyShares\MyShares\Settings\
HKCU\Software\MyShares\MyShares\MyShares\
HKLM\SOFTWARE\Magnet\Handlers\MyShares

download Try Sophos products for free
Download now