Hi Chaps, Just been doin a bit of cleaning up, Spybot, Ad-aware, MS Antispyware, when an AVG Virus Alert window appeared wit the following:
WHILE OPENING FILE: C:\Program Files\ehc\hc2\Printers\Troubleshooting\Images\ep1.bmp.shs WARNING: Hidden extension .shs
Now, I think I'm right in thinking this ehc folder has something to do with Evesham (supplier). I don't know WHAT this is, I somehow don't think there is a real virus...in the folder it points to, there are 2 files in that don't look like the rest. they are:
ep1.bmp and scrap.bak - both look like bits of paper with top-right corner folded down, and wavy at the bottom. White with yellow on centre. Both are 501kb
I've also found folder in progs named 'helpcentre' and in that there is a zip folder, EHC.ZIP which is 19.506kb. In the same folder, is an EHC.exe - autoplay Media Studio.4.0 runtime Indigo Rose Corporation.
In this case not a virus but a truble shooting file for the printer setup>
The Shell Scrap Object is part of the Microsoft embed objects inside objects philosophy. Basically, what happens is that the shell script is wrapped around an object and the .SHS extension (which normally can't be seen even with extensions turned on) is added to the file.
An .SHS file is really potentially quite dangerous because it can have anything executable in it along with a vast collection of dangerous script code in the wrapper. At least one worm uses the Shell Script object.
Note: This file type can become infected and should be carefully scanned if someone sends you a file with this extension.