Really a Virus? What's the ehc folder for?

  AngeTheHippy 18:26 21 Oct 2005

Hi Chaps,
Just been doin a bit of cleaning up, Spybot, Ad-aware, MS Antispyware, when an AVG Virus Alert window appeared wit the following:

WHILE OPENING FILE: C:\Program Files\ehc\hc2\Printers\Troubleshooting\Images\ep1.bmp.shs
WARNING: Hidden extension .shs

Now, I think I'm right in thinking this ehc folder has something to do with Evesham (supplier). I don't know WHAT this is, I somehow don't think there is a real the folder it points to, there are 2 files in that don't look like the rest. they are:

ep1.bmp and scrap.bak - both look like bits of paper with top-right corner folded down, and wavy at the bottom. White with yellow on centre. Both are 501kb

I've also found folder in progs named 'helpcentre' and in that there is a zip folder, EHC.ZIP which is 19.506kb. In the same folder, is an EHC.exe - autoplay Media Studio.4.0 runtime Indigo Rose Corporation.

Any suggestions please, what to do next?


  AngeTheHippy 18:28 21 Oct 2005

whatever I select on the AVG window, 'info', 'heal' 'delete file' or 'move to vault', it cannot do any of these actions.


  johnnyrocker 18:35 21 Oct 2005

click here at least you will know what type it is.


  AngeTheHippy 18:43 21 Oct 2005

thanks, had a quick peruse at the site you suggested... prob need to have a good read of it though... will in a minute.

Just did a 'properties' on the shs file, and it said it was created in Nov 2002!!!


  Fruit Bat /\0/\ 18:54 21 Oct 2005

In this case not a virus but a truble shooting file for the printer setup>

The Shell Scrap Object is part of the Microsoft embed objects inside objects philosophy. Basically, what happens is that the shell script is wrapped around an object and the .SHS extension (which normally can't be seen even with extensions turned on) is added to the file.

An .SHS file is really potentially quite dangerous because it can have anything executable in it along with a vast collection of dangerous script code in the wrapper. At least one worm uses the Shell Script object.

Note: This file type can become infected and should be carefully scanned if someone sends you a file with this extension.

  AngeTheHippy 19:22 21 Oct 2005

whadayathink, if I RENAME both these files, adding a .bak?


  AngeTheHippy 19:24 21 Oct 2005

each time I go this file, as soon as I click (right-click for properties) I get that AVG virus alert file....


  Fruit Bat /\0/\ 19:30 21 Oct 2005

Virus alert due to the double extension .bmp.shs

rename files without the .shs on the end and they will be fine an it should also stop the virus alert.

  AngeTheHippy 19:36 21 Oct 2005

just reneamed 'em. Went out of then back into C:\Program files\ehc\hc2\Printers\Troubleshooting
\images\ep1.bak , right-clicked and hey, no virus alert window!!!

Have clicked 'resolved' ... for now!

Cheers guys,


This thread is now locked and can not be replied to.

Elsewhere on IDG sites

OnePlus 5T review: Hands-on

Illustrator Andrés Lozano on his improv line work, brazen use of colours & hand sketching

iPhone X review

Comment envoyer gratuitement des gros fichiers ?