Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 50.00%
6.1.7600.16385 (win7_rtm.090713-1255) 50.00%

Relationships

Parent process
Child process
Related files

PE structurePE file structure
Show functions
Import table
advapi32.dll
SetSecurityDescriptorOwner, InitializeAcl, AddAccessAllowedAce, GetAce, AddAce, LookupAccountNameW, GetTokenInformation, SetSecurityDescriptorGroup, IsValidSid, GetLengthSid, CopySid, InitializeSecurityDescriptor, GetSecurityDescriptorDacl, GetAclInformation, CreateWellKnownSid, LookupAccountSidW, OpenProcessToken, SetSecurityDescriptorDacl
kernel32.dll
QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, GetTickCount, InterlockedCompareExchange, Sleep, InterlockedExchange, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, GetProcAddress, EncodeSystemPointer, CloseHandle, RaiseException, GetModuleFileNameW, SetCurrentDirectoryW, LoadLibraryW, FreeLibrary, GetLastError, GetStartupInfoW
mscoree.dll
DllMain
msvcrt.dll
DllMain
ole32.dll
CoUninitialize, CoInitializeEx, CoInitializeSecurity, CoCreateInstance
shlwapi.dll
PathRemoveFileSpecW

ehshell.exe

Windows Media Center by Microsoft

Remove ehshell.exe
Version:   6.1.7600.16385 (win7_rtm.090713-1255)
MD5:   b0222bd0f9d97488d691bcc02b051a92
SHA1:   8c305663ba7667f1a4ca5559793101c7a7099bc8
This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

ehshell.exe executes as a process with the local user's privileges typically within the context of its parent dllhost.exe (COM Surrogate by Microsoft Corporation). This version is designed to run on Windows 7 and is compiled as a 32 bit program.

DetailsDetails

File name:ehshell.exe
Publisher:Microsoft Corporation
Product name:Windows Media Center
Description:Microsoft® Windows® Operating System
Typical file path:C:\windows\ehome\ehshell.exe
File version:6.1.7600.16385 (win7_rtm.090713-1255)
Product version:6.1.7600.16385
Size:98.5 KB (100,864 bytes)
Digital DNA
PE subsystem:Windows GUI
File packed:No
Code language:Microsoft Visual C++
.NET CLR:No
More details

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.21076020%
0.028634%
Kernel CPU:0.07354975%
0.013761%
User CPU:0.13721045%
0.014873%
Kernel CPU time:42,729 ms/min
100,923,805ms/min
Memory
Private memory:229 MB
21.59 MB
Private (maximum):235.3 MB
Private (minimum):82.55 MB
Non-paged memory:229 MB
21.59 MB
Virtual memory:530.48 MB
140.96 MB
Virtual memory (peak):535.04 MB
169.69 MB
Working set:235.3 MB
18.61 MB
Working set (peak):235.56 MB
37.95 MB
Resource allocations
Threads:26
12
Handles:23518
600
GUI GDI count:53
103
GUI GDI peak:166
142
GUI USER count:41
49
GUI USER peak:45
71

BehaviorsProcess properties

Integrety level:Medium
Platform:32-bit
Command line:"C:\windows\ehome\ehshell.exe" "C:\windows\web\wallpaper\architecture\img14.jpg"
Owner:User
Parent process:dllhost.exe (COM Surrogate by Microsoft Corporation)

ResourcesThreads

Averages
 
msvcrt.dll (Windows NT CRT DLL by Microsoft)
Total CPU:12.47773199%
0.272967%
Kernel CPU:2.92424982%
0.107585%
User CPU:9.55348217%
0.165382%
CPU cycles:290,743,653/sec
5,741,424/sec
Memory:688 KB
1.16 MB
ehshell.exe (main module)
Total CPU:3.27056138%
Kernel CPU:0.64013552%
User CPU:2.63042586%
CPU cycles:67,337,813/sec
Memory:112 KB
mscorwks.dll
Total CPU:0.82837032%
Kernel CPU:0.58344388%
User CPU:0.24492644%
CPU cycles:16,440,528/sec
Memory:5.67 MB
DSOUND.dll
Total CPU:0.00846755%
Kernel CPU:0.00423332%
User CPU:0.00423423%
CPU cycles:3,252,730/sec
Memory:456 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 8.1 Pro with Media Center 50.00%
Windows 7 Ultimate 50.00%

Distribution by countryDistribution by country

United States installs about 100.00% of Windows Media Center.
Back to top
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE