Should I block it?

40%

40% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

1.1.42.70	14.29%
1.1.42.70	14.29%
1.0.55.21	14.29%
1.0.55.19	14.29%
1.0.54.17	14.29%
1.0.19.0	28.57%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, GetUserNameW, RegCreateKeyExW, RegDeleteKeyW, RegSaveKeyExW, OpenProcessToken, RegDeleteValueW, LookupPrivilegeValueW, SetFileSecurityA, QueryServiceConfigW, CloseServiceHandle, OpenSCManagerW, OpenServiceW, LookupAccountNameW, QueryServiceStatusEx, ControlService, ConvertSidToStringSidW, IsTextUnicode, GetTokenInformation, SetFileSecurityW, AdjustTokenPrivileges, StartServiceW, ChangeServiceConfigW

crypt32.dll

CryptQueryObject, CryptMsgClose, CertFreeCertificateContext, CertFindCertificateInStore, CertCloseStore, CryptMsgGetParam, CertGetNameStringW, CryptDecodeObject

kernel32.dll

DllMain

ole32.dll

CoTaskMemFree, CoCreateInstance, CoInitialize, CoUninitialize

psapi.dll

EnumProcessModules, GetModuleFileNameExW, GetModuleInformation, GetProcessImageFileNameW

shell32.dll

ShellExecuteExW, SHGetFileInfoW

shlwapi.dll

SHDeleteKeyW, StrToIntW, StrStrIW, PathUnExpandEnvStringsW

user32.dll

wsprintfW, SetFocus, FindWindowW, WaitForInputIdle, SendMessageW, GetWindowTextW, EnumWindows, GetClassNameW, SendMessageTimeoutW, FindWindowExW, SetForegroundWindow, EnumDisplaySettingsW, GetWindowThreadProcessId, DestroyIcon, PostMessageW, wsprintfA, GetSystemMetrics, ShowWindow, CharUpperW, OemToCharBuffA, OemToCharA, CharUpperA, CharLowerA, CharToOemBuffW, CharToOemA, IsCharAlphaW, IsCharAlphaNumericW

version.dll

GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW

wintrust.dll

CryptCATCatalogInfoFromContext, CryptCATAdminReleaseContext, WinVerifyTrustEx, CryptCATAdminCalcHashFromFileHandle, CryptCATAdminAcquireContext, CryptCATAdminEnumCatalogFromHash

ShScanner.dll

SpyHunter4 by Enigma Software Group USA (Signed)

Remove ShScanner.dll

Version:	1.0.54.17
MD5:	e6999d31f6a5bc9eee251d1f351b6acd
SHA1:	b851c7b70af850d476a81ce862049031a9735d95
SHA256:	f9748c0c20d0d3ed436c53df2ef122b8a515ff1764596cc479bb82d9e56d0fb7

Overview

shscanner.dll is loaded as dynamic link library that runs in the context of a process. It is installed with a couple of know programs including SpyHunter published by Enigma Software Group, SpyHunter from Enigma Software Group and SpyHunter by Enigma Software Group. The file is digitally signed by Enigma Software Group USA which was issued by the VeriSign certificate authority (CA).

Details

File name:	shscanner.dll
Publisher:	Enigma Software Group USA, LLC.
Product name:	SpyHunter4
Description:	Sh scanner
Typical file path:	C:\Program Files\enigma software group\spyhunter\shscanner.dll
File version:	1.0.54.17
Product version:	4.12.13.4202
Size:	2.82 MB (2,961,792 bytes)
Certificate
Issued to:	Enigma Software Group USA
Authority (CA):	VeriSign
Expiration date:	Thursday, April 24, 2014
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

SpyHunter

Enigma Software Group

41% remove

SpyHunter is an antivirus program that also includes its built in 'registry cleaner', Reghunter. It also may be bundled with 3rd party pay per install programs such as InstallIQ.