Should I block it?

No, this file is 100% safe to run.

Additional versions

1.0.3203	18.52%
1.0.3203	66.67%
1.0.3203	3.70%
1.0.3203	3.70%
1.0.3203	3.70%
1.0.3203	3.70%

(Note, CyberLink publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

clhnserviceforpowerdvd12.exe (CLHNServiceForPowerDVD12 Module by CyberLink)

PE file structure

Show functions

Import table

advapi32.dll

GetTokenInformation, OpenThreadToken, OpenProcessToken, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueW, RegQueryInfoKeyW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegOpenKeyExW, StartServiceCtrlDispatcherW, ControlService, DeleteService, CreateServiceW, RegDeleteValueW, RegSetValueExW, RegCloseKey, RegQueryValueExW, SetServiceStatus, RegisterServiceCtrlHandlerW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, OpenSCManagerW, OpenServiceW, CloseServiceHandle

iphlpapi.dll

SetIpTTL

kernel32.dll

OutputDebugStringW, GetCPInfo, SetStdHandle, EnterCriticalSection, LeaveCriticalSection, GetCurrentThread, GetCurrentProcess, CloseHandle, lstrcatW, lstrcpyW, LoadLibraryW, GetProcAddress, lstrcpynW, LoadLibraryExW, GetLastError, FindResourceW, LoadResource, SizeofResource, lstrlenA, MultiByteToWideChar, FreeLibrary, GetModuleHandleW, GetShortPathNameW, InterlockedIncrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameW, lstrlenW, GetCommandLineW, lstrcmpiW, GetCurrentThreadId, InterlockedDecrement, GetOEMCP, GetACP, GetStringTypeW, GetStringTypeA, LCMapStringW, FlushFileBuffers, LoadLibraryA, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, SetFilePointer, WideCharToMultiByte, WriteFile, RtlUnwind, HeapFree, HeapAlloc, HeapReAlloc, GetModuleHandleA, GetStartupInfoW, GetVersion, ExitProcess, TlsSetValue, TlsAlloc, SetLastError, TlsGetValue, GetModuleFileNameA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetEnvironmentStrings, GetCommandLineA, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, LCMapStringA

ole32.dll

CoCreateInstance, CoRevokeClassObject, CoRegisterClassObject, CoTaskMemRealloc, CoTaskMemAlloc, CoInitialize, CoInitializeSecurity, CoUninitialize, CoTaskMemFree

user32.dll

DispatchMessageW, MessageBoxW, LoadStringW, GetMessageW, PostThreadMessageW, CharNextW

CLHNServiceForPowerDVD.exe

CLHNServiceForPowerDVD Module by CyberLink (Signed)

Remove CLHNServiceForPowerDVD.exe

Version:	1.0.3203
MD5:	4aa6694fb767bbff6a8ef080806447bd
SHA1:	80f65ab080b61565098f6af0f72b2b2c30caa11a
SHA256:	4920b3683fde19a86453c76e08c23132b037d254afb7147e84130c06aa90b0f8

Overview

clhnserviceforpowerdvd.exe runs as a service under the name CLHNServiceForPowerDVD with extensive SYSTEM privileges (full administrator access). This is typically installed with the program CyberLink PowerDVD 11 published by CyberLink Corp.. The file is digitally signed by CyberLink which was issued by the VeriSign certificate authority (CA).

Details

File name:	clhnserviceforpowerdvd.exe
Product name:	CLHNServiceForPowerDVD Module
Typical file path:	C:\Program Files\cyberlink\powerdvd11\kernel\dmp\clhnserviceforpowerdvd.exe
File version:	1.0.3203
Size:	81.29 KB (83,240 bytes)
Certificate
Issued to:	CyberLink
Authority (CA):	VeriSign
Effective date:	Monday, February 16, 2009
Expiration date:	Thursday, April 12, 2012
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

CyberLink PowerDVD 11

CyberLink Corp.

5% remove

CyberLink PowerDVD 11 is a media player for Microsoft Windows. PowerDVD is distributed on physical media or by download from the Cyberlink website. It is often bundled with a variety of PC systems and peripheral devices (particularly optical drives).

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'CLHNServiceForPowerDVD'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00029143%	0.028634%
Kernel CPU:	0.00002351%	0.013761%
User CPU:	0.00026792%	0.014873%
Kernel CPU time:	17,344 ms/min	100,923,805ms/min
CPU cycles:	1,627/sec	17,470,203/sec
Memory
Private memory:	1.13 MB	21.59 MB
Private (maximum):	3.88 MB
Private (minimum):	2.59 MB
Non-paged memory:	1.13 MB	21.59 MB
Virtual memory:	29.9 MB	140.96 MB
Virtual memory (peak):	33.78 MB	169.69 MB
Working set:	2.75 MB	18.61 MB
Working set (peak):	4.16 MB	37.95 MB
Page faults:	1,897/min	2,039/min
I/O
I/O other transfer:	2 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	81	600
GUI GDI count:	4	103
GUI USER count:	4	49

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\cyberlink\powerdvd11\kernel\dmp\clhnserviceforpowerdvd.exe"
Owner:	SYSTEM
Windows Service
Service name:	CLHNServiceForPowerDVD
Description:	“CLHNServiceForPowerDVD”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads