Should I block it?

No, this file is 100% safe to run.

Additional versions

1.0.3203	18.52%
1.0.3203	66.67%
1.0.3203	3.70%
1.0.3203	3.70%
1.0.3203	3.70%
1.0.3203	3.70%

(Note, CyberLink publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

clhnserviceforpowerdvd12.exe (CLHNServiceForPowerDVD12 Module by CyberLink)

PE file structure

Show functions

Import table

advapi32.dll

GetTokenInformation, OpenThreadToken, OpenProcessToken, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueW, RegQueryInfoKeyW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegOpenKeyExW, StartServiceCtrlDispatcherW, ControlService, DeleteService, CreateServiceW, RegDeleteValueW, RegSetValueExW, RegCloseKey, RegQueryValueExW, SetServiceStatus, RegisterServiceCtrlHandlerW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, OpenSCManagerW, OpenServiceW, CloseServiceHandle

iphlpapi.dll

SetIpTTL

kernel32.dll

OutputDebugStringW, GetCPInfo, SetStdHandle, EnterCriticalSection, LeaveCriticalSection, GetCurrentThread, GetCurrentProcess, CloseHandle, lstrcatW, lstrcpyW, LoadLibraryW, GetProcAddress, lstrcpynW, LoadLibraryExW, GetLastError, FindResourceW, LoadResource, SizeofResource, lstrlenA, MultiByteToWideChar, FreeLibrary, GetModuleHandleW, GetShortPathNameW, InterlockedIncrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameW, lstrlenW, GetCommandLineW, lstrcmpiW, GetCurrentThreadId, InterlockedDecrement, GetOEMCP, GetACP, GetStringTypeW, GetStringTypeA, LCMapStringW, FlushFileBuffers, LoadLibraryA, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, SetFilePointer, WideCharToMultiByte, WriteFile, RtlUnwind, HeapFree, HeapAlloc, HeapReAlloc, GetModuleHandleA, GetStartupInfoW, GetVersion, ExitProcess, TlsSetValue, TlsAlloc, SetLastError, TlsGetValue, GetModuleFileNameA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetEnvironmentStrings, GetCommandLineA, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, LCMapStringA

ole32.dll

CoCreateInstance, CoRevokeClassObject, CoRegisterClassObject, CoTaskMemRealloc, CoTaskMemAlloc, CoInitialize, CoInitializeSecurity, CoUninitialize, CoTaskMemFree

user32.dll

DispatchMessageW, MessageBoxW, LoadStringW, GetMessageW, PostThreadMessageW, CharNextW

CLHNServiceForPowerDVD.exe

CLHNServiceForPowerDVD Module by CyberLink (Signed)

Remove CLHNServiceForPowerDVD.exe

Version:	1.0.3203
MD5:	9f7dbe12a2b5be09f9c9e3be20d81e38
SHA1:	7b41971b2eb3080c6ad6b74838415932a9c26c49
SHA256:	21155feced0bbc8e2b20002e8b84a836567f3278a38ed413706b2f8a94b41c6d

Overview

clhnserviceforpowerdvd.exe runs as a service under the name CLHNServiceForPowerDVD with extensive SYSTEM privileges (full administrator access). It is installed with a couple of know programs including CyberLink PowerDVD 11 published by CyberLink Corp. and CyberLink Home Cinema 10 published by CyberLink Corp.. The file is digitally signed by CyberLink which was issued by the VeriSign certificate authority (CA).

Details

File name:	clhnserviceforpowerdvd.exe
Product name:	CLHNServiceForPowerDVD Module
Typical file path:	C:\Program Files\cyberlink\powerdvd11\kernel\dmp\clhnserviceforpowerdvd.exe
File version:	1.0.3203
Size:	81.29 KB (83,240 bytes)
Certificate
Issued to:	CyberLink
Authority (CA):	VeriSign
Effective date:	Monday, February 16, 2009
Expiration date:	Thursday, April 12, 2012
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

CyberLink PowerDVD 11

CyberLink Corp.

5% remove

CyberLink PowerDVD 11 is a media player for Microsoft Windows. PowerDVD is distributed on physical media or by download from the Cyberlink website. It is often bundled with a variety of PC systems and peripheral devices (particularly optical drives).

CyberLink Home Cinema 10

CyberLink Corp.

5% remove

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'CLHNServiceForPowerDVD'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00000129%	0.028634%
User CPU:	0.00000129%	0.014873%
CPU cycles:	28/sec	17,470,203/sec
Memory
Private memory:	1.14 MB	21.59 MB
Private (maximum):	3.71 MB
Private (minimum):	624 KB
Non-paged memory:	1.14 MB	21.59 MB
Virtual memory:	30.77 MB	140.96 MB
Virtual memory (peak):	34.52 MB	169.69 MB
Working set:	1012 KB	18.61 MB
Working set (peak):	4.08 MB	37.95 MB
Page faults:	1,945/min	2,039/min
I/O
I/O other transfer:	0 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	73	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\cyberlink\powerdvd11\kernel\dmp\clhnserviceforpowerdvd.exe"
Owner:	SYSTEM
Windows Service
Service name:	CLHNServiceForPowerDVD
Description:	“CLHNServiceForPowerDVD”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	40.74%
Windows 7 Ultimate	33.33%
Windows 7 Professional	14.81%
Microsoft Windows XP	11.11%

Distribution by country

Ireland installs about 18.52% of CLHNServiceForPowerDVD Module.

Distribution by PC manufacturer

PC Manufacturer	distribution
Acer	25.00%
Dell	25.00%
Toshiba	16.67%
Lenovo	16.67%
Hewlett-Packard	16.67%

Remove Adware and Spyware Programs, FREE Download!