Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 0.47%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.07%
6.2.9200.16384 (win8_rtm.120725-1247) 1.94%
6.2.9200.16384 (win8_rtm.120725-1247) 0.33%
6.2.8250.0 (winmain_win8beta.120217-1520) 0.07%
6.1.7600.16385 (win7_rtm.090713-1255) 3.28%
6.1.7600.16385 (win7_rtm.090713-1255) 4.35%
6.1.7600.16385 (win7_rtm.090713-1255) 52.65%
6.1.7600.16385 (win7_rtm.090713-1255) 2.95%
6.1.7600.16385 (win7_rtm.090713-1255) 19.76%
6.1.7600.16385 (win7_rtm.090713-1255) 2.01%
6.1.7600.16385 (win7_rtm.090713-1255) 0.07%
6.1.7600.16385 (win7_rtm.090713-1255) 0.07%
6.1.7600.16385 (win7_rtm.090713-1255) 0.07%
6.1.1000.18273 (longhorn_mc_dev(wmbla).080702-2311) 0.33%
6.0.6000.16386 (vista_rtm.061101-2205) 7.90%
6.0.6000.16386 (vista_rtm.061101-2205) 0.47%
6.0.6000.16386 (vista_rtm.061101-2205) 1.67%
6.0.6000.16386 (vista_rtm.061101-2205) 0.07%
5.1.2715.3011 (xpsp(wmbla).061009-1511) 0.94%
5.1.2715.2941 (xpsp(wmbla).060629-0920) 0.07%
5.1.2715.2812 (xpsp(wmbla).051215-1116) 0.20%
5.1.2700.2230 built by: private/xpsp_mce_qfe(wmbla) 0.07%
5.1.2700.2180 (private/xpsp_mce.040810-0205) 0.20%

Relationships

Parent process
Related files

PE structurePE file structure
Show functions
Import table
advapi32.dll
SetServiceStatus, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, AddAce, GetAce, GetAclInformation, DeregisterEventSource, RegisterEventSourceW, ReportEventW, InitializeSecurityDescriptor, LookupAccountNameW, AddAccessAllowedAce, InitializeAcl, GetLengthSid, RegDeleteValueW, SetSecurityDescriptorDacl, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW, RegSetValueExW, RegGetValueW, RegCreateKeyExW, CreateWellKnownSid, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyW, SetNamedSecurityInfoW, SetEntriesInAclW, GetNamedSecurityInfoW, LookupAccountSidW, GetTokenInformation, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, IsValidSid, CopySid, GetSecurityDescriptorDacl, OpenProcessToken, CloseServiceHandle, OpenServiceW, OpenSCManagerW, DeleteService, ControlService, RegEnumKeyExW, ChangeServiceConfig2W, CreateServiceW, RegDeleteKeyW, FreeSid, CheckTokenMembership, AllocateAndInitializeSid, SetSecurityInfo, ConvertStringSecurityDescriptorToSecurityDescriptorW
ehtrace.dll
ehAllocateEventBuffer, ehFreeEventBuffer, ehUnregisterTraceGUIDs, ehTraceEvent, ehRegisterTraceGUIDs
faultrep.dll
ReportFault
kernel32.dll
CreateEventW, SetPriorityClass, GetCurrentProcess, GetProfileIntW, GetCommandLineW, SetUnhandledExceptionFilter, HeapSetInformation, lstrlenW, EnterCriticalSection, LeaveCriticalSection, GetLocaleInfoW, GetUserDefaultUILanguage, GetTickCount, GetCurrentThreadId, GetSystemTimeAsFileTime, SleepEx, QueueUserAPC, GetCurrentThread, DuplicateHandle, GetCurrentProcessId, HeapReAlloc, CancelWaitableTimer, CreateWaitableTimerW, CreateThread, SetWaitableTimer, GetProcAddress, FreeLibrary, LoadLibraryExW, WaitForMultipleObjectsEx, WaitForMultipleObjects, WaitForSingleObject, ResetEvent, FindNextFileW, DeleteFileW, SetFileAttributesW, FindFirstFileW, GetFileAttributesW, ExitThread, LoadLibraryW, ExpandEnvironmentStringsW, LocalFree, OpenThread, GetProcessHeap, HeapAlloc, GetLastError, GetVersionExW, VirtualProtect, VirtualAlloc, GetSystemInfo, VirtualQuery, InterlockedExchange, InterlockedCompareExchange, GetStartupInfoW, GetModuleHandleA, InitializeCriticalSection, QueryPerformanceCounter, TerminateProcess, UnhandledExceptionFilter, OutputDebugStringW, GetLocalTime, EncodeSystemPointer, DecodeSystemPointer, GetTempPathW, MoveFileExW, OutputDebugStringA, Sleep, MultiByteToWideChar, SetEvent, CloseHandle, InterlockedDecrement, InterlockedIncrement, FindClose, DeleteCriticalSection, HeapFree, GetModuleHandleW, lstrcmpiW, GetModuleFileNameW, SizeofResource, LoadResource, FindResourceW, GetTickCount64, LocalAlloc, K32GetModuleBaseNameW, CreateDirectoryW, GetExitCodeThread, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, lstrlenA, SetThreadExecutionState, GetVersionExA, RaiseException
msvcrt.dll
DllMain
ole32.dll
CoTaskMemAlloc, CoCreateInstance, CoFreeUnusedLibrariesEx, CoWaitForMultipleHandles, CoCreateGuid, StringFromCLSID, StringFromGUID2, CoInitializeSecurity, CoTaskMemFree, CLSIDFromString, CoInitialize, CoDisconnectObject, CoInitializeEx, CoUninitialize, CoImpersonateClient, CoRevertToSelf, CoSuspendClassObjects, CoRegisterClassObject, CoRevokeClassObject, CoTaskMemRealloc
psapi.dll
GetModuleBaseNameW
shell32.dll
SHGetKnownFolderPath, SHSetLocalizedName, SHCreateDirectoryExW
shlwapi.dll
PathFileExistsW
slc.dll
SLGetWindowsInformationDWORD
user32.dll
TranslateMessage, SetTimer, PostThreadMessageW, KillTimer, RegisterDeviceNotificationW, MsgWaitForMultipleObjectsEx, DispatchMessageW, PeekMessageW, LoadStringW, GetMessageW, UnregisterDeviceNotification, CharNextW, UnregisterClassA
version.dll
GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueA
Export table
_CETWProvider_Initialize@20
_CETWProvider_TraceCriticalCall@12
_CETWProvider_TraceEHomeEvent@56
_CETWProvider_TraceErrorEvent@16
_CETWProvider_TraceErrorLevel@24
_CETWProvider_TraceEventID@12
_CETWProvider_TraceInfo@12
_CETWProvider_TracePerfMarkerEnd@12
_CETWProvider_TracePerfMarkerStart@12
_CETWProvider_TraceTextLevel@20
_CETWProvider_TraceVideoSize@16
_CETWProvider_Uninitialize@4

ehrecvr.exe

Windows Media Center Receiver Service by Microsoft

Remove ehrecvr.exe
Version:   6.0.6000.16386 (vista_rtm.061101-2205)
MD5:   14ce384d2e27b64c256bda4dc39c312d
SHA1:   0f69f2483f9f20e51f35f98df13ec8ef6f576fe5
SHA256:   d5fa9c2bb162f1c22e419d33671b8202aac245a87f6b183b97f83f5bfa165b41
This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is ehrecvr.exe?

Windows Media Center Service for TV and FM broadcast reception is a Windows service The Windows Media Center Receiver Service runs that as NT AUTHORITY\networkService in its own process.

About ehrecvr.exe (from Microsoft)

“Microsoft Windows Media Center is a feature of certain SKUs of the Windows 7 operating system that includes enhanced capabilities for consolidating digital entertainment and media content and deliveri”

DetailsDetails

File name:ehrecvr.exe
Publisher:Microsoft Corporation
Product name:Windows Media Center Receiver Service
Description:Microsoft® Windows® Operating System
Typical file path:C:\windows\ehome\ehrecvr.exe
Original name:ehRecvr.exe.mui
File version:6.0.6000.16386 (vista_rtm.061101-2205)
Product version:6.0.6000.16386
Size:336 KB (344,064 bytes)
Digital DNA
PE subsystem:Windows GUI
Entropy:5.715225
File packed:No
Code language:Microsoft Visual C++
.NET CLR:No
More details

BehaviorsBehaviors

Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
  • 'ehRecvr'
Network connections
  • [UDP] listens on port 51995

    • ResourcesResource utilization

    (Note: statistics below are averages based on a minimum sample size of 200 unique participants)
    Averages
     
    CPU
    Total CPU:0.00019313%
    0.028634%
    Kernel CPU:0.00008800%
    0.013761%
    User CPU:0.00010513%
    0.014873%
    Kernel CPU time:484 ms/min
    100,923,805ms/min
    CPU cycles:702,281/sec
    17,470,203/sec
    Memory
    Private memory:18.34 MB
    21.59 MB
    Private (maximum):27.77 MB
    Private (minimum):12.66 MB
    Non-paged memory:18.34 MB
    21.59 MB
    Virtual memory:156.98 MB
    140.96 MB
    Virtual memory (peak):158.98 MB
    169.69 MB
    Working set:13.67 MB
    18.61 MB
    Working set (peak):27.81 MB
    37.95 MB
    Page faults:15,076/min
    2,039/min
    I/O
    I/O read transfer:1.2 KB/sec
    1.02 MB/min
    I/O read operations:1/sec
    343/min
    I/O write transfer:10 Bytes/sec
    274.99 KB/min
    I/O write operations:1/sec
    227/min
    I/O other transfer:359 Bytes/sec
    448.09 KB/min
    I/O other operations:9/sec
    1,671/min
    Resource allocations
    Threads:35
    12
    Handles:593
    600

    BehaviorsProcess properties

    Integrety level:System
    Platform:64-bit
    Command line:C:\windows\ehome\ehrecvr.exe
    Owner:NETWORK SERVICE
    Windows Service
    Service name:ehRecvr
    Display name:Servicio Receptor de Windows Media Center
    Description:“A Windows Media Center televízió- és rádióvételi szolgáltatása”
    Type:Win32OwnProcess
    Parent process:services.exe (Services and Controller app by Microsoft)

    ResourcesThreads

    Averages
     
    ehRecvr.exe (main module)
    Total CPU:0.00023300%
    0.272967%
    Kernel CPU:0.00009093%
    0.107585%
    User CPU:0.00014207%
    0.165382%
    CPU cycles:105,561/sec
    5,741,424/sec
    Context switches:4/sec
    79/sec
    Memory:352 KB
    1.16 MB
    winhttp.dll (Windows HTTP Services by Microsoft)
    Total CPU:0.00016624%
    Kernel CPU:0.00000000%
    User CPU:0.00016624%
    CPU cycles:22,375/sec
    Memory:448 KB
    MsDri.dll
    Total CPU:0.00009093%
    Kernel CPU:0.00002273%
    User CPU:0.00006820%
    CPU cycles:1,869/sec
    Memory:548 KB
    ADVAPI32.dll
    Total CPU:0.00005683%
    Kernel CPU:0.00005683%
    User CPU:0.00000000%
    CPU cycles:2,635/sec
    Memory:1.03 MB
    sbe.dll
    Total CPU:0.00003979%
    Kernel CPU:0.00002274%
    User CPU:0.00001705%
    CPU cycles:225,956/sec
    Context switches:10/sec
    Memory:424 KB
    SSDPAPI.dll
    Total CPU:0.00001137%
    Kernel CPU:0.00001137%
    User CPU:0.00000000%
    CPU cycles:358/sec
    Memory:64 KB

    Windows OS versionsDistribution by Windows OS

    OS versiondistribution
    Windows 7 Home Premium 56.50%
    Windows 7 Ultimate 27.00%
    Windows 7 Professional 8.50%
    Windows Vista Home Premium 4.00%
    Windows 8.1 Pro with Media Center 3.00%
    Windows Seven Black Edition 0.50%
    Windows 8 Pro with Media Center 0.50%

    Distribution by countryDistribution by country

    United States installs about 50.75% of Windows Media Center Receiver Service.

    OEM distributionDistribution by PC manufacturer

    PC Manufacturerdistribution
    Dell 28.90%
    Hewlett-Packard 18.25%
    ASUS 14.45%
    Acer 10.65%
    Toshiba 9.89%
    Lenovo 4.56%
    Sony 3.04%
    Samsung 2.28%
    GIGABYTE 2.28%
    MSI 1.52%
    Alienware 0.76%
    Medion 0.76%
    Intel 0.76%
    Gateway 0.76%
    NEC 0.76%
    Sahara 0.38%
    Back to top
    Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

    Download it for FREE