Should I block it?

No, this file is 100% safe to run.

Additional versions

2.0.5417	1.61%
2.0.3027	17.74%
2.0.2807	30.65%
2.0.2807	1.61%
2.0.0828	4.84%
2.0.0705	11.29%
1.1.0808	1.61%
1.1.0808	29.03%
1.0.1321	1.61%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

richvideo64.exe (RichVideo Module by CyberLink)

PE file structure

Show functions

Import table

advapi32.dll

InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ControlService, DeleteService, CreateServiceA, StartServiceCtrlDispatcherA, OpenThreadToken, SetServiceStatus, RegisterServiceCtrlHandlerA, RegisterEventSourceA, ReportEventA, DeregisterEventSource, OpenSCManagerA, OpenServiceA, CloseServiceHandle, RegEnumKeyW, RegEnumKeyA, RegDeleteValueA, RegDeleteValueW, RegDeleteKeyA, RegDeleteKeyW, RegCreateKeyExA, RegCreateKeyExW, RegSetValueExA, RegSetValueExW, RegQueryValueExW, RegEnumKeyExA, RegEnumKeyExW, RegEnumValueA, RegEnumValueW, RegQueryValueExA, RegCloseKey, RegOpenKeyExA, RegOpenKeyExW, CopySid, GetLengthSid, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, GetTokenInformation, OpenProcessToken

kernel32.dll

GetStartupInfoA, IsBadWritePtr, IsBadReadPtr, GetFileSize, SetEvent, CreateEventA, GetLastError, WideCharToMultiByte, CloseHandle, ReadFile, SetEndOfFile, WriteFile, GetVersionExA, CreateFileA, CreateFileW, OutputDebugStringA, OutputDebugStringW, MultiByteToWideChar, FindFirstFileA, FindFirstFileW, GetTempFileNameA, GetTempFileNameW, DeleteFileA, DeleteFileW, CreateDirectoryA, CreateDirectoryW, SetFilePointer, GetTempPathW, GetDriveTypeW, GetDriveTypeA, GetVolumeInformationA, CreateMutexA, InterlockedDecrement, GetCurrentThread, GetCurrentThreadId, lstrcmpiA, GetCommandLineA, InitializeCriticalSection, GetModuleFileNameA, lstrlenA, DeleteCriticalSection, lstrlenW, GetShortPathNameA, GetModuleHandleA, InterlockedIncrement, FreeLibrary, CreateThread, LoadLibraryA, lstrcpyA, lstrcatA, GetCurrentProcess, LeaveCriticalSection, EnterCriticalSection, WaitForSingleObject, GetProcAddress, DeviceIoControl, ResetEvent, QueryDosDeviceA, VirtualFree, VirtualAlloc, SearchPathA

msvcrt.dll

DllMain

ole32.dll

CoCreateInstance, CoInitialize, CoInitializeSecurity, CoRegisterClassObject, CoRevokeClassObject, CoUninitialize, CoDisconnectObject

shell32.dll

SHGetSpecialFolderPathA, SHGetSpecialFolderPathW

shlwapi.dll

PathFileExistsW, PathFileExistsA

user32.dll

MessageBoxA, CharNextA, PostThreadMessageA, DispatchMessageA, GetMessageA, LoadStringA, MessageBoxW, wsprintfA

winmm.dll

timeGetTime

RichVideo.exe

RichVideo Module by CyberLink (Signed)

Remove RichVideo.exe

Version:	1.1.0808
MD5:	bd517c7fb119997effbe39d5e4b37b05
SHA1:	1e14ffce50bad86c0453478cac9c1db0e7213996
SHA256:	4b03555714824fe6c247fa9df910671d7f1ba18c13dd82e5e7147f7aab2bf6b1

Overview

richvideo.exe runs as a service under the name Cyberlink RichVideo Service(CRVS) (RichVideo) with extensive SYSTEM privileges (full administrator access). It is installed with a couple of know programs including PowerDVD published by CyberLink Corp. and CyberLink Home Cinema 10 published by CyberLink Corp.. The file is digitally signed by CyberLink which was issued by the VeriSign certificate authority (CA).

Details

File name:	richvideo.exe
Product name:	RichVideo Module
Typical file path:	C:\Program Files\cyberlink\shared files\richvideo.exe
File version:	1.1.0808
Size:	164 KB (167,936 bytes)
Certificate
Issued to:	CyberLink
Authority (CA):	VeriSign
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Programs

The following programs will install this file

PowerDVD

CyberLink Corp.

3% remove

CyberLink PowerDVD is a media player for Microsoft Windows. All editions support the viewing of DVD. The Ultra and Pro editions support Blu-ray playback, including the playback of Blu-ray 3D content. PowerDVD is distributed on physical media or by download from the Cyberlink website. It is often bundled with a variety of PC systems and peripheral devices.

CyberLink Home Cinema 10

CyberLink Corp.

5% remove

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'RichVideo' (Cyberlink RichVideo Service(CRVS))
RichVideo

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00007204%	0.028634%
Kernel CPU:	0.00004436%	0.013761%
User CPU:	0.00002768%	0.014873%
Kernel CPU time:	23 ms/min	100,923,805ms/min
CPU cycles:	1,490/sec	17,470,203/sec
Memory
Private memory:	1.16 MB	21.59 MB
Private (maximum):	3.63 MB
Private (minimum):	2.29 MB
Non-paged memory:	1.16 MB	21.59 MB
Virtual memory:	49.84 MB	140.96 MB
Virtual memory (peak):	52.79 MB	169.69 MB
Working set:	2.37 MB	18.61 MB
Working set (peak):	3.64 MB	37.95 MB
Page faults:	1,550/min	2,039/min
I/O
I/O read transfer:	36 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	47 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	83	600
GUI GDI count:	8	103
GUI USER count:	4	49

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	"C:\Program Files\cyberlink\shared files\richvideo.exe"
Owner:	SYSTEM
Windows Service
Service name:	RichVideo
Display name:	Cyberlink RichVideo Service(CRVS)
Type:	Win32OwnProcess, InteractiveProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads