Should I block it?

No, this file is 100% safe to run.

Additional versions

3,7,0,190	1.86%
3,7,0,190	1.86%
3,6,6,129	6.12%
3,6,6,129	4.26%
3,6,4,160	1.06%
3,6,4,160	0.27%
3,6,3,549	7.45%
3,6,3,549	4.52%
3,6,3,489	0.27%
3,6,3,489	0.27%
3,6,2,196	1.86%
3,6,2,196	1.33%
3,6,2,168	6.12%
3,6,2,168	3.19%
3,6,0,187	17.82%
3,6,0,187	9.04%
3,6,0,165	0.27%
3,6,0,164	0.27%
3,6,0,164	0.27%
3,5,0,229	19.41%
3,5,0,229	9.31%
3,5,0,227	0.27%
3,4,1,195	1.60%
3,4,1,195	0.80%
2,9,0,242	0.27%
2,8,0,306	0.27%

Relationships

Parent processes

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegOpenKeyExW, RegCloseKey, RegQueryValueExW

kernel32.dll

lstrlenW, GetPrivateProfileIntW, InterlockedExchange, GetLastError, GetProcAddress, DisableThreadLibraryCalls, lstrcmpiW, lstrcatW, GetModuleFileNameW, lstrcpyW, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, RtlUnwind, TerminateProcess, GetVersionExW, LoadLibraryW, CloseHandle, CreateMutexW, IsProcessorFeaturePresent

ole32.dll

CoUninitialize, CoCreateInstance, CoInitializeEx

user32.dll

UnhookWindowsHookEx, SetWindowsHookExW, GetClassNameW, DispatchMessageW, GetMessageW, CallNextHookEx, TranslateMessage

Export table

saHooker_Initialize

saHooker_Initialize_and_Wait

saHooker_Uninitialize

saHook.dll

McAfee SiteAdvisor by McAfee (Signed)

Remove saHook.dll

Version:	3,6,2,168
MD5:	0f7f45725dfefc3f894e5c6ac9e3dec4
SHA1:	403a7955e36f47250ce3c4639d1be178b8c1c59a
SHA256:	ef845e6a6e85e1d4b2a414d2aad264e08f805dd384ce4c61be899d01e5e28f1a

What is saHook.dll?

SiteAdvisor is a service that reports on the safety of web sites by crawling the web and testing the sites it finds for malware and spam. The functionality of SiteAdvisor can be accessed either through a Browser Plugin or by submitting a URL to the website. SiteAdvisor only rates sites based on the risk of malware or spam.

About saHook.dll (from McAfee)

“McAfee SiteAdvisor software is a free browser plug-in that provides simple Web site safety ratings and a Secure Search box so you can surf, search and shop more safely. With SiteAdvisor software insta”

Details

File name:	sahook.dll
Publisher:	McAfee, Inc.
Product name:	McAfee SiteAdvisor
Description:	SiteAdvisor
Typical file path:	C:\Program Files\McAfee\SiteAdvisor\sahook.dll
File version:	3,6,2,168
Product version:	3,6,2,0
Size:	17.22 KB (17,632 bytes)
Certificate
Issued to:	McAfee
Authority (CA):	VeriSign
Expiration date:	Tuesday, December 31, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

McAfee SiteAdvisor

McAfee, Inc.

10% remove

SiteAdvisor is a service that reports on the safety of web sites by crawling the web and testing the sites it finds for malware and spam. A paid version of McAfee SiteAdvisor, McAfee SiteAdvisor Plus, has extra features. The functionality of SiteAdvisor can be accessed either through a Browser Plugin or by submitting a URL to the website. In addition to selling to the end consumers, McAfee also sells to the web site owners with their Mc...

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00028314%	0.028634%
Kernel CPU:	0.00023122%	0.013761%
User CPU:	0.00005193%	0.014873%
Kernel CPU time:	25 ms/min	100,923,805ms/min
CPU cycles:	1,268/sec	17,470,203/sec
Memory
Private memory:	2.05 MB	21.59 MB
Private (maximum):	13.11 MB
Private (minimum):	849.71 KB
Non-paged memory:	2.05 MB	21.59 MB
Virtual memory:	54.95 MB	140.96 MB
Virtual memory (peak):	57.65 MB	169.69 MB
Working set:	4.8 MB	18.61 MB
Working set (peak):	24.89 MB	37.95 MB
Page faults:	9,614/min	2,039/min
I/O
I/O read transfer:	12 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	9 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	2	12
Handles:	66	600
GUI GDI count:	11	103
GUI GDI peak:	12	142
GUI USER count:	4	49
GUI USER peak:	4	71

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	"C:\Windows\System32\rundll32.exe" "C:\progra~2\mcafee\sitead~1\sahook.dll", sahooker_initialize_and_wait "C:\Windows\System32\rundll32.exe" "C:\progra~1\mcafee\sitead~1\sahook.dll", sahooker_initialize_and_wait
Owner:	SYSTEM
Parent processes:	sahook.dll (McAfee SiteAdvisor by McAfee) mcsvhost.exe (McAfee Shared Service Host by McAfee) McSACore.exe (McAfee SiteAdvisor by McAfee)

Threads