Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.47%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.07%
6.2.9200.16384 (win8_rtm.120725-1247)	1.94%
6.2.9200.16384 (win8_rtm.120725-1247)	0.33%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.07%
6.1.7600.16385 (win7_rtm.090713-1255)	3.28%
6.1.7600.16385 (win7_rtm.090713-1255)	4.35%
6.1.7600.16385 (win7_rtm.090713-1255)	52.65%
6.1.7600.16385 (win7_rtm.090713-1255)	2.95%
6.1.7600.16385 (win7_rtm.090713-1255)	19.76%
6.1.7600.16385 (win7_rtm.090713-1255)	2.01%
6.1.7600.16385 (win7_rtm.090713-1255)	0.07%
6.1.7600.16385 (win7_rtm.090713-1255)	0.07%
6.1.7600.16385 (win7_rtm.090713-1255)	0.07%
6.1.1000.18273 (longhorn_mc_dev(wmbla).080702-2311)	0.33%
6.0.6000.16386 (vista_rtm.061101-2205)	7.90%
6.0.6000.16386 (vista_rtm.061101-2205)	0.47%
6.0.6000.16386 (vista_rtm.061101-2205)	1.67%
6.0.6000.16386 (vista_rtm.061101-2205)	0.07%
5.1.2715.3011 (xpsp(wmbla).061009-1511)	0.94%
5.1.2715.2941 (xpsp(wmbla).060629-0920)	0.07%
5.1.2715.2812 (xpsp(wmbla).051215-1116)	0.20%
5.1.2700.2230 built by: private/xpsp_mce_qfe(wmbla)	0.07%
5.1.2700.2180 (private/xpsp_mce.040810-0205)	0.20%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

SetServiceStatus, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, AddAce, GetAce, GetAclInformation, DeregisterEventSource, RegisterEventSourceW, ReportEventW, InitializeSecurityDescriptor, LookupAccountNameW, AddAccessAllowedAce, InitializeAcl, GetLengthSid, RegDeleteValueW, SetSecurityDescriptorDacl, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW, RegSetValueExW, RegGetValueW, RegCreateKeyExW, CreateWellKnownSid, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyW, SetNamedSecurityInfoW, SetEntriesInAclW, GetNamedSecurityInfoW, LookupAccountSidW, GetTokenInformation, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, IsValidSid, CopySid, GetSecurityDescriptorDacl, OpenProcessToken, CloseServiceHandle, OpenServiceW, OpenSCManagerW, DeleteService, ControlService, RegEnumKeyExW, ChangeServiceConfig2W, CreateServiceW, RegDeleteKeyW, FreeSid, CheckTokenMembership, AllocateAndInitializeSid, SetSecurityInfo, ConvertStringSecurityDescriptorToSecurityDescriptorW

ehtrace.dll

ehAllocateEventBuffer, ehFreeEventBuffer, ehUnregisterTraceGUIDs, ehTraceEvent, ehRegisterTraceGUIDs

faultrep.dll

ReportFault

kernel32.dll

CreateEventW, SetPriorityClass, GetCurrentProcess, GetProfileIntW, GetCommandLineW, SetUnhandledExceptionFilter, HeapSetInformation, lstrlenW, EnterCriticalSection, LeaveCriticalSection, GetLocaleInfoW, GetUserDefaultUILanguage, GetTickCount, GetCurrentThreadId, GetSystemTimeAsFileTime, SleepEx, QueueUserAPC, GetCurrentThread, DuplicateHandle, GetCurrentProcessId, HeapReAlloc, CancelWaitableTimer, CreateWaitableTimerW, CreateThread, SetWaitableTimer, GetProcAddress, FreeLibrary, LoadLibraryExW, WaitForMultipleObjectsEx, WaitForMultipleObjects, WaitForSingleObject, ResetEvent, FindNextFileW, DeleteFileW, SetFileAttributesW, FindFirstFileW, GetFileAttributesW, ExitThread, LoadLibraryW, ExpandEnvironmentStringsW, LocalFree, OpenThread, GetProcessHeap, HeapAlloc, GetLastError, GetVersionExW, VirtualProtect, VirtualAlloc, GetSystemInfo, VirtualQuery, InterlockedExchange, InterlockedCompareExchange, GetStartupInfoW, GetModuleHandleA, InitializeCriticalSection, QueryPerformanceCounter, TerminateProcess, UnhandledExceptionFilter, OutputDebugStringW, GetLocalTime, EncodeSystemPointer, DecodeSystemPointer, GetTempPathW, MoveFileExW, OutputDebugStringA, Sleep, MultiByteToWideChar, SetEvent, CloseHandle, InterlockedDecrement, InterlockedIncrement, FindClose, DeleteCriticalSection, HeapFree, GetModuleHandleW, lstrcmpiW, GetModuleFileNameW, SizeofResource, LoadResource, FindResourceW, GetTickCount64, LocalAlloc, K32GetModuleBaseNameW, CreateDirectoryW, GetExitCodeThread, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, lstrlenA, SetThreadExecutionState, GetVersionExA, RaiseException

msvcrt.dll

DllMain

ole32.dll

CoTaskMemAlloc, CoCreateInstance, CoFreeUnusedLibrariesEx, CoWaitForMultipleHandles, CoCreateGuid, StringFromCLSID, StringFromGUID2, CoInitializeSecurity, CoTaskMemFree, CLSIDFromString, CoInitialize, CoDisconnectObject, CoInitializeEx, CoUninitialize, CoImpersonateClient, CoRevertToSelf, CoSuspendClassObjects, CoRegisterClassObject, CoRevokeClassObject, CoTaskMemRealloc

psapi.dll

GetModuleBaseNameW

shell32.dll

SHGetKnownFolderPath, SHSetLocalizedName, SHCreateDirectoryExW

shlwapi.dll

PathFileExistsW

slc.dll

SLGetWindowsInformationDWORD

user32.dll

TranslateMessage, SetTimer, PostThreadMessageW, KillTimer, RegisterDeviceNotificationW, MsgWaitForMultipleObjectsEx, DispatchMessageW, PeekMessageW, LoadStringW, GetMessageW, UnregisterDeviceNotification, CharNextW, UnregisterClassA

version.dll

GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueA

Export table

_CETWProvider_Initialize@20

_CETWProvider_TraceCriticalCall@12

_CETWProvider_TraceEHomeEvent@56

_CETWProvider_TraceErrorEvent@16

_CETWProvider_TraceErrorLevel@24

_CETWProvider_TraceEventID@12

_CETWProvider_TraceInfo@12

_CETWProvider_TracePerfMarkerEnd@12

_CETWProvider_TracePerfMarkerStart@12

_CETWProvider_TraceTextLevel@20

_CETWProvider_TraceVideoSize@16

_CETWProvider_Uninitialize@4

ehrecvr.exe

Windows Media Center Receiver Service by Microsoft

Remove ehrecvr.exe

Version:	6.0.6000.16386 (vista_rtm.061101-2205)
MD5:	9be3744d295a7701eb425332014f0797
SHA1:	9a31371b6836c9e2a951a3399e4ddaba9aef4b78
SHA256:	1a139ee9232581e466591c5ebef41e4bf1f82d99c1959f1c68c879b240e9f46d

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is ehrecvr.exe?

Windows Media Center Service for TV and FM broadcast reception is a Windows service The Windows Media Center Receiver Service runs that as NT AUTHORITY\networkService in its own process.

About ehrecvr.exe (from Microsoft)

“Microsoft Windows Media Center is a feature of certain SKUs of the Windows 7 operating system that includes enhanced capabilities for consolidating digital entertainment and media content and deliveri”

Details

File name:	ehrecvr.exe
Publisher:	Microsoft Corporation
Product name:	Windows Media Center Receiver Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\windows\ehome\ehrecvr.exe
Original name:	ehRecvr.exe.mui
File version:	6.0.6000.16386 (vista_rtm.061101-2205)
Product version:	6.0.6000.16386
Size:	285.5 KB (292,352 bytes)
Digital DNA
PE subsystem:	Windows GUI
Entropy:	5.715225
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'ehRecvr'

Network connections

[UDP] listens on port 55866

[UDP] listens on port 65521

[UDP] listens on port 49198

[UDP] listens on port 57993

[UDP] listens on port 49441

[UDP] listens on port 52609

[UDP] listens on port 62032

[UDP] listens on port 58121

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00197277%	0.028634%
Kernel CPU:	0.00121655%	0.013761%
User CPU:	0.00075621%	0.014873%
Kernel CPU time:	772,517 ms/min	100,923,805ms/min
CPU cycles:	215,643/sec	17,470,203/sec
Memory
Private memory:	10.98 MB	21.59 MB
Private (maximum):	15.83 MB
Private (minimum):	11.8 MB
Non-paged memory:	10.98 MB	21.59 MB
Virtual memory:	98.16 MB	140.96 MB
Virtual memory (peak):	99.86 MB	169.69 MB
Working set:	12.72 MB	18.61 MB
Working set (peak):	16.25 MB	37.95 MB
Page faults:	15,985/min	2,039/min
I/O
I/O read transfer:	10 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	6 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	818 Bytes/sec	448.09 KB/min
I/O other operations:	18/sec	1,671/min
Resource allocations
Threads:	20	12
Handles:	382	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\windows\ehome\ehrecvr.exe
Owner:	NETWORK SERVICE
Windows Service
Service name:	ehRecvr
Display name:	Servicio Receptor de Windows Media Center
Description:	“A Windows Media Center televízió- és rádióvételi szolgáltatása”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads

Averages

ADVAPI32.dll
Total CPU:	0.00019919%	0.272967%
Kernel CPU:	0.00016121%	0.107585%
User CPU:	0.00003798%	0.165382%
CPU cycles:	5,580/sec	5,741,424/sec
Memory:	792 KB	1.16 MB
MsDri.dll
Total CPU:	0.00015388%
Kernel CPU:	0.00010510%
User CPU:	0.00004878%
CPU cycles:	3,932/sec
Memory:	420 KB
ehRecvr.exe (main module)
Total CPU:	0.00015228%
Kernel CPU:	0.00005817%
User CPU:	0.00009412%
CPU cycles:	24,097/sec
Memory:	296 KB
winhttp.dll (Windows HTTP Services by Microsoft)
Total CPU:	0.00009846%
Kernel CPU:	0.00006814%
User CPU:	0.00003032%
CPU cycles:	3,227/sec
Memory:	384 KB
sbe.dll
Total CPU:	0.00007158%
Kernel CPU:	0.00004711%
User CPU:	0.00002447%
CPU cycles:	180,870/sec
Memory:	332 KB
SSDPAPI.dll
Total CPU:	0.00003216%
Kernel CPU:	0.00002375%
User CPU:	0.00000841%
CPU cycles:	760/sec
Memory:	48 KB
ksproxy.ax
Total CPU:	0.00001566%
Kernel CPU:	0.00001566%
User CPU:	0.00000000%
CPU cycles:	3/sec
Memory:	152 KB
quartz.dll
Total CPU:	0.00000987%
Kernel CPU:	0.00000493%
User CPU:	0.00000493%
CPU cycles:	102/sec
Memory:	1.45 MB
WMVCore.DLL
Total CPU:	0.00000493%
Kernel CPU:	0.00000493%
User CPU:	0.00000000%
CPU cycles:	9/sec
Memory:	2.29 MB
ntdll.dll
Total CPU:	0.00000122%
Kernel CPU:	0.00000122%
User CPU:	0.00000000%
CPU cycles:	32/sec
Memory:	1.16 MB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	56.50%
Windows 7 Ultimate	27.00%
Windows 7 Professional	8.50%
Windows Vista Home Premium	4.00%
Windows 8.1 Pro with Media Center	3.00%
Windows Seven Black Edition	0.50%
Windows 8 Pro with Media Center	0.50%

Distribution by country

United States installs about 50.75% of Windows Media Center Receiver Service.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	28.90%
Hewlett-Packard	18.25%
ASUS	14.45%
Acer	10.65%
Toshiba	9.89%
Lenovo	4.56%
Sony	3.04%
Samsung	2.28%
GIGABYTE	2.28%
MSI	1.52%
Alienware	0.76%
Medion	0.76%
Intel	0.76%
Gateway	0.76%
NEC	0.76%
Sahara	0.38%

Remove Adware and Spyware Programs, FREE Download!