Should I block it?

No, this file is 100% safe to run.

Additional versions

3,7,0,190	1.86%
3,7,0,190	1.86%
3,6,6,129	6.12%
3,6,6,129	4.26%
3,6,4,160	1.06%
3,6,4,160	0.27%
3,6,3,549	7.45%
3,6,3,549	4.52%
3,6,3,489	0.27%
3,6,3,489	0.27%
3,6,2,196	1.86%
3,6,2,196	1.33%
3,6,2,168	6.12%
3,6,2,168	3.19%
3,6,0,187	17.82%
3,6,0,187	9.04%
3,6,0,165	0.27%
3,6,0,164	0.27%
3,6,0,164	0.27%
3,5,0,229	19.41%
3,5,0,229	9.31%
3,5,0,227	0.27%
3,4,1,195	1.60%
3,4,1,195	0.80%
2,9,0,242	0.27%
2,8,0,306	0.27%

Relationships

Hosts

rundll32.exe (Windows host process (Rundll32) by Microsoft)

Parent processes

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegOpenKeyExW, RegCloseKey, RegQueryValueExW

kernel32.dll

lstrlenW, GetPrivateProfileIntW, InterlockedExchange, GetLastError, GetProcAddress, DisableThreadLibraryCalls, lstrcmpiW, lstrcatW, GetModuleFileNameW, lstrcpyW, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, RtlUnwind, TerminateProcess, GetVersionExW, LoadLibraryW, CloseHandle, CreateMutexW, IsProcessorFeaturePresent

ole32.dll

CoUninitialize, CoCreateInstance, CoInitializeEx

user32.dll

UnhookWindowsHookEx, SetWindowsHookExW, GetClassNameW, DispatchMessageW, GetMessageW, CallNextHookEx, TranslateMessage

Export table

saHooker_Initialize

saHooker_Initialize_and_Wait

saHooker_Uninitialize

saHook.dll

McAfee SiteAdvisor by McAfee (Signed)

Remove saHook.dll

Version:	3,6,0,187
MD5:	43ef8ca8fa9dc5f998fbc4c12c9556e2
SHA1:	24a68f0efd33c36b6cae033ccc6e0337a7765d89
SHA256:	2880f5dc537432d3114dbb331fcd421c95300d1cc9337cabac02460be3ed5449

What is saHook.dll?

SiteAdvisor is a service that reports on the safety of web sites by crawling the web and testing the sites it finds for malware and spam. The functionality of SiteAdvisor can be accessed either through a Browser Plugin or by submitting a URL to the website. SiteAdvisor only rates sites based on the risk of malware or spam.

About saHook.dll (from McAfee)

“McAfee SiteAdvisor software is a free browser plug-in that provides simple Web site safety ratings and a Secure Search box so you can surf, search and shop more safely. With SiteAdvisor software insta”

Details

File name:	sahook.dll
Publisher:	McAfee, Inc.
Product name:	McAfee SiteAdvisor
Description:	SiteAdvisor
Typical file path:	C:\Program Files\McAfee\SiteAdvisor\sahook.dll
File version:	3,6,0,187
Product version:	3,6,0,0
Size:	19.6 KB (20,072 bytes)
Certificate
Issued to:	McAfee
Authority (CA):	VeriSign
Expiration date:	Tuesday, December 31, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

McAfee SiteAdvisor

McAfee, Inc.

10% remove

SiteAdvisor is a service that reports on the safety of web sites by crawling the web and testing the sites it finds for malware and spam. A paid version of McAfee SiteAdvisor, McAfee SiteAdvisor Plus, has extra features. The functionality of SiteAdvisor can be accessed either through a Browser Plugin or by submitting a URL to the website. In addition to selling to the end consumers, McAfee also sells to the web site owners with their Mc...

SiteAdvisor

McAfee, Inc.

40% remove

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00040802%	0.028634%
Kernel CPU:	0.00028263%	0.013761%
User CPU:	0.00012539%	0.014873%
Kernel CPU time:	43,654 ms/min	100,923,805ms/min
CPU cycles:	10,992/sec	17,470,203/sec
Memory
Private memory:	1.91 MB	21.59 MB
Private (maximum):	11.28 MB
Private (minimum):	1.87 MB
Non-paged memory:	1.91 MB	21.59 MB
Virtual memory:	53.37 MB	140.96 MB
Virtual memory (peak):	56.75 MB	169.69 MB
Working set:	3.72 MB	18.61 MB
Working set (peak):	18.8 MB	37.95 MB
Page faults:	12,878/min	2,039/min
I/O
I/O read transfer:	34 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	15 Bytes/sec	448.09 KB/min
I/O other operations:	2/sec	1,671/min
Resource allocations
Threads:	2	12
Handles:	66	600
GUI GDI count:	11	103
GUI GDI peak:	11	142
GUI USER count:	4	49
GUI USER peak:	4	71

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	"C:\Windows\System32\rundll32.exe" "C:\progra~2\mcafee\sitead~1\sahook.dll", sahooker_initialize_and_wait "C:\Windows\System32\rundll32.exe" "C:\progra~1\mcafee\sitead~1\sahook.dll", sahooker_initialize_and_wait
Owner:	SYSTEM
Parent processes:	sahook.dll (McAfee SiteAdvisor by McAfee) McSACore.exe (McAfee SiteAdvisor by McAfee) mcsvhost.exe (McAfee Shared Service Host by McAfee)

Threads