Versions

3,7,0,190	1.86%
3,7,0,190	1.86%
3,6,6,129	6.12%
3,6,6,129	4.26%
3,6,4,160	1.06%
3,6,4,160	0.27%
3,6,3,549	7.45%
3,6,3,549	4.52%
3,6,3,489	0.27%
3,6,3,489	0.27%
3,6,2,196	1.86%
3,6,2,196	1.33%
3,6,2,168	6.12%
3,6,2,168	3.19%
3,6,0,187	17.82%
3,6,0,187	9.04%
3,6,0,165	0.27%
3,6,0,164	0.27%
3,6,0,164	0.27%
3,5,0,229	19.41%
3,5,0,229	9.31%
3,5,0,227	0.27%
3,4,1,195	1.60%
3,4,1,195	0.80%
2,9,0,242	0.27%
2,8,0,306	0.27%

There are 26 versions of sahook.dll in the wild, the latest version being 3,7,0,190. sahook.dll is run as a standard windows process in the context of the SYSTEM account with extensive privileges. The average file size is about 18.13 KB. The file is a digitally signed and issued to McAfee by VeriSign. During the process's lifecycle, the typical CPU resource utilization is about 0.0002% including both foreground and background operations, the average private memory consumption is about 1.81 MB with the maximum memory reaching around 10.45 MB. Addionally, typically read and write I/O disk operations is about 181 Bytes per minute for reads and 0 Bytes per minute for writes.

SiteAdvisor is a service that reports on the safety of web sites by crawling the web and testing the sites it finds for malware and spam. The functionality of SiteAdvisor can be accessed either through a Browser Plugin or by submitting a URL to the website. SiteAdvisor only rates sites based on the risk of malware or spam.