My firewall pops the alert in the screenshot when the CLHelper.exe is used in any way, and each time that it runs a scan. With this file deleted, PowerDVD fails to initiate, so it comes down to a choice between keeping a questionable file or not using PowerDVD. Does anyone really know what the risk of this file is?
Personally no, but you may be able to just block that program for good with your windows firewall and if PowerDVD still operates, enjoy... :)
Not the first AV to flag it,
Avast 5.1 in conflict with Cyberlink PowerDVD
and found a few others as well (Kapersky, Bitdefender, etc). Also not the first time for Outpost either,
Clhelper.exe/Rlhelper.exe
More like a false positive than anything malicious. If it hasn't been flagged before probably find it is a recent definition update that needs to be fixed on Outpost's end.
CLHelper.exe is an important part of the Windows system, which is responsible for a large number of important tasks in your PC.
Removing it can only cause more problems in running your PC/ programs.
Power DVD is not the cause of this problem.So removing Power DVD is not going to be the cure. Other programs also may not run without CLHelper.exe. Are you going to remove them all too?:)
You should only try to get rid of the virus and cleanup your system with a good antivirus program without removing important system files. You may google and try to find if there is any other way of killing Packed/RLPack.
One other way which may work is after removing CLHelper.exe (assuming that is the infected file), you may run system file checker and see whether it will replace the missing file with a clean one. Good luck.
I do remember that long back I used to extract files from the Windows media and implant them into my system. I had had no occasion to do such surgery thereafter and so I have forgotten all about it.
Last edited by Ponmayilal; 22 Apr 2011 at 13:37.
You have any info on that?
The program is located inside the PowerDVD install folder and it's probably not a coincidence that the "CL" in CLHelper is the same initials as the company's name "Cyber Link". (Though there is some reference to a CLHelper from Creativfe Labs as well on the net)
True, and there is no other instance of the file on my PC, so I don't believe that it is a system file.
When looking closer at the alert, it appears that what it is actually squawking about is RLPack, rather than CLHelper. When I Googled that, I saw a lot of returns speaking of it as either a trojan or virus, but I also found a webpage where it is a wrapper for compressing files. I'm guessing that is what CL used to compress the CLHelper.exe, but I would like to really be sure.
That is indeed quite interesting. Sometimes the info given on the net can be wrong. This is what I read in one website "Normally, the CLHelper.exe file should be in the C:\Windows\System32 folder. If it is found anywhere else, then the CLHelper.exe could be a virus, Trojan, worm, or spyware!" My only concern was that no system file should be deleted.
I do have Power DVD on two of my machines in India but not here and so I am unable to categorically state whether this file gets installed with Power DVD.
Assuming that it does and that one has got infected leading to the problem, a simple uninstall and reinstall of Power DVD should put a clean copy of the file and clear the problem.
If it does not then one has to assume that the source of this rogue implant or a genuine file turning into a rogue lies elsewhere and should be tackled as such rather than doing away with Power DVD.
I don't know where that German website came up with that, because there is no CLHelper in System32 at all...at least not in the root folder, and a Start Menu search doesn't turn it up anywhere else either.
I have reinstalled PowerDVD more than once, and this has occurred each time, but I do not want to permanently uninstall it based on that fact, because there is reason to believe that this is a false positive, in which the trojan/virus is simply using the same name as a legitimate piece of software...assuming that the RLPack software is legitimate.
Have you asked on the Outpost forums? If it is false positive they should know about it so they can fix it.
Quote