PowerDVD Ultra 8 Malware?

[seekermeister]

My firewall pops the alert in the screenshot when the CLHelper.exe is used in any way, and each time that it runs a scan. With this file deleted, PowerDVD fails to initiate, so it comes down to a choice between keeping a questionable file or not using PowerDVD. Does anyone really know what the risk of this file is?

 

[fseal]

Personally no, but you may be able to just block that program for good with your windows firewall and if PowerDVD still operates, enjoy...

 

[stormy13]

Not the first AV to flag it,

Avast 5.1 in conflict with Cyberlink PowerDVD

and found a few others as well (Kapersky, Bitdefender, etc). Also not the first time for Outpost either,

Clhelper.exe/Rlhelper.exe

More like a false positive than anything malicious. If it hasn't been flagged before probably find it is a recent definition update that needs to be fixed on Outpost's end.

 

[Ponmayilal]

CLHelper.exe is an important part of the Windows system, which is responsible for a large number of important tasks in your PC.

Removing it can only cause more problems in running your PC/ programs.

Power DVD is not the cause of this problem.So removing Power DVD is not going to be the cure. Other programs also may not run without CLHelper.exe. Are you going to remove them all too?

You should only try to get rid of the virus and cleanup your system with a good antivirus program without removing important system files. You may google and try to find if there is any other way of killing Packed/RLPack.

One other way which may work is after removing CLHelper.exe (assuming that is the infected file), you may run system file checker and see whether it will replace the missing file with a clean one. Good luck.

I do remember that long back I used to extract files from the Windows media and implant them into my system. I had had no occasion to do such surgery thereafter and so I have forgotten all about it.

 

[fseal]

You have any info on that?

The program is located inside the PowerDVD install folder and it's probably not a coincidence that the "CL" in CLHelper is the same initials as the company's name "Cyber Link". (Though there is some reference to a CLHelper from Creativfe Labs as well on the net)

 

[seekermeister]

True, and there is no other instance of the file on my PC, so I don't believe that it is a system file.

 

[seekermeister]

When looking closer at the alert, it appears that what it is actually squawking about is RLPack, rather than CLHelper. When I Googled that, I saw a lot of returns speaking of it as either a trojan or virus, but I also found a webpage where it is a wrapper for compressing files. I'm guessing that is what CL used to compress the CLHelper.exe, but I would like to really be sure.

 

[Ponmayilal]

That is indeed quite interesting. Sometimes the info given on the net can be wrong. This is what I read in one website "Normally, the CLHelper.exe file should be in the C:\Windows\System32 folder. If it is found anywhere else, then the CLHelper.exe could be a virus, Trojan, worm, or spyware!" My only concern was that no system file should be deleted.

I do have Power DVD on two of my machines in India but not here and so I am unable to categorically state whether this file gets installed with Power DVD.

Assuming that it does and that one has got infected leading to the problem, a simple uninstall and reinstall of Power DVD should put a clean copy of the file and clear the problem.

If it does not then one has to assume that the source of this rogue implant or a genuine file turning into a rogue lies elsewhere and should be tackled as such rather than doing away with Power DVD.

 

[seekermeister]

That is indeed quite interesting. Sometimes the info given on the net can be wrong. This is what I read in one website "Normally, the CLHelper.exe file should be in the C:\Windows\System32 folder. If it is found anywhere else, then the CLHelper.exe could be a virus, Trojan, worm, or spyware!"

I do have Power DVD on two of my machines in India but not here and so I am unable to categorically state whether this file gets installed with Power DVD.

Assuming that it does and that one has got infected leading to the problem, a simple uninstall and reinstall of Power DVD should put a clean copy of the file and clear the problem.

If it does not than one has to assume that the source of this rogue implant lies elsewhere and should be tackled rather than doing away with Power DVD.

I don't know where that German website came up with that, because there is no CLHelper in System32 at all...at least not in the root folder, and a Start Menu search doesn't turn it up anywhere else either.

I have reinstalled PowerDVD more than once, and this has occurred each time, but I do not want to permanently uninstall it based on that fact, because there is reason to believe that this is a false positive, in which the trojan/virus is simply using the same name as a legitimate piece of software...assuming that the RLPack software is legitimate.

 

[stormy13]

Have you asked on the Outpost forums? If it is false positive they should know about it so they can fix it.

 

[seekermeister]

Actually, I just posted on their forum before returning here. I'm not sure that the forum is the right place to ask the question though, but I do not know of a route to send the a copy of the file to Acronis for analysis. Here is a link to the RL Pack software website:

http://www.reversinglabs.com/products/RLPack.php

 

[seekermeister]

I just realized that I should probably have posted this on the Security forum, instead of here, so if someone wants to move it, that would be good.

 

[Ponmayilal]

Have a look here to remove Packed.RLPack. Remove Packed.RLPack. Resort to manual removal. Hope it helps.

 

[seekermeister]

Thanks, but since I do not have the siiswin.exe on my computer, I can't uninstall it manually or otherwise. That may be an indication that this is a false positive after all, but when reading the symptoms of the trojan/virus, it does sound a lot like some of the problems that I have been trying to fix. Still, I would like to actually know, one way or the other.

 

[Ponmayilal]

Ok, Start Windows in safe mode and then run Power DVD. Does it start without crashing? ( You may not be able to play DVDs though.) If it does, then in all probabillity some other program is in conflict with Power DVD.

It has been documented that Avira and Avast were respnosible for Power DVD crashes.

Going by this, I would not discount the possibility of some update to your Outpost Security Suite being responsible for the recent crash. As you have conjectured, the outpost alarm may be a false positive after the update.

Please understand these are only conjectures at this stage, as no one else had probably faced the same problem and resolved it.

On this ground and assuming that you could reinstall your security software without any problems, disconnect from the internet, uninstall Outpost and then try Power DVD.

If Power DVD starts without a problem then Outpost is the culprit. If the problem persists - Well, we may have to look elsewhere till we strike gold.

I would then suggest that you try the trial version of Power DVD 11. If it works flawlessly with Outpost running, then you know what. It is time that you upgrade to Power DVD 11.

 

[seekermeister]

In a response to my question at the Outpost Forum, a mod there suggest submitting the file to Virus Total for analysis, and if clean, submit it to Agnitum so that the problem could be fixed. But when I did so, VT only stated that the file had been analyzed previous, and displayed a long list of AV engines used for the analysis. I think that the original list was 49 items long, with only 5 of them detecting the file as malicious, but when I had it reanalyzed, the list shrunk to 43 with the same 5 flagging it.

That same mod felt that it was probably a false positive, and that I should contact Agnitum as suggested previously, but I'm sure that is going to take time, and I'm tired of OP's continual alerts. I will probably just set it on the exclusion list, but I was hoping for some firmer ground to stand on.