Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Database description of "cvhsvc.exe"


  • Please log in to reply
No replies to this topic

#1 svenskenr

svenskenr

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern PA, USA
  • Local time:01:14 AM

Posted 20 February 2018 - 10:50 PM

The Bleeping Computer database description of the process "cvhsvc.exe" (https://www.bleepingcomputer.com/startups/Client_Virtualization_Handler-27218.html) correctly identifies it as part of the Office 2010 Click-to-Run Virtualization Handler. However, it describes it as being responsible for updating the Click-to-Run software.

 

The thing to keep in mind is that Office 2010 Click-to-Run was strongly based on App-V (Application Virtualization) technology and installs the Office software in a virtualized environment. The Office 2013 Click-to-Run departed a little more from App-V by not isolating the Office software in this manner.

 

It appears that "cvhsvc", "cvh.exe", and "officevirt.exe" - all components of the Virtualization Handler - were what enabled the virtualized software to "reach out" of its "bubble" into the normal disk addressing space to read and write user data. This Microsoft Answers forum thread (https://answers.microsoft.com/en-us/msoffice/forum/msoffice_install-mso_other-mso_2010/office-2010-doesnt-close-completely/adca530d-ad08-4c64-9874-f52ede05296b?messageId=0797a063-b1cd-4177-90c8-8176ea5def1e (02/24/201) provides evidence that "officevirt.exe" starts when a user data file is opened by any virtualized Office 2010 app.



BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users