What is the "TPHKSVC.exe" process on windows 7? Is the "TPHKSVC.exe" process a virus? Can I terminate the "TPHKSVC.exe" process?

"TPHKSVC.exe" process represents "On screen display Fn+Fx handler" program. "TPHKSVC.exe" is for "On Screen Display" service which is related to the Thinkpad On Screen Display Utility to display the function keys on the desktop screen.

"TPHKSVC.exe" process is normally running under the parent process "services" as shown in the process tree below:

Boot
   wininit
      services
         TPHKSVC

On the Processes tab of "Task Manager", "TPHKSVC.exe" process may be listed as:

Image Name                 Memory   Description
--------------------   ----------   -----------
TPHKSVC.exe               6,368 K   On screen display Fn+Fx handler

Additional information about "TPHKSVC.exe" process:

Command line:
   "C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"

Programe file information:
   Name: TPHKSVC.exe
   Location: C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
   Description: On screen display Fn+Fx handler
   Version: 2.51
   Size: 126408 bytes
   Last modified: 5/29/2015 1:15:12 PM
   Company Name: Lenovo Group Limited
   
Some data files used:
C:\Windows
C:\Windows\SysWOW64
C:\Windows\SysWOW64\en-US\setupapi.dll.mui
C:\Windows\SysWOW64\en-US\crypt32.dll.mui
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My

Some registry keys used:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
HKLM\SYSTEM\ControlSet001\Control\SESSION MANAGER
HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale
HKLM\SYSTEM\ControlSet001\services\IBMPMSVC\Parameters\Notification
HKU\.DEFAULT\Control Panel\International
HKLM\SYSTEM\ControlSet001\services\crypt32
HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT

Some DLL libraries used:
C:\windows\SYSTEM32\ntdll.dll
C:\windows\SYSTEM32\wow64.dll
C:\windows\SYSTEM32\wow64win.dll
C:\windows\SYSTEM32\wow64cpu.dll
C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
C:\windows\SysWOW64\ntdll.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\msvcrt.dll

"TPHKSVC.exe" process is not a virus. You can terminate "TPHKSVC.exe" process or stop the "On Screen Display" service. You don't need to display functions keys on the screen.

⇒ "tpnumlk.exe" Process on Windows 7

⇐ "tphkload.exe" Process on Windows 7

⇑ Application Service Processes on Windows 7

⇑⇑ Windows 7 Processes Tutorials