rundll32.exe

[rwillis]

I just noticed a few days ago a process in the TM called "rundll32.exe." I'd never seen it there before, so I was suspicious; Apparently it is usually legit (and it's located in windows\system32), but is it anything to be worried about? I haven't seen any noticeable effects in performance, no popups, etc, but the fact that I've never seen it till recently has me worried. I can attach a HJT log if people think it's warranted.

Thanks

 

[Po`Girl]

As you said It`s a valid system file when it`s in system 32 folder.

It`s a file that runs other processes - often properties panels,such as Internet Options.

If you have an Nvidia card,it runs the tray icon for display properties,or some such.

If you kill it in the Task Manager,nothing terrible will happen.

 

[kitty500cat]

To back up Po`Girl, yes, it is a legit file in C:\WINDOWS\system32. It is used to run a file with a .dll extension as an application. If located anywhere else, it's usually malware. If you run HijackThis and look at the log, the top part of the log contains running processes and says where they are executing from. I wish the Windows Task Manager would give the full path of the running file.

 

[rwillis]

Oh yeah, when I ended it the nvidia thing went away; you were right!
Thanks guys, good to know.