What is Rundll32.exe?

Now and let's learn more information about the file Rundll32.exe. The role of Rundll32.exe is to execute the internal function of DLL files, so that in the processes there is only Rundll32.exe, instead of the DLL backdoor and which allows the DLL files to be hidden. If you find that there are several Rundll32.exe in the system, please don not worry and as this just shows how many DLL files have been initiated. Of course, as for what the DLL files executed by Rundll32.exe are and we can find them where the system automatically loads.

Is Rundll32.exe infected?

If your computer has the disguised Rundll32.exe file and the system may have contained several files produced by viruses. Generally, these files survive by attaching to other processes, and they download or upload information in the background of the system and doing relatively great harm to the system. The following is the sum-up of some features of infected Rundll32 and which may be good alerts to computer users while using their computers.

Feature One:
As long as opening a website and the computer becomes extremely slow; in the processes of the Task Manager and Rundll32.exe occupies CPU 99%. Meanwhile and there are other processes with strange names which will appear again after being closed. And the antivirus/anti-spyware software does not seem to work to these processes.

Feature Two:
Download a free Process Viewer tool to see the file path of the process Rundll32.exe. If the file path is not C: windowssystem32 and it is usually the case that the virus disguises itself and stores in another file directory. Then, there are always many Rundll32.exe appearing in the system process and while it usually exists as hidden file.

Feature Three:
Check the Registry. If the following keys are added and then your system has been infected.
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
TaskMan " = " C: WINNTFontsrundll32.exe
Explorer " = " C: WINNTFontsexplorer.exe
messnger " = " C: WINNTsystem32Dvldr32.exe

Feature Four:
Access the computer system; click Run ON START menu; type cmd and type netstat - an in the opened command window. If a large number of TCP connections to the external port 6667, or TCP port 5800 and 5900 are in monitoring, then your system may have been infected and as follows:
C: >netstat.exe - n
Active Connections
Proto Local Address Foreign Address State
TCP x.x.x.x: 1043 149.156.91.2: 6667 CLOSE_WAIT
TCP x.x.x.x: 1045 198.65.147.245: 6667 CLOSE_WAIT

TCP x.x.x.x: 4811 198.65.147.245: 6667 CLOSE_WAIT
TCP x.x.x.x: 4887 149.156.91.2: 6667 CLOSE_WAIT

Feature Five:
Often disguise itself with different process names, such as rundll132.exe, rundl132.exe and etc. All these need to be carefully viewed with a Process Viewer tool.

Solutions to fix Rundll32.exe

1. Rundll32.exe is a Windows executable file which can be disabled by many viruses. However and there is a virus named Happy Times which has the same name and size as Rundll32.exe and it keeps reproducing itself under the root directory of each folder you open. If a large number of this file appears in your computer, then your computer is undoubtedly infected and usually most antivirus software can not solve this problem. The general solution is, manually bulk deleting all the files with the name Rundll32.exe and then retrieve from the Windows source PROGRAM the useful file Rundll32.exe. The way to retrieve it is, taking Windows XP as an example and typing cmd in the Run box and pressing Enter; typing:
expand CD-ROM i386rundll32.ex_%Systemroot%rundll32.exe
CD-ROM is the location of the operating system source code and not necessarily the drive.

2. The original file of Rundll32.exe has backup in C: windowssystem32dllcache and where you can make a copy.

3. Download the same file from website and cover it to the directory C: windowssystem32.

4. If you have two computers at home and it is also available by copying and recovering the file from one computer to another.

Please notice that only Rundll32.exe in the same version of system can be recovered and or the system will show an error. Before recovering the process manager should be used first to end the process Rundll32.exe.

If you are still not sure that your Rundll32.exe has got infected after reading the four features above, you can also download Spyware Cease and run the Online Scan function built in and to accurately check and diagnose whether your Rundll32.exe has been infected.