RunDLL32

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	(default)	"rundll32.exe [path to DLL file]	Do98Work"
X	98D0CE0C16B1	"rundll32.exe D0CE0C16B1	D0CE0C16B1"
X	A70F6A1D-0195-42a2-934C-D8AC0F7C08EB	"rundll32.exe E6F1873B.DLL	D9EBC318C"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
Y	AdslTaskBar	"rundll32.exe stmctrl.dll	TaskBar"
N	AME_CSA	"rundll32 amecsa.cpl	RUN_DLL"
X	Arucer	"rundll32 Arucer.dll	Arucer"
X	Arucer Dynamic Link Library	"rundll32 Arucer.dll	Arucer"
U	ASK	rundll32.exe [path] ASK.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
?	AudCtrl	"RunDll32 AudCtrl.dll	RCMonitor"
X	AUNPS2	"RUNDLL32 AUNPS2.DLL	_Run@16"
Y	Authentic-ID Toolbar	"rundll32.exe [path] ToolbarATL.dll	LoadTrayIcon"
X	autochk	"rundll32.exe autochk.dll	_IWMPEvents@16"
X	autochk	"rundll32.exe protect.dll	_IWMPEvents@16"
X	autoupdate	"rundll32 DATADX.DLL	SHStart"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
?	AxFilter	"Rundll32 AXFILTER.DLL	Rundll32"
X	babeie	"rundll32 cnbabe.dll	dllstartup"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
U	BatInfEx	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
U	BatLogEx	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
U	BCMHal	"rundll32.exe bcmhal9x.dll	bcinit"
U	BelNotify	"rundll32.exe [path] NPBelv32.dll	RunDll32_BelNotify"
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
U	BLOG	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
?	Bluetooth HCI Monitor	"RunDll32 HCIMNTR.DLL	RunCheckHCIMode"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	BMMGAG	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
U	BMMMONWND	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
X	BookedSpace	"RunDLL32.EXE bs2.dll	DllRun"
X	Bridge	"rundll32.exe [path] Bridge.dll	Load"
X	Bsx3	"RunDLL32.EXE bs3.dll	DllRun"
X	bxsx5	"RunDLL32.EXE bsx5.dll	DllRun"
X	bxxs5	"RunDLL32.EXE bxxs5.dll	dllrun"
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
X	calc	"rundll32.exe calc.dll	_IWMPEvents@0"
N	Ccdecode	"rundll32.exe streamci	StreamingDeviceSetup"
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	cfgmgr51	"RunDLL32.EXE cfgmgr51.dll	DllRun"
X	cfgmgr52	"RunDLL32.EXE cfgmgr52.dll	DllRun"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Cmaudio	"Rundll32 cmicnfg.cpl	CMICtrlWnd"
U	CmPCIaudio	"RunDll32 CMICNFG3.CPL	CMICtrlWnd"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
?	Compaq Computer Security	"Rundll32.exe SECURE32.CPL	Service"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Control	"rundll32.exe ctrlpan.dll	Restore ControlPanel"
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CoolMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CPU Watcher	"rundll32.exe cpu.dll	load"
N	CrazyTalk Serve	"rundll32.exe CrazyTalk.dll	DIIServeMediaFile"
X	CTDrive	"rundll32.exe drvmod.dll	startup"
X	dabrun	"rundll32.exe dabapi.dll	Rundll32"
N	DeadAIM	"rundll32.exe DeadAIM.ocm	ExportedCheckODLs"
X	delsubmit	"rundll32.exe advpack.dll	DelNodeRunDLL32 submit.exe"
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Dialer	"rundll32.exe MSA32CHK.dll	Reg"
X	DisableKeybaord	"Rundll32.exe Keyboard	Disable"
X	DisableMouse	"Rundll32.exe Mouse	Disable"
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	drkly16j	"rundll32.exe drkly16j.dll	ServiceCheck"
X	drvupd	rundll32 ..drvupd.inf	"Hijacker - drvupd.inf file installs a ""searchforge.com"" hijack"
X	EntraOcio	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ForceShow	"rundll32.exe QaBar.dll	ForceShowBar"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	fstsvc	"rundll32.exe fstsvc.dll	start"
U	ftutil2	"rundll32.exe ftutil2.dll	SetWriteCacheMode"
X	Games toolbar	rundll32.exe [path] tbGame.dll DllShowTB	"Topconverting.com/180Search ""Games Toolbar"" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	Gddlib	"rundll32.exe gddlib.dll	start"
X	GetitAll	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetTheMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	gfxtray	"rundll32 ctccw32.dll	findwnd"
X	govurarope	"Rundll32.exe retasevo.dll	s"
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	GsiFinal	"rundll32 gspndll.dll	postInstall final"
X	gvagfxj	rundll32 ...gvagfxj.dll	"Unidentified adware
X	he3bbcff	"rundll32.exe he3bbcff.dll	EnableRunDLL32"
X	he3e3fc4	"rundll32.exe he3e3fc4.dll	EnableRunDLL32"
X	helper.dll	rundll32.exe [path] helper.dll	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	icdd7ee6	"rundll32.exe icdd7ee6.dll	EnableRunDLL32"
X	icddefff	"rundll32.exe icddefff.dll	EnableRunDLL32"
U	ICSDCLT	"rundll32.exe Icsdclt.dll	ICSClient"
X	IE Menu Extension toolbar	rundll32.exe [path] tbextn.dll DllShowTB	"Topconverting.com/180Search ""IEMenuExtension"" toolbar. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	iel2cde8	"rundll32.exe iel2cde8.dll	EnableRunDLL32"
X	ielcaabe	"rundll32.exe ielcaabe.dll	EnableRunDLL32"
U	IKL	rundll32.exe [path] IKL.dll	"IKL surveillance software. Uninstall this software unless you put it there yourself"
X	Image	"rundll32 [path] [trojan filename]	Install"
X	InfoData	"rundll32.exe ********.dll	realset [* = random char]"
X	Instant Access	"rundll32.exe EGDHTML_1023.dll	InstantAccess"
X	Instant Access	"rundll32.exe eg_auth_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMLIB_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMSERVICE_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe p2esocks_****.dll	InstantAccess [**** = digits]"
X	iSecurity applet	"rundll32.exe iSecurity.cpl	SecurityMonitor"
X	jmudkve.dll	"rundll32.exe jmudkve.dll	mzrwkwf"
U	jx_Key	"Rundll32 JXKey.dll	Rundll32Main"
Y	KB926239	"rundll32.exe apphelp.dll	ShimFlushCache"
X	kernctl32	"rundll32 kctl32.dll	initialize"
X	keymgrldr	"rundll32 setupapi	InstallHinfSection... keymgr3.inf"
X	kw3eef76	"rundll32.exe kw3eef76.dll	EnableRunDLL32"
N	lhttseng	"rundll32.exe ..lhttseng.inf	RemoveCabinet"
X	li01f948	"rundll32.exe li01f948.dll	EnableRunDLL32"
X	libtec	"rundll32.exe libtec.dll	start"
U	LicCtrl	"rundll32.exe MMFS.DLL	Service"
X	Ljx	rundll32.exe	"Added by the LINEAG-ABD TROJAN! Note - this is not the legitimate rundll32.exe process
X	load	rundll32.exe	"Added by the WOWCRAFT TROJAN!"
X	Loadhg	rundll32.exe	"Added by the LINEAG-ABX TROJAN!"
X	LoadHTML	"rundll32.exe regsvr32.exe	MShtmpre"
X	loadMecq3	rundll32.exe	"Added by the LEGMIR-AS TROJAN! Note - this is not the legitimate rundll32.exe process
X	loadMefs	rundll32.exe	"Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process
U	LoadPowerProfile	Rundll32.exe powrprof.dll	"Power management specifics such as monitor shut-off
X	LoadPowerProfile	Rundll32.exe	"Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has ""powrprof.dll"" appended to the command/data line"
X	LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	"Ulubione adult content dialer. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	LoadSIPS	"rundll32.exe SIPSPI32.dll	SIPSPI32"
X	logonUiInit	Rundll32.exe rgtndz.dll	"Identified as a variant of the Trojan-Clicker.Win32.Agent.bqy malware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""rgtndz.dll"" file is found in %System%"
X	LosMejoresMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfGames	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfJokes	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ltssvc	"rundll32.exe ltssvc.dll	start"
X	LTT2	rundll32.exe	"Added by the LINEAGE-BI TROJAN!"
Y	LXBSCATS	"rundll32 [path] LXBStime.dll	_RunDLLEntry@16"
Y	LXBTCATS	"rundll32 [path] LXBTtime.dll	_RunDLLEntry@16"
Y	LXBUCATS	"rundll32 [path] LXBUtime.dll	_RunDLLEntry@16"
Y	LXBXCATS	"rundll32 [path] LXBXtime.dll	_RunDLLEntry@16"
Y	LXBYCATS	"rundll32 [path] LXBYtime.dll	_RunDLLEntry@16"
Y	LXCCCATS	"rundll32 [path] LXCCtime.dll	_RunDLLEntry@16"
U	LXCDCATS	"rundll32 [path] LXCDtime.dll	_RunDLLEntry@16"
Y	LXCECATS	"rundll32 [path] LXCEtime.dll	_RunDLLEntry@16"
Y	LXCFCATS	"rundll32 [path] LXCFtime.dll	_RunDLLEntry@16"
Y	LXCGCATS	"rundll32 [path] LXCGtime.dll	_RunDLLEntry@16"
Y	LXCJCATS	"rundll32 [path] LXCJtime.dll	_RunDLLEntry@16"
Y	LXCQCATS	"rundll32 [path] LXCQtime.dll	_RunDLLEntry@16"
Y	LXCRCATS	"rundll32 [path] LXCRtime.dll	_RunDLLEntry@16"
Y	LXCTCATS	"rundll32 [path] LXCTtime.dll	_RunDLLEntry@16"
Y	LXCYCATS	"rundll32 [path] LXCYtime.dll	_RunDLLEntry@16"
Y	LXDBCATS	"rundll32 [path] LXDBtime.dll	_RunDLLEntry@16"
Y	LXDCCATS	"rundll32 [path] LXDCtime.dll	_RunDLLEntry@16"
Y	LXDDCATS	"rundll32 [path] LXDDtime.dll	_RunDLLEntry@16"
Y	LXDICATS	"rundll32 [path] LXDItime.dll	_RunDLLEntry@16"
U	LXDJCATS	"rundll32 [path] LXDJtime.dll	_RunDLLEntry@16"
X	MainDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Mass storage check registry	"rundll32.exe MSDServ.dll	check registry"
U	MBMon	"Rundll32 CTMBHA.DLL	MBMon"
X	Microsoft (R) Windows DLL Loader	rundll32.exe	"Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process
X	Microsoft Update	rundll32.dll	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update 32	rundll32.exe	"Added by the RBOT.AIE BACKDOOR! Note that this BACKDOOR modifies the file rundll32.exe
N	Microsoft� Windows� Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	Microsoft� Windows� Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
?	MigrationVendorSetupCaller	"rundll32.exe migrate.dll	CallVendorSetupDlls"
X	MMSystem	"rundll32.exe mmsystem.dll	RunDll32"
X	Module Call initialize	"RUNDLL32.EXE reg.dll	ondll_reg"
X	MoreContent	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3Collection	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3files	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3nice	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3Themes	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3ToTheMax	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MsAudio	"MsVM_STI.EXE RunDll32 cmicnfg.cpl	CMICtrlWnd"
X	mscheck	rundll32.exe wincheck071008.dll mymain	"Added by the AGENT.ADXI TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wincheck071008.dll"" file is located in %System%"
X	MSDrive	rundll32.exe drvkoc.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	MSDrive	rundll32.exe drvmod.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	MSDrive	rundll32.exe drvsoh.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	Msn	"rundll32.exe ilss32.dll	network"
X	MSServer	"Rundll32.exe [random].dll	#1"
X	MSxmlHpr	"RUNDLL32.EXE [path] msxm192z.dll	w"
X	MyWebSearch Plugin	"rundll32 [path] M3PLUGIN.DLL	UPF"
X	NAVUpd	"rundll32.exe navupd.dll	Startup"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	NewDotNetStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	NewDotNetStartup"
X	NewDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NewMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NiceDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NiceMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	notepad	"rundll32.exe notepad.dll	_IWMPEvents@0"
X	notepad	"rundll32.exe ntload.dll	_IWMPEvents@0"
X	NT security	rundll32.com	"Added by the RBOT-AJC WORM!"
N	ntlfreedom	"rundll32 [path] RyDial.dll	QuickStart"
X	NumberOneMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	NVCLOCK	"rundll32 nvclock.dll	fnNvclock"
?	NvColorInit	"rundll32.exe NvQtwk.dll	NvColorInit"
U	NvCpl	"RUNDLL32.EXE NvCpl.dll	NvStartup"
U	NvCplDaemon	"RUNDLL32.EXE NvQTwk	NvCplDaemon"
U	NvCplDaemon	"RUNDLL32.EXE NvCpl.dll	NvStartup"
U	NVHotkey	rundll32.exe nvHotkey.dll	"Enables the use of ""hot keys"" for changing setting on Nvidia graphics"
U	NVIDIA Media Center Library	"RunDLL32.exe NvMCTray.dll	NvTaskbarInit"
N	NvidiaQuickTweak	"rundll32.exe NvQtwk.dll	NvTaskbarInit"
U	NVIEW	"rundll32.exe nview.dll	nViewLoadHook"
N	NvInitialize	"rundll32.exe NvQtwk.dll	NvXTInit"
U	NVMCTRAY	"RunDLL32.exe NvMCTray.dll	NvTaskbarInit"
U	NvMediaCenter	"RunDLL32.exe NvMCTray.dll	NvTaskbarInit"
N	NVQuickTweak	"rundll32.exe NvQtwk.dll	NvTaskbarInit"
Y	NvRegisterMCTray	"RUNDLL32.EXE NVMCTRAY.DLL	NvMCRegisterApp NvCpl.dll"
Y	NvRegisterMCTrayNview	"RUNDLL32.EXE NVMCTRAY.DLL	NvMCRegisterApp nView.dll"
U	NvSvc	"RUNDLL32.EXE nvsvc.dll	nvsvcStart"
X	nxgsvc	"rundll32.exe nxgsvc.dll	start"
X	nxosys	"rundll32.exe nxosys.dll	start"
N	OfotoNow USB Detection	"Rundll32.exe OFUSBS.DLL	WatchForConnection OfotoNow"
X	oo4	"RunDLL32.EXE oo4.dll	DllRun"
U	P17Helper	"Rundll32 P17.dll	P17Helper"
?	P17Helper	"Rundll32 SPIRun.dll	RunDLLEntry"
?	P17RunE	"RunDll32 P17RunE.dll	RunDLLEntry"
X	PopularScreensaversWallpaper	"rundll32 [path] F3SCRCTR.DLL	LES"
X	PostSetupCheck	Rundll32.exe atgban.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""atgban.dll"" file is found in %System%"
X	postSetupCheck	Rundll32.exe gzmrt.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""gzmrt.dll"" file is found in %System%"
X	PostSetupCheck	Rundll32.exe cpmsky.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""cpmsky.dll"" file is found in %System%"
X	Protected Storage	RUNDLL32.EXE MSSIGN30.DLL ondll_reg	"Added by the LOVGATE-W WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
?	Ptipbmf	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
U	PtiuPbmd	"Rundll32.exe ptipbm.dll	SetWriteBack"
X	PTRGMYGK	"rundll32.exe ptmg1v.dll	DllRunMain"
U	pwrmonit	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
X	qkoszvd.dll	"rundll32.exe qkoszvd.dll	jwezubg"
X	R	rundll32.exe msprt.dll	"Chinese originated browser hijacker - redirecting to 4199.com Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	readdb40	"rundll32.exe readdb40.dll	EnableRunDLL32"
X	RegistryCheck	"rundll32.exe chkreg.dll	CheckRegistry"
X	Regrx	rundll32.exe	"Added by the WAYIC-A TROJAN! Note - this is not the legitimate rundll32.exe process
X	Remote Procedure Call Locator	RUNDLL32.EXE reg678.dll ondll_reg	"Added by the LOVGATE.F WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	Remote System Protection	"rundll32.exe [random].dll	HUI_proc"
N	RFX_auto_upgrade	rundll32.exe npvpg005.dll	"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
X	Rhg	rundll32.exe	"Added by the LINEAG-BIT TROJAN! Note - this is not the legitimate rundll32.exe process
X	RichMedia	"rundll32.exe [path] hbcast.dll	WaitWindows"
X	RKrx	rundll32.exe	"Added by the LINEAG-ADA TROJAN! Note - this is not the legitimate rundll32.exe process
X	RKrx	rundll32.exe	"Added by a variant of the LINEAG-ADA TROJAN! Note - this is not the legitimate rundll32.exe process
X	rmdrfje.dll	"rundll32.exe rmdrfje.dll	[random characters]"
X	Rr2	rundll32.exe	"Added by the LINEAG-ADI TROJAN! Note - this is not the legitimate rundll32.exe process
X	rro	rundll32.exe	"Added by the LINEAG-AAE TROJAN! Note - this is not the legitimate rundll32.exe process
X	RSS	"rundll32 RSSToolbar.dll	DllRunMain"
X	run	rundll32.exe rsrc.dll	"Chinese originated browser hijacker - redirecting to 4199.com Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	RunDLL	"rundll32.exe [path] Bridge.dll	Load"
X	Rundll	rundll32.exe [random filename].dll	"Added by the MYTOB.IG WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in %System%"
X	Rundll32	Rundll32.exe	"Added by a variant of the DVLDR TROJAN! Note - this is not the legitimate rundll32.exe process
U	RUNDLL32	"RUNDLL32.EXE NvQTwk	NvCplDaemon"
U	RunDLL32	"RunDLL32.exe NvMCTray.dll	NvTaskbarInit"
X	RunDLL32	winupdate.exe	"Added by an unidentified TROJAN! - possibly a BMBOT variant"
X	Rundll32	Windows.exe	"Added by the QQPASS.E TROJAN!"
U	Rundll32	"Rundll32.exe ptipbm.dll	SetWriteBack"
X	rundll32	[path to worm]	"Added by the AUTEX WORM!"
?	rundll32	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
X	rundll32	rundll32.exe	"Added by the SANKER WORM! Note - this is not the legitimate rundll32.exe process
X	rundll32	csrss.exe	"Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	rundll32	"rundll32.exe irprops.cpl
X	RUNDLL32	rundl32.exe	"Added by the DEMOTRY-A WORM!"
X	rundll32	rundll32.exe	"Added by the AGENT-EZ TROJAN! Note - this is not the legitimate rundll32.exe process
X	Rundll32	RUNDDLL32.EXE	Added by the STARTPAGE.AXH TROJAN!
X	rundll32	kernel32.exe	"Added by the STAP-C WORM!"
X	rundll32	kernel33.exe	"Added by the STAP-D WORM!"
X	rundll32	MSDTC.exe	"Added by the STAP-E WORM!"
X	rundll32	rookie.vbs	"Added by the ROOKIE-A TROJAN!"
X	rundll32	rundll64.exe	"Added by the DELF.BKC TROJAN!"
U	rundll32	"rundll32.exe bthprops.cpl
U	rundll32	"rundll32.exe nview.dll	nViewLoadHook"
X	rundll32	svchs0t.exe	"Added by the PWSTEAL-E TROJAN!"
N	Rundll32 cmicnfg	"Rundll32 cmicnfg.cpl	CMICtrlWnd"
Y	RunDll32 essprops	"RunDll32 essprops.cpl	TaskbarIconWnd"
U	Rundll32 P17	"Rundll32 P17.dll	P17Helper"
X	Rundll32.exe	Proyecto1.exe	"Added by the GRUEL WORM!"
X	Rundll32.exe	Root.exe	"Added by the GRUEL WORM!"
X	Rundll32_7	"rundll32.exe MSIEFR40.DLL	DllRunServer"
X	Rundll32_8	"rundll32.exe inetp60.dll	DllRunServer"
X	Rundll32_8	"rundll32.exe 1.dll	DllRunServer"
?	RUSBHOLoader	"rundll32.exe RUSBHOLoader.dll	AutoRegister"
X	rx	rundll32.exe	"Added by the LINEAGE-BP TROJAN! Note - this is not the legitimate rundll32.exe process
X	rzt	rundll32.exe	"Added by the LINEAGE.BDP TROJAN! Note - this is not the legitimate rundll32.exe process
U	Samsung MJC-900 Series Monitor	"RUNDLL32.EXE SMMASHLL.DLL	AutoUpdatePnPValue"
X	saSyncMgr	"rundll32.exe sasync.dll	SyncWait"
X	Savsvc	"rundll32.exe savsvc.dll	start"
U	SbUsb AudCtrl	"RunDll32 sbusbdll.dll	RCMonitor"
X	ScreenSaverPlus	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	SearchMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	SetCacheMode	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
X	ShutDownWindows	"Rundll32.exe User	ExitWindows"
X	si91e44b	"rundll32.exe si91e44b.dll	EnableRunDLL32"
Y	SiSPower	"Rundll32.exe SiSPower.dll	ModeAgent"
X	SOProc_RegSoAlertWxLiteNnAj	"rundll32 shell32.dll	ShellExec_RunDLL [path] soproc.exe"
?	SoundFusion	rundll32 cwcprops.cpl	"Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time?"
?	SoundFusion	"rundll32 hercplgs.cpl	BootEntryPoint"
?	SoundFusion	"RunDll32 cwaprops.cpl	C25CrystalControlWnd"
X	sp	"rundll32 (Path to Trojan DLL)	DllInstall"
X	spa_start	Rundll32.exe spads.dll	"IconAds adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""spads.dll"" file is located in the Winnt or Windows folder"
X	spa_start	Rundll32.exe sprt_ads.dll	"Superiorads adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""sprt_ads.dll"" file is located in %System%"
?	SPIRun	"Rundll32 SPIRun.dll	RunDLLEntry"
X	sre	"rundll32.exe sre.dll	Register"
?	srePostpone	"rundll32.exe [path] srescan.dll	DoSpecialAction"
?	SRFirstRun	"rundll32 srclient.dll	CreateFirstRunRp"
X	Startwd	"rundll32.exe wd081025.dll	Hook"
X	stlbdist	"rundll32exe stlbdist.DLL	DllRunMain"
X	stlbupdt	"rundll32.exe stlbupdt.DLL	DllRunMain"
X	supdate2.dll	"rundll32.exe supdate2.dll	Run"
X	SurfBuddy	rundll32 [path] sbuddy.dll	"SurfBuddy adware - not to be confused with the legitimate SurfBuddy application by SurfApps!. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	SWL	rundll32.exe [path] SWL.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	sys	rundll32.exe	"Added by the LINEAG-G TROJAN! Note - this is not the legitimate rundll32.exe process
X	SysPnP	"rundll32 setupapi	InstallHinfSection [varies] oemsyspnp.inf"
U	System Check	"Rundll32.exe SysDll32.dll	SystemCheck"
X	SystemHelp	"RUNDLL32.EXE SystemHper.dll	Install"
U	SystemKey	rundll32.exe [path] SystemKey.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemMessenger	rundll32.exe [path] SystemMessenger.dll	"Stealth Chat Monitor spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	Systems Restart	"Rundll32.exe beem.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe snim.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe zolk.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe boln.dll	DllRegisterServer"
U	SystemWeb	rundll32.exe [path] SystemWeb.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SysWy	rundll32.exe	"Added by the LINEAGE-JH TROJAN! Note - this is not the legitimate rundll32.exe process
X	TakeMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	TaskMan	Rundll32.exe	"Added by the DVLDR TROJAN! Note - this is not the legitimate rundll32.exe process
N	Tesco.net	"rundll32 [path] RyDial.dll	QuickStart"
X	TheBestMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ThemeMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	transys	"rundll32.exe transys.dll	start"
X	Tray	rundll32.exe	"Added by the LINEAG-ADR TROJAN! Note - this is not the legitimate rundll32.exe process
U	Tweak UI	"rundll32.exe tweakui.cpl	tweakmeup"
U	Tweak UI	"rundll32.exe tweakui.cpl	tweaklogon"
X	Tweak UI	"RunDLL32 tweakUI.DLL	TWEAKUI /tweakmeup"
U	Tweak UI 1.33 deutsch	"RUNDLL32.EXE TWEAKUI.CPL	TweakMeUp"
U	UCmore XP - The Search Accelerator	"rundll32.exe UCMTSAIE.dll	DllShowTB"
X	uhvjsul.dll	"rundll32.exe uhvjsul.dll	mrpmvyf"
?	UPDATEHOOK	Rundll32.exe	"??"
X	utasvc	"rundll32.exe utasvc.dll	start"
X	UtilitiesAndSoftware	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	V128IID	"Rundll32.exe v128iitw.dll	STB_InitTweak"
X	VFW Encoder/Decoder Settings	RUNDLL32.exe MSSIGN30.DLL ondll_reg	"Added by the LOVGATE-W WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	VoodooBanshee	"rundll32.exe 3DBBps.dll	BansheeLoadSettings"
X	W3KNetwork	"rundll32.exe w3knet.dll	dllinitrun"
X	WebSpecials	rundll32 [path] webspec.dll	"WebSpecials spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
N	WIAWizardMenu	"RUNDLL32.EXE sti_ci.dll	WiaCreateWizardMenu"
?	WildTangent CDA	"RUNDLL32.exe cdaEngine0400.dll	cdaEngineMain"
X	Win32 Rundll Loader	Rundll32.exe	"Added by the SDBOT.A TROJAN! Note - this is not to be confused with the legitimate rundll32.exe file!"
X	winabc	"rundll32.exe [Temp][ORIGFILENAME].DLL	InstallLaunchEv"
X	wincls	"rundll32.exe wincls.dll	start"
X	WinDLL (algs.exe)	"rundll32.exe algs.exe	start"
X	WinDLL (asdfsa.exe)	"rundll32.exe asdfsa.exe	start"
X	WinDLL (bee.dll)	"rundll32.exe bee.dll	start"
X	WinDLL (bix.exe)	"rundll32.exe bix.exe	start"
X	WinDLL (csmss.exe)	"rundll32.exe CSMSS.EXE	start"
X	WinDLL (ctfmonm.exe)	"rundll32.exe ctfmonm.exe	start"
X	WinDLL (dasda.com)	"rundll32.exe dasda.com	start"
X	WinDLL (diem.exe)	"rundll32.exe diem.exe	start"
X	WinDLL (dlfksdld.exe)	"rundll32.exe dlfksdld.exe	start"
X	WinDLL (jbi32.dll)	"rundll32.exe jbi32.dll	start"
X	WinDLL (lcass.exe)	"rundll32.exe lcass.exe	start"
X	WinDLL (mysnlive.exe)	"rundll32.exe mysnlive.exe	start"
X	WinDLL (qwex.dll)	"rundll32.exe qwex.dll	start"
X	WinDLL (redyLive.exe)	"rundll32.exe redyLive.exe	start"
X	WinDLL (scvhost32.dll)	"rundll32.exe scvhost32.dll	start"
X	WinDLL (slmss.exe)	"rundll32.exe slmss.exe	start"
X	WinDLL (slsass.exe)	"rundll32.exe slsass.exe	start"
X	WinDLL (smaprnter.exe)	"rundll32.exe smaprnter.exe	start"
X	WinDLL (smms.exe)	"rundll32.exe smms.exe	start"
X	WinDll (sslms.exe)	"rundll32.exe sslms.exe	start"
X	WinDLL (start0s.exe)	"rundll32.exe start0s.exe	start"
X	WinDLL (steam.dll)	"rundll32.exe steam.dll	start"
X	WinDLL (svc.exe)	"rundll32.exe svc.exe	start"
X	WinDLL (svchost.dll)	"rundll32.exe svchost.dll	start"
X	WinDLL (sysx32.dll)	"rundll32.exe sysx32.dll	start"
X	WinDLL (tepmlayer.exe)	"rundll32.exe tepmlayer.exe	start"
X	WinDLL (tmp.exe)	"rundll32.exe tmp.exe	start"
X	WinDLL (tock24.dll)	"rundll32.exe tock24.dll	start"
X	WinDLL (tqurity.exe)	"rundll32.exe tqurity.exe	start"
X	WinDLL (v4mon.dll)	"rundll32.exe v4mon.dll	start"
X	WinDLL (vdm32.dll)	"rundll32.exe vdm32.dll	start"
X	WinDLL (vxd32.dll)	"rundll32.exe vxd32.dll	start"
X	WinDLL (wchshield.exe)	"rundll32.exe wchshield.exe	start"
X	WinDLL (wimimi.exe)	"rundll32.exe wimimi.exe	start"
X	WinDLL (windns32.dll)	"rundll32.exe windns32.dll	start"
X	WinDLL (wingatey32.exe)	"rundll32.exe wingatey32.exe	start"
X	WinDLL (wintmp.exe)	"rundll32.exe wintmp.exe	start"
X	WinDLL (Wseclayer.exe)	"rundll32.exe Wseclayer.exe	start"
X	WinDLL (wsync32.dll)	"rundll32.exe wsync32.dll	start"
X	WinDLL (xvd32.dll)	"rundll32.exe xvd32.dll	start"
X	Windows DLL Loader	rundll32.exe	"Added by the WHIPSER-B WORM! Note - this is not the legitimate rundll32.exe process"
X	Windows Firewall	rundll32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	Windows Media Center	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
X	Windows Security Assistant	rundll32.vbe	"CoolWebSearch Alfasearch parasite variant - also detected as the STARTPA-U TROJAN!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
N	WindowsWelcomeCenter	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
U	Winfast2KLoadDefault	"rundll32.exe wf2kcpl.dll	DllLoadDefaultSettings"
U	WinFast_Gamma	"Rundll32.exe wfcpl.dll	DllLoadGammaRampSettings"
U	WinFast_Taskbar	"rundll32.exe wftask.dll	WFDllLoadDefaultSettings"
N	WinHacker	"rundll32.exe wh95.dll	HackMe"
X	winupd	"RUNDLL32.EXE [random value].dll	_mainRD"
X	winupdt	RUNDLL32.EXE [random.dll]	"Added by the MABUT.A WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in the Windows or Winnt folder"
U	WinXPLoad	"Rundll32 LoadDll	LoadExe WinXPLoad.exe"
X	wm41a398	"rundll32.exe wm41a398.dll	EnableRunDLL32"
X	wmcbaaca	"rundll32.exe wmcbaaca.dll	EnableRunDLL32"
X	wrclib	"rundll32.exe wrclib.dll	start"
X	wtzlank.dll	"rundll32.exe wtzlank.dll	qttwuwc"
X	wupipenimi	"Rundll32.exe jinorije.dll	s"
X	wupipenimi	"Rundll32.exe luyenofe.dll	s"
X	wupipenimi	"Rundll32.exe poyimimu.dll	s"
X	wupipenimi	"Rundll32.exe siremase.dll	s"
X	wupipenimi	"Rundll32.exe tamuyiko.dll	s"
?	xkstartup	"RunDll32 InstZ82.dll	SetUsbPrinterPort"
X	yahoo!	"rundll32.exe [random]don.dll	Set"
X	YourMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Zenet	"rundll32 CNBabe.dll	DllStartup"
X	zsmscc	rundll32.exe zsmscc071001.dll mymain	"Added by the GENETIK.KQ TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""zsmscc071001.dll"" file is found in %System%"
X	zsmscc	rundll32.exe mycc071208.dll mymain	"Added by the AGENT.FZK TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""mycc071208.dll"" file is found in %System%"
X	zt	rundll32.exe	"Added by the LINEAG-ABA TROJAN! Note - this is not the legitimate rundll32.exe process
X	[random number]	"rundll32.exe shell32.dll	Control_RunDLL [random number].cpl"
X	_rx	rundll32.exe	"Added by the LINEAG-B TROJAN!! Note - this is not the legitimate rundll32.exe process
X	{12EE7A5E-0674-42f9-A76B-000000004D00}	"rundll32.exe stlb2.dll	DllRunMain"
X	{2CF0B992-5EEB-4143-99C0-5297EF71F444}	"rundll32.exe stlbdist.dll	DllRunMain"
X	{2CF0B992-5EEB-4143-99C2-5297EF71F44B}	"rundll32.exe stlbupdt.DLL	DllRunMain"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.