up vote 3 down vote favorite
share [g+] share [fb]

The following process seems to be running all the time:

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding

Anyone know what it is?

Scanned with MalwareBytes and Kaspersky Internet Security 2011

Using Windows 7 Ultimate 64 bits.

link|improve this question
91% accept rate
1  
rundll32.exe is a standard Windows/MS program to initialize a DLL. shell32.dll is a standard Windows/MS extension. The interesting part is the SHCreateLocalServerRunDll. Google doesn't shed any light on that. Does Registry Editor find anything in your registry for the hex argument at the end? – Nathan G. Jan 3 '11 at 0:17
@Nathan did not find anything of interest when looking for "995C996E-D918-4a8c-A302-45719A6F4EA7" – BloodPhilia Jan 3 '11 at 0:43
Why are you suspicious of this legit Windows system file? – Moab Jan 3 '11 at 1:26
@Moab because I can't seem to find the source of why this is running... I've never had this process before and I haven't installed anything in the meantime. – BloodPhilia Jan 3 '11 at 1:50
2  
Try Process Explorer, a powerful tool if you know how to use it..technet.microsoft.com/en-us/sysinternals/bb896653 – Moab Jan 3 '11 at 2:09
show 5 more comments
feedback

1 Answer

up vote 5 down vote accepted

It is a Microsoft Windows DistributedCOM server. It is safe as far as I can tell. I have seen it on other systems that were couple of weeks old and didn't get chance to get infected :).

link|improve this answer
+1 I couldn't find that anywhere. – digitxp Jan 3 '11 at 0:43
@digitxp - According to Wiki it's a long deprecated technology, why would this still be on my Win7 64 bits computer? – BloodPhilia Jan 3 '11 at 0:48
I guess backwards compatibility with .net frameworks – Mat Banik Jan 3 '11 at 0:53
1  
Microsoft always uses long deprecated technology! You must be a Linux/Unix user. – Moab Jan 3 '11 at 1:16
@Moab Well mainly yes xD Is it that obvious huh? – BloodPhilia Jan 3 '11 at 1:51
show 11 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.