0

I have two run32dll.exe processes, one in System32 and another in SysWOW64. Is one of them a virus or is it normal? Sometimes only one is there (SysWOW64) and this one uses 60-90 Mbs Of memory.

Plus, I was alone at home with all the devices wi-fi turned off but my online gaming experience was laggy. I went to resource monitor an all the other processes (except run32dll) were using 20-30% of the network while the rest was used by run32dll (70%).

1
  • 2
    You can always upload a file to VirusTotal to get it checked.
    – gowenfawr
    Jun 25, 2015 at 1:46

3 Answers 3

1

Rundll32 is just a host process that loads a DLL and calls a function in that DLL. The 'interesting' part is not the exe itself (which is part of Windows), but instead the dll it has loaded and what that dll does.

Sysinternals process explorer is your best bet on finding out what this particular instance has loaded; is it running some standard windows process/service, or is it hosting malware? The command line arguments it was started with will tell; first argument is the dll it loads, second is the entry point, followed by parameters passed to it.

As someone else mentioned: fiddler, wireshark, MS network monitor, etc may be useful in tracking down why it is using a lot of network bandwidth, and who it is communicating with. The "who" part can also be revealed with a simple "netstat -oa".

Finally, yes, on a 64-bit system you will have two copies of rundll32: a 64-bit version in system32, and a 32-bit version in syswow64.

0

First of all, run32dll.exe is used normally by Windows. For instance, if you open up Display Properties on XP you’ll see new rundll32.exe in the process list, because Windows internally uses rundll32 to run that dialog. The valid process is normally located at \Windows\System32\rundll32.exe, but sometimes spyware uses the same filename and runs from a different directory in order to disguise itself. If you think you have a problem, you should always run a scan to be sure, but we can verify exactly what is going on. Use Task Manager to see full path of the running file. If it is something different than \Windows\System32\rundll32.exe, then you might have a spyware problem. If you have two processes, one of which is in System32, and the other one is in SysWOW64, then this is perfectly normal. Obviously, there is a possibility that run32dll.exe itself is infected. Unfortunately, it is not possible to answer this question - you should run a virus scan.

3
  • thanks for the info about it being normal the scans were good and clean, but what about the internet usage ?
    – Kemo III
    Jun 24, 2015 at 21:44
  • Concerning bandwidth usage, you need to use some network monitor to see TCP connections that each application uses. The easies one is to use Performance Monitor (tab "Performance" in Windows Task Manager. There you can see to which hosts your application connect. Look through it, try to find some unusual hosts.
    – Acetylator
    Jun 24, 2015 at 21:47
  • run32dll is the most of using internet,all other processes i know except for svchost.exe and smoetimes there are 2 run32dlls again one using more internet than the other
    – Kemo III
    Jun 24, 2015 at 22:01
0

Generally no but there are scenarios where the process could be serving malicious code.

This site gives some scenarios where the process might be suspicious:

http://www.file.net/process/rundll32.exe.html

For troubleshooting the process you can try Microsoft's Process explorer https://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Since you wrote that 70% of network traffic is coming from the process, you can use the following tools to help troubleshoot what type of traffic is being sent within your network and outside:

  1. Fiddler is used for troubleshooting websites but is easy to use and see what is being sent in and out of your network: http://www.telerik.com/fiddler.

  2. Wireshark is a more advanced tool but you can see what is happening on your LAN as well as WAN https://www.wireshark.org

While monitoring your network traffic using one of the tools above, try terminating (don't disable) the process and see what happens.

1
  • The poster wrote that the process is using 70% of the network so it seems that something is happening over the network. I suggested Wireshark and Fiddler as tools to help troubleshoot and verify what is happening in the LAN as well as WAN.
    – VirtualJJ
    Jun 24, 2015 at 22:31

You must log in to answer this question.