New
#1
Where should you see runDLL32.exe, and how many copies?
Hi everyone. Quick question for you all. Sorry if it's so quick as to be stupid! I'm running Win 7 x64 Professional for this inquiry:
rundll32.exe is a common MicroSoft Windows file that most of us have seen before. Also, it's a commonly impersonated file when it comes to nasties and malware!
Today I saw a process being scanned by NOD that wasn't open or active in either Process Explorer or WinPatrol 2010 - It was C:\Windows\sysWOW64\RunDLL32.exe
Is this a normal location for a rundll32 instance? Why would a 32-bit program be in the sysWOW64 directory? Particularly when there's another copy of it in the system32 directory?
NOD, MBAM, and VirusTotal all come back with negative results, but I'm not sure why this file is where it is.