Where should you see runDLL32.exe, and how many copies?


  1. Posts : 76
    Windows 7 RTM
       #1

    Where should you see runDLL32.exe, and how many copies?


    Hi everyone. Quick question for you all. Sorry if it's so quick as to be stupid! I'm running Win 7 x64 Professional for this inquiry:

    rundll32.exe is a common MicroSoft Windows file that most of us have seen before. Also, it's a commonly impersonated file when it comes to nasties and malware!

    Today I saw a process being scanned by NOD that wasn't open or active in either Process Explorer or WinPatrol 2010 - It was C:\Windows\sysWOW64\RunDLL32.exe

    Is this a normal location for a rundll32 instance? Why would a 32-bit program be in the sysWOW64 directory? Particularly when there's another copy of it in the system32 directory?

    NOD, MBAM, and VirusTotal all come back with negative results, but I'm not sure why this file is where it is.
      My Computer


  2. Posts : 8,476
    Windows® 8 Pro (64-bit)
       #2

    Carbonyl said:
    NOD, MBAM, and VirusTotal all come back with negative results, but I'm not sure why this file is where it is.
    3 things cannot go wrong. Let either NOD32 or MBAM remove it.
      My Computer


  3. Posts : 76
    Windows 7 RTM
    Thread Starter
       #3

    Dinesh said:
    Carbonyl said:
    NOD, MBAM, and VirusTotal all come back with negative results, but I'm not sure why this file is where it is.
    3 things cannot go wrong. Let either NOD32 or MBAM remove it.
    ???

    When I say all three came back with negative results, I mean all three said the file was clean. Should I still delete it?
      My Computer


  4. Posts : 8,476
    Windows® 8 Pro (64-bit)
       #4

    Carbonyl said:
    Dinesh said:
    Carbonyl said:
    NOD, MBAM, and VirusTotal all come back with negative results, but I'm not sure why this file is where it is.
    3 things cannot go wrong. Let either NOD32 or MBAM remove it.
    ???

    When I say all three came back with negative results, I mean all three said the file was clean. Should I still delete it?
    No.
      My Computer


  5. Posts : 4,925
    Windows 7 Professional 64-bit
       #5

    In task manager click on view menu then select columns. Now tick command line and youl be able to see exactly what run32dll.exe is calling.
      My Computer


  6. Posts : 9,582
    Windows 8.1 Pro RTM x64
       #6

    That is perfectly normal. There are 2 copies of rundll32.exe on 64-bit systems. One copy is in the System32 folder and the other is located in the SysWOW64 folder.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 03:36.
Find Us