SystemLookup - Startup List

List Information

Started by: Paul Collins

Maintained by: random/random, nasdaq, Vino Rosso

Startup List

The Startup List catalogues startup applications - not running processes.
For information on the difference, please see here.

These are entries for programs that can start automatically with your computer.

Status Key:
Y = Normally leave to run at start-up
N = Not required - often infrequently used tasks that can be started manually, if necessary
U = User's choice - depends whether a user deems it necessary
X = Malware, spyware, adware, or other potentially unwanted items
? = Currently unknown status

Filename

Name

Searching: Over 29,152 items

Search Results
(displaying 250 results)

Name	Filename	Description	Status
MMSystem	"%\Windows%\rundll32.exe "%System%\mmsystem.dll"", RunDll32"	Added by a FUNNER.A worm infection	X
cesmain.dll	Rundll32.exe [path] cmail.dll, Rundll32	CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted	X
BIE	Rundll32.exe BDSrHook.dll, Rundll32	BDplugin parasite	X
CnsMin	Rundll32.exe CNSMIN.DLL, Rundll32	CnsMin (Chinese_Keywords) related	X
AxFilter	Rundll32 AXFILTER.DLL, Rundll32	CnsMin (Chinese_Keywords) related	X
Image	rundll32 (path) image.dll, Install, rundll32 (path)sdkqh32.dll,Install	CoolWebSearch parasite related	X
rx	rundll32.exe	Added by the Troj/Lineage-BP TROJAN! Note: This is not the legitimate Windows process (Which is found in the Windows folder for (95\98\ME) and the System32 folder for Nt\2000\XP) This trojan file is found in the Windows or Winnt folder.	X
load	rundll32.exe	Added by the PWSteal.Wowcraft TROJAN!	X
Ljx	rundll32.exe	Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\inf (Win9x/Me), C:\%WINDIR%\inf (XP/WinNT/2K)	X
Windows DLL Loader	rundll32.exe	Added by the W32/WHIPSER-B WORM! - NOTE: This particular rundll32.exe file is placed in the Windows\System folder, wheras the legitimate Windows file of the same name is located in the Windows folder on Win 98 or ME systems, and in Winnt\System32 or Windows\System32 in Windows 2000 or XP	X
Windows Firewall	rundll32.exe	Added by a variant of the IRCBOT Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.	X
Windows Security Assistant	rundll32.vbe	CoolWebSearch parasite related.	X
Tray	rundll32.exe	Troj/Lineag-ADR Note: Located in %windir%\command	X
rundll32	rundll32.exe	Added by the Troj/RedNeck-AC TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\ folder. Note: Information stealing Trojan	X
rundll32	rundll32.exe	Added by the Troj/Agent-EZ keylogging TROJAN! Note: This trojan file is found in the System\SHELLEXT (95/98/ME) or System32\SHELLEXT (NT/2000/XP) folder. Do not confuse this with the real rundll32.exe which resides in the System (95/98/ME) or System32 (NT/2000/XP) folder.	X
Mr	rundll32.exe	Added by a variant of the RBOT family of IRC Backdoor trojan. Note: Located in \%WINDIR%\ Note: Use SDFix under supervision.	X
rundll32	rundll32.exe	Added by the SANKER VIRUS! Note that the valid "rundll32.exe" resides in C:\Windows\System32 wheras this version resides in C:\Windows	X
rzt	rundll32.exe	Added by the TSPY_LINEAGE.BDP Note: This worm\trojan is located in C:\Windows\Intel (Win9x/Me), C:\%WINDIR%\Intel (XP/WinNT/2K)	X
TaskMan	rundll32.exe	Added by the DVLDR VIRUS! Note - this is not the valid "rundll32.exe" as it's in the Windows\Fonts directory	X
Rundll32	Rundll32.exe	Added by the DVLDR VIRUS! Note - this is not the valid "Rundll32.exe" as it's in the Windows\Fonts directory	X
SysWy	rundll32.exe	Added by the TROJ/LINEAGE-JH TROJAN! - NOTE: this file is found in the C:\Windows\System folder, and is not to be confused with the legitimate rundll32.exe file, always located in the Windows folder on Win 98 and ME systems, and in the Winnt\System32 or Windows\System32 folder in Windows XP and NT!	X
Rr2	rundll32.exe	Troj/Lineag-ADI Note: Located in %windir%\addins	X
Regrx	rundll32.exe	Added by the TROJ/WAYIC-A TROJAN! - NOTE: this file is found in the C:\Windows folder, and is not to be confused with the legitimate rundll32.exe file, always located in the Windows folder on Win 98 and ME systems, and in the Winnt\System32 or Windows\System32 folder in Windows XP and NT!	X
LTT2	rundll32.exe	Added by the Troj/Lineage-BI TROJAN!	X
Adobe32 ARM	rundll32.exe	Added by the Trojan.Win32.Swisyn.asnu Note: Located in \%Windir%\Adobe32 ARM\ Note: Do not remove the legitimate (rundll32.exe) file which is always found in \%Windir%\%System%\	X
cfe	rundll32.exe	Added by the Generic.bfr!68F42B274A0B TROJAN! Note: Located in \%AppData%\Roaming\NUMBERS\ Note: Do not remove the legitimate (rundll32.exe) file which is always found in \%Windir%\%System%\	X
rundll32	rundll32.exe	Added by the Advanced Security Tool 2010 Note: Located in \%UserProfile%\ Note: This infection should not be confused with the legitimate C:\Windows\System32\rundll32.exe file.	X
Microsoft Update checker	rundll32.exe	Added by the Instant Messenger worm Note: Located in \%WINDIR%\ Note: Do not remove the legitimate rundll32.exe file which is always found in \%WINDIR%\%System%\	X
UPDATEHOOK	Rundll32.exe	Note: ??	?
Microsoft ® Windows DLL Loader	rundll32.exe	Added by an unidentified TROJAN! of the Sdbot family. Note: This is not the legitimate Windows Process. (Which is found in the c:\Windows or C:\Windows\System32 folder.) This worm\trojan file is found in the C:\%WINDIR%\dll\ folder.	X
Microsoft Update	rundll32.dll	Added by a variant of the IRCBOT Note: Located in \%WINDIR%\System32\ Note: Use SDFix under supervision.	X
Win32 Rundll Loader	Rundll32.exe	Added by the SDBOT.A WORM! Note: Rundll32.exe is a valid Windows application called "Run a DLL as an App" and stored in the C:\Windows directory. The version created by this virus is saved in the C:\Windows\System directory	X
LoadPowerProfile	Rundll32.exe	Added by the MIROOT VIRUS! Note - do not confuse with the valid LoadPowerProfile entry which has "powrprof.dll" appended to the command/data line	X
NT security	rundll32.com	Added by the W32/Rbot-AJC WORM!	X
Background Intelligent Transfer Service	rundll32.exe	Added by the TROJ/VB-ZD TROJAN! - Note: this file is located in the C:\Windows\help folder, and is not to be confused with the legitimate rundll32.exe file!	X
BatInfEx	rundll32.exe	Displays battery status information on an IBM Thinkpad	U
loadMefs	rundll32.exe	Added by the Troj/LegMir-JB TROJAN! Note: This is not the legitimate Windows Process rundll32.exe, Which is found in the Windows folder(98\ME) or the System32 folder(NT\2000\XP). This trojan file is found in the Windows\inf or Winnt\inf folder.	X
loadMefs	rundll32.exe	Added by the TROJ/LEGMIR-JA TROJAN! - NOTE: this file is found in the C:\Windows\help folder, and is not to be confused with the legitimate rundll32.exe file, always located in the Windows folder on Win 98 and ME systems, and in the Winnt\System32 or Windows\System32 folder in Windows XP and NT!	X
loadMecq3	rundll32.exe	Added by the Troj/LegMir-AS TROJAN!	X
BIH	rundll32.exe bih.dll	Related to Notebook Battery Info Note: Located in \%WINDIR%\system32\	U
MSDrive	rundll32.exe drvkoc.dll	Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "drvkoc.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
ctfmon32.exe	rundll32.exe, 2fofh.dat	Added by ane unidentified malware. Note: Located in \%Program Files%\ Note: Do not remove the legitimate rundll32.exe file which is always found in \%Windir%\%System%\	X
Pwrmonit	Rundll32 PwrMonit.dll	IBM's proprietary 'battery maximiser' and power monitoring software for laptops	Y
gvagfxj	rundll32 ...gvagfxj.dll	Unidentified adware, spyware or virus	X
SWL	rundll32.exe [path] SWL.dll rdl	Added by the Stealth.Weblog surveillance software. Uninstall this software unless you put it there yourself.	U
P17Helper	Rundll32 P17.dll,P17Helper	ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality	Y
Module Call initialize	RUNDLL32.EXE reg.dll, ondll_reg	Added by a variant of the LOVGATE WORM!	X
oo4	RunDLL32.EXE oo4.dll, DllRun	BookedSpace Parasite	X
IKL	rundll32.exe [path] IKL.dll	IKL surveillance software - uninstall unless you put it there yourself!	U
BookedSpace	RunDLL32.EXE bs2.dll, DllRun	BookedSpace parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "bs2.dll" file is located in the Winnt or Windows folder	X
winupdt	RUNDLL32.EXE [random.dll]	Added by the Mabutu.a WORM!	X
NvCplDaemon	rundll32.exe NvCpl.dll	Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card	U
LoadPowerProfile	Rundll32.exe powrprof.dll	Power management specifics such as monitor shut-off, system standby, etc. Associated with power management and is listed twice - see here. Loads your selected power scheme. May not be required - depends upon whether you modify the default Control Panel -> Power Options settings	U
NvCpl	rundll32.exe NvCpl.dll	Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card	U
Tencent QQ	Rund1132.exe qq.dll, Rundll32	Added as the result of the QQPASS.F VIRUS!	X
helperdll	Pupw.sys,Rundll32	Identified by Symantec as Adware.Henbang Note: Located in \%System%\drivers\ Note: This entry is loaded through one of the "Policies" startup keys.	X
Rundll32 P17	Rundll32 P17.dll, P17Helper	ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality	?
Rundll32_8	rundll32.exe C:\1.dll,DllRunServer	BrowserAid/BrowserPal Foistware	X
InternetLogger	rundll32 InternetLogger.dll	Related to Sofix Internet Logger "enables you to save both incoming and outgoing Internet traffic" Note: Location to be advised	U
WinDLL (svc.exe)	rundll32.exe svc.exe, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "svc.exe" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
sysesentDirect	rundll32.exe sysesentDirect.dll	Identified as a trojan downloader - see here Note: Located in %AppData%\sysesentDirect	X
(Default)	rundll32.exe svchost.dll	Identified by Kaspersky as Worm.Win32.AutoRun.gde. Information at Threat Expert Note: Located in %Programfiles%\Tecent	X
Prnkbd	rundll32.exe widtray.dat	Identified by Microsoft as Trojan:Win32/Riern.B. Information at Threat Expert Note: Located in %AppData%\Adobe\Update	X
SoundFusion	rundll32 cwcprops.cpl	Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Note: Does it need to run at start-up every time?	N
Spooler de Impressão	rundll32.exe winsys.dll	Banker trojan of Brazilian origin. Note: Located in %Windir%\ocxlist	X
Spooler de Impressão	rundll32.exe windll.dll	Banker trojan of Brazilian origin. Note: Located in %Windir%\netaps	X
cesmain.dll	cmail.dll, Rundll32	CnsMin (Chinese_Keywords) related	X
Internet	rundll32.exe networkmap.dll	Identified by Kaspersky as Trojan-Downloader.Win32.Delf.wyz. Information at Threat Expert Note: Located in %UserProfile%	X
Bridge	rundll32.exe ...Bridge.dll	Flingstone.com browser hijacker	X
WinDLL (bee.dll)	rundll32.exe bee.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "bee.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
Wallpaper	rundll32.exe undersystem.dll	Identified by Kaspersky as Trojan.Win32.Delf.vjr. Information at Threat Expert Note: Located in %UserProfile%	X
Dialer	rundll32.exe msa32chk.dll	Unidentfied malware	X
sre	rundll32.exe sre.dll,Register	CoolWebSearch parasite related, also detected by Kaspersky antivirus as Trojan.Downloader.Agent.Fc	X
ASK	rundll32.exe [path] ASK.dll rdl	Added by the StealthKeylog surveillance software. Uninstall this software unless you put it there yourself. Note: Read the link, keylogger/password stealing trojan(s) involved.	X
bxsx5	RunDLL32.EXE bsx5.dll	BookedSpace Parasite	X
Internet	rundll32.exe renewnetwork.dll	Identified by Kaspersky as Trojan.Win32.Delf.wkb. Information at Threat Expert Note: Located in %UserProfile%	X
drvupd	rundll32 ..drvupd.inf	Hijacker - drvupd.inf file installs a "searchforge.com" hijack	X
RFX_auto_upgrade	rundll32.exe npvpg005.dll	A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade	N
_nltide_3	rundll32 advpack.dll	Related to Dino Nuhagic With nLite you will be able to have Windows installation which on install does not include, or even contain on media, the unwanted components.	U
NvCpl	NvCpl64.dll, RunDll32.exe	Added by the Worm:Win32/Metibh.A WORM! Note: Located in \%Windir%\%System%\	X
Bsx3	Rundll32.exe bs3.dll, DllRun	BookedSpace Parasite	X
Tweak UI	rundll32.exe tweakui.cpl, tweakmeup	Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed	U
Rundll32_8	rundll32.exe inetp60.dll, DllRunServer	BrowserAid/BrowserPal Foistware	X
Tweak UI	rundll32.exe tweakui.cpl, tweaklogon	Automatically logs you on if you have Microsoft's Tweak UI "powertoy" installed	U
Tweak UI 1.33 deutsch	RUNDLL32.EXE TWEAKUI.CPL, TweakMeUp	Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed - German version	U
UCmore XP - The Search Accelerator	rundll32.exe UCMTSAIE.dll, DllShowTB	UCmore toolbar - search accelerator	U
supdate2.dll	rundll32.exe [path] supdate2.dll	Added by the ZLOB-VL TROJAN!	X
sp	rundll32 [path] se.dll,DllInstall	Added by the StartPage.M TROJAN, CoolWebSearch parasite related.	X
SurfBuddy	rundll32 [path] sbuddy.dll	SurfBuddy adware - not to be confused with the legitimate SurfBuddy application by SurfApps!	X
stlbupdt	rundll32.exe stlbupdt.DLL, DllRunMain	BrowserAid/BrowserPal Foistware	X
SRFirstRun	rundll32 srclient.dll,CreateFirstRunRp	Created by execution of the Windows XP sr.inf file, which installs the Windows XP System Restore feature, needed for example when installing System Restore into Windows Server 2003. - Note: does this indeed need to run at every bootup?	?
System Check	Rundll32.exe SysDll32.dll, SystemCheck	XPCSpy Pro keylogger, surveillance and monitoring software	U
System Check	Rundll32.exe SysDll32.dll,SystemCheck	Added by XpcSpy SPYWARE!	X
SystemKey	rundll32.exe [path] SystemKey.dll rdl	Added by the StealthKeylog surveillance software. Uninstall this software unless you put it there yourself.	U
Systems Restart	Rundll32.exe beem.dll, DllRegisterServer	Added by the Best_Search browser hijacker!	X
Systems Restart	Rundll32.exe snim.dll,DllRegisterServer	Added by the Startpage.I browser hijacker	X
RunDLL32	RunDLL32.exe NvMCTray.dll, NvTaskbarInit	System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties	N
SoundFusion	RunDll32 cwaprops.cpl,CrystalControlWnd	[Control panel item for a Terratec soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Note: Does it need to run at start-up every time?	N
SoundFusion	rundll32 hercplgs.cpl, BootEntryPoint	Control panel item for Hercules Fortissimo soundcards (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Note: Does it need to run at start-up every time?	N
Systems Restart	Rundll32.exe boln.dll,DllRegisterServer	Added by the StartPage.J TROJAN!	X
Systems Restart	Rundll32.exe zolk.dll, DllRegisterServer	Added by a variant of the StartPage.J TROJAN!	X
TakeMP3	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
SbUsb AudCtrl	RunDll32 sbusbdll.dll,RCMonitor	Control for Soundblaster MP3 external (USB) sound card	U
saSyncMgr	rundll32.exe sasync.dll, SyncWait	Browser hijacker - redirecting to Searchant.com	X
RUSBHOLoader	rundll32.exe RUSBHOLoader.dll, AutoRegister	Note: ??	?
WinDLL (qwex.dll)	rundll32.exe qwex.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "qwex.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
NvCpl	rundll32.exe NvCpl.dll, NvStartup	Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card	U
P17Helper	Rundll32 SPIRun.dll, RunDLLEntry	Related to Creative Technology Inc. Soundblaster Audigy driver. Note: Located in \%WINDIR%\%System%\	Y
Rundll	rundll32.exe [random filename].dll	Added by the MYTOB.IG WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
Rundll32	Rundll32.exe ptipbm.dll, SetWriteBack	Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. Tells the drivers that the connected Drives should use the "Write Back" Caching. You can disable this if you don't want to use "Write Back" Caching or if you have not connected any driver to your Promise Controller	U
rundll32	rundll32.exe ptipbmf.dll, SetWriteCacheMode	Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. Note: May be necessary in order to maintain preferences applied to the RAID array connected to the Promise controller	?
ScreenSaverPlus	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
SystemWeb	rundll32.exe [path] SystemWeb.dll rdl	StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted	X
TheBestMP3	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
WinDLL (ctfmonm.exe)	rundll32.exe ctfmonm.exe, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "ctfmonm.exe" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (diem.exe)	rundll32.exe diem.exe, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "diem.exe" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (jbi32.dll)	rundll32.exe jbi32.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "jbi32.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (lcass.exe)	rundll32.exe lcass.exe, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "lcass.exe" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
NiceMP3	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
WinDLL (redyLive.exe)	rundll32.exe redyLive.exe, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "redyLive.exe" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (steam.dll)	rundll32.exe steam.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "steam.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (svchost.dll)	rundll32.exe svchost.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "svchost.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (sysx32.dll)	rundll32.exe sysx32.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "sysx32.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (tepmlayer.exe)	rundll32.exe tepmlayer.exe, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "tepmlayer.exe" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (tock24.dll)	rundll32.exe tock24.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "tock24.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (v4mon.dll)	rundll32.exe v4mon.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "v4mon.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (vdm32.dll)	rundll32.exe vdm32.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "vdm32.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (wimimi.exe)	rundll32.exe wimimi.exe, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "wimimi.exe" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
WinDLL (wsync32.dll)	rundll32.exe wsync32.dll, start	Added by a variant of the IRCBOT TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "wsync32.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
YourMP3	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
xkstartup	RunDll32 InstZ82.dll, SetUsbPrinterPort	On a system with a Lexmark printer	?
VoodooBanshee	rundll32.exe 3DBBps.dll, BansheeLoadSettings	Loads the configuration settings for a 3dfx Voodoo Banshee chipset based graphics card. If you change some of the settings from default you probably need this - otherwise maybe not	U
W3KNetwork	rundll32.exe w3knet.dll, dllinitrun	Advertising spyware. Check here for more info on this particular one	X
WebSpecials	rundll32 [path] webspec.dll	WebSpecials adware downloader	X
WIAWizardMenu	RUNDLL32.EXE sti_ci.dll, WiaCreateWizardMenu	Still Image Class Installer - installed with a webcam	N
WildTangent CDA	RUNDLL32.exe cdaEngine0400.dll",cdaEngineMain	WildTangent on-line games related; not required for the games to work.	N
WinDLL (csmss.exe)	rundll32.exe [path] CSMSS.EXE	Added by the AKBOT.U WORM!	X
Winfast2KLoadDefault	Rundll32.exe Wf2kcpl.dll, DllLoadDefaultSettings	Loads default settings for Leadtek Winfast graphics cards	U
WinFast_Gamma	Rundll32.exe wfcpl.dll, DllLoadGammaRampSettings	Loads if you change the gamma settings on Leadtek WinFast graphics cards	U
WinFast_Taskbar	rundll32.exe wftask.dll,WFDllLoadDefaultSettings	Leadtek WinFast graphics cards related taskbar; can be launched manually.	U
WinHacker	rundll32.exe wh95.dll, HackMe	Tweaking utility by Wedge Software. There are far better tweakers and, unlike WinHacker, most are free	N
winupd	RUNDLL32.EXE (random value).dll,_mainRD	Added by the MOTA.A VIRUS!	X
V128IID	Rundll32.exe v128iitw.dll, STB_InitTweak	Loads drivers for some STB graphics cards such as the STB nVIDIA TNT 16MB. Required if you don't want to experience lock-ups or error messages	Y
Zenet	rundll32 CNBabe.dll, DllStartup	CommonName Toolbar spyware. To uninstall see here	X
autoupdate	rundll32 DATADX.DLL, SHStart	Added by a variant of the QOOLOGIC TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "DATADX.DLL" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
autoupdate	rundll32 SUPDATE.DLL, SHStart	Added by a variant of the QOOLOGIC TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "SUPDATE.DLL" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
bxsx5	RunDLL32.EXE bsx5.dll, DllRun	BookedSpace parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "bsx5.dll" file is located in the Winnt or Windows folder	X
DownloadMP3	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
GetMP3	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
MigrationVendorSetupCaller	rundll32.exe migrate.dll, CallVendorSetupDlls	Note: ??	?
MoreContent	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
MP3Collection	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
MP3freeDownload	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder	X
mscheck	rundll32.exe wincheck071008.dll mymain	Detected by Trend Micro as the AGENT.ADXH TROJAN! See here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "wincheck071008.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder	X
Instant Access	rundll32.exe EGDACCESS_****.dll, InstantAccess	Electronic_Group/InstantAccess premium rate adult content dialer variant	X
dabrun	rundll32.exe [path] dabapi.dll	"SinaUpdateCenter" - adware of Chinese origin hailing from fhmedia.cn	X
DeadAIM	rundll32.exe DeadAIM.ocm, ExportedCheckODLs	DeadAIM - feature enhancing product for AOL's Instant Messenger program	N
DesktopUpdate	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
DownloadLegalMusic	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
drkly16j	rundll32.exe drkly16j.dll,ServiceCheck	KidsWatch_Time_Control parental control software	U
ForceShow	rundll32.exe QaBar.dll, ForceShowBar	AdultLinks.QBar Parasite related	X
FreeMP3download	rundll32.exe MSA64CHK.DLL, DllMostrar	MatrixDialer related	X
ftutil2	rundll32.exe ftutil2.dll, SetWriteCacheMode	Related to Promise Technology's FastTrak SX4030_4060 DS.pdf Controller.	U
GetTheMusic	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
gfxtray	rundll32 ctccw32.dll, findwnd	Added by the IRCBot-CTCC/GFX.Process TROJAN! Note: Located in \%WINDIR%\System32\. Note: NoteDo not delele the Note: Located in \%WINDIR%\System32\rundll32.exe as it is a legitimate file.	X
ICSDCLT	rundll32.exe Icsdclt.dll, ICSClient	Internet Connection Sharing allows more than one computer to simultaneously access the internet with a single connection. Also required when networking two machines	U
CrazyTalk Serve	rundll32.exe CrazyTalk.dll, DIIServeMediaFile	CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS	N
Instant Access	rundll32.exe p2esocks_****.dll, InstantAccess	Electronic_Group/InstantAccess premium rate adult content dialer variant	X
Instant Access	rundll32.exe EGCOMSERVICE_****.dll, InstantAccess	Electronic_Group/InstantAccess premium rate adult content dialer variant	X
Instant Access	rundll32.exe EGDHTML_****.dll, InstantAccess	Electronic_Group/InstantAccess premium rate adult content dialer variant	X
Instant Access	rundll32.exe eg_auth_****.dll, InstantAccess	Electronic_Group/InstantAccess premium rate adult content dialer variant	X
Instant Access	rundll32.exe EGCOMLIB_****.dll, InstantAccess	Electronic_Group/InstantAccess premium rate adult content dialer variant	X
iSecurity applet	rundll32.exe iSecurity.cpl, SecurityMonitor	Added by a variant of the IRCBOT Note: Located in \%WINDIR%\System32\ Note: Use SDFix under supervision.	X
KB926239	rundll32.exe apphelp.dll,ShimFlushCache	Related to Microsoft_KB926239 fix. Windows Media Player 10 may close unexpectedly on a Windows XP-based computer	Y
kernctl32	rundll32 kctl32.dll,initialize	Added by a Trojan.Proxy.Agent.AT infection	X
lhttseng	rundll32.exe ..lhttseng.inf, RemoveCabinet	Left over after installation of the British English version of the Lernout & Hauspie Text To Speech (TTS) Engine	N
LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	Ulubione adult content dialer	X
BlueToothAuthentication Agent	rundll32.exe irprops.cpl,,BluetoothAuthenticatio nAgent	Associated with BlueTooth software, designed to allow bluetooth mobile devices to authenticate to the computer, when connecting a PDA to your computer - necessary for the computer and the PDA to communicate. Should you get the error message, "Rundll irprops.cpl missing entry Bluetooth authentication agent", click here for more information. In case you no longer have BlueTooth support installed, and don't need it, simply uncheck the entry in Msconfig > Startup.	U
{12EE7A5E-0674-42f9-A76B-000000004D00}	rundll32.exe stlb2.dll,DllRunMain	BrowserAid/BrowserPal Foistware	X
{2CF0B992-5EEB-4143-99C0-5297EF71F444}	rundll32.exe stlbdist.dll, DllRunMain	BrowserAid/BrowserPal Foistware	X
{2CF0B992-5EEB-4143-99C2-5297EF71F44B}	rundll32.exe stlbupdt.DLL, DllRunMain	BrowserAid/BrowserPal Foistware	X
A70F6A1D-0195-42a2-934C-D8AC0F7C08EB	rundll32.exe E6F1873B.DLL,D9EBC318C	BrowserAid/BrowserPal Foistware	X
AdslTaskBar	rundll32.exe stmctrl.dll, TaskBar	ISP software, initializes DSL modem	Y
AME_CSA	rundll32 amecsa.cpl, RUN_DLL	Loads ADSL modem Control Panel applet	N
AudCtrl	RunDll32 AudCtrl.dll, RCMonitor	Note: Audio control panel?	?
AUNPS2	RUNDLL32 AUNPS2.DLL,_Run@16	AlwaysUpdatedNews.com parasite related - More_information	X
babeie	rundll32 cnbabe.dll, dllstartup	CommonName Toolbar spyware. To uninstall see here	X
BCMHal	rundll32.exe bcmhal9x.dll, bcinit	BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings	U
RunDll32 essprops	RunDll32 essprops.cpl, TaskbarIconWnd	Associated with a Logitech mouse - required for proper operation	Y
BluetoothAuthenticationAgen t	rundll32.exe bthprops.cpl,,BluetoothAuthenticati onAgent	Associated with BlueTooth software, designed to allow bluetooth mobile devices to authenticate to the computer, when connecting a PDA to your computer - necessary for the computer and the PDA to communicate.	U
BMMGAG	Rundll32 PWRMONIT.DLL, StartPwrMonitor	Displays a battery gauge icon in the Taskbar (not the System Tray). Provides shortcuts to IBM's proprietary power saving settings and to a battery information window	U
bxxs5	RunDLL32.EXE bxxs5.dll, dllrun	BookedSpace Parasite	X
Ccdecode	rundll32.exe streamci, StreamingDeviceSetup	Part of the closed caption decdoder/MS VBI codec. Should only run once	N
Cmaudio	Rundll32 cmicnfg.cpl, CMICtrlWnd	System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel	N
Compaq Computer Security	Rundll32.exe SECURE32.CPL, Service	Note: ??	?
ContentDownload	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
CoolDownloads	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
CoolMP3	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
CPU Watcher	rundll32.exe [path] cpu.dll,load	Added by the TROJ/DLOADER-LO TROJAN!	X
Ptipbmf	rundll32.exe ptipbmf.dll, SetWriteCacheMode	Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations. Note: May be necessary in order to maintain preferences applied to the RAID array connected to the Promise controller	?
RSS	rundll32 RSSToolbar.dll, DllRunMain	"Related Sites" toolbar - SearchAndClick hijacker variant	X
rmdrfje.dll	rundll32.exe [path] rmdrfje.dll	Troj/Dloadr-ANM	X
NEWDOT~1	rundll32.exe NewDotNetStartup Newdot~2.exe	NewDotNet Foistware	X
NiceDownloads	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
NVCLOCK	rundll32 nvclock.dll, fnNvclock	Note: Overclocking utility for nVidia based graphics cards?	?
RegistryCheck	rundll32.exe chkreg.dll,CheckRegistry	Ulubione adult content dialer	X
R	[path] rundll32.exe msprt.dll	Browser hijacker of Chinese origin, redirecting to 4199.com	X
PTRGMYGK	rundll32.exe ptmg1v.dll,DllRunMain	Added by an Unclassified_Unknown_Origin malware.	X
PtiuPbmd	Rundll32.exe ptipbm.dll, SetWriteBack	Installed with the miniport drivers for Promise hard drive controllers in both RAID and non-RAID installations.Tells the drivers that the connected Drives should use the "Write Back" Caching. You can disable this if you don't want to use "Write Back" Caching or if you have not connected any driver to your Promise Controller. See here	U
Remote Procedure Call Locator	RUNDLL32.EXE reg678.dll ondll_reg	Added by a variant of the LOVGATE WORM!	X
Protected Storage	RUNDLL32.EXE MSSIGN30.DLL ondll_reg	Added by a variant of the LOVGATE WORM!	X
NvMediaCenter	RunDLL32.exe NvMCTray.dll, NvTaskbarInit	System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties	N
NvColorInit	rundll32.exe NvQtwk.dll, NvColorInit	Note: Associated with Nvidia based graphics cards	?
NvCplDaemon	rundll32.exe NvQtwk.dll, NvCplDaemon	System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if enabled - see here)	N
NVMCTRAY	RUNDLL32.EXE ...NVMCTRAY.DLL, NvTaskbarInit	System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties	N
NvidiaQuickTweak or NVQuickTweak	rundll32.exe NvQtwk.dll, NvTaskbarInit	System Tray icon used to change display settings for nVidia based graphics cards. Unnecessary since you can easily configure these settings the way you want them in the Display Properties	N
NVIEW	rundll32.exe nview.dll, nViewLoadHook	This is a DLL to enable multiple display monitors on a single computer. It can be a cause of numerous problems on some computers	U
NvInitialize	rundll32.exe NvQtwk.dll, NvXTInit	Thought to enable the clock frequency option on nVidia control panels. You can overclock without leaving this enabled	N
NAVUpd	rundll32.exe navupd.dll, Startup	Added by the NAVU VIRUS!	X
MigrationVend or SetupCaller	rundll32.exe migrate.dll, CallVendorSetupDlls	Note: ??	?
RUNDLL32	RUNDLL32.EXE NvQtwk, NvCplDaemon	System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again. Also disable the "NVIDIA Driver Helper Service" if enabled as it can cause this entry to be re-enabled on re-boot (note that this service can also cause extreme shutdown delays if enabled - see here)	N
MP3download	rundll32.exe MSA64CHK.dll, DllMostrar	MatrixDialer related	X
(default)	rundll32.exe (path to) Zykheptd.dll	Added by the Backdoor.Hesive.B TROJAN! Note: Read the link, rootkit type stealth involved.	X
rundll32	Rundll32.exe Wf2kcpl.dll DllLoadDefaultSettings	Loads default settings for Leadtek Winfast graphics cards	U
rundll32	RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent	Associated with a Bluetooth adapter. If disabled the error dialogue box disappears	U
Rundll32 cmicnfg	Rundll32 cmicnfg.cpl, CMICtrlWnd	System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel	N
Rundll32_7	rundll32.exe MSIEFR40.DLL, DllRunServer	BrowserAid/BrowserPal Foistware	X
New.net	rundll32.exe NewDotNetStartup Newdot~2.exe	NewDotNet Foistware	X
RunDLL	rundll32.exe bridge.dll, Load	Flingstone.com browser hijacker	X
run	[path] rundll32.exe rsrc.dll	Browser hijacker of Chinese origin, redirecting to 4199.com	X
MBMon	Rundll32 CTMBHA.DLL,MBMon	Related to Creative_Audigy line of sound cards. Sounds like it helps Windows control the audio on your motherboard. Note: Is it required?	N
SysPnP	rundll32 setupapi, InstallHinfSection.... oemsyspnp.inf	Search hijacker	X
OfotoNow USB Detection	Rundll32.exe OFUSBS.DLL, WatchForConnection OfotoNow	Autodetects when a digital camera is attached to a USB port and launches OfotoNow image software. Available via Start -> Programs	N
Desktop	rundll32.exe msconfd.dll, Restore ControlPanel	Added by the BOOKMARKER VIRUS!	X
delsubmit	rundll32.exe advpack.dll, DelNodeRunDLL32 submit.exe	CoolWebSearch parasite related	X
si91e44b	rundll32.exe (path) si91e44b.dll,EnableRunDLL32	LZIO.com adware downloader	X
CTDrive	rundll32.exe [path] drv**.dll ( = random character)	Added by a TROJAN, member of the DesktopHijack aka SmitFraud family - detected by Kaspersky antivirus as Hoax.Win32.Renos.fw	X
Rundll	rundll32.exe [random file name].dll "taskmon"	Added by the MYTOB.IG WORM!	X
SoundService	rundll32.exe *******.dll,setvm ( = random char)	VirtuMonde/Vundo adware variant	X
autoupdate	rundll32 [path] SUPDATE.DLL,SHStart	Added by a variant of the QOOLOGIC TROJAN!	X
safe to remove USB	RunDll32.exe shell32.dll,Control_RunDLL hotplug.dll	Related to Microsoft Safely Remove Hardware applet.	N
Control	rundll32.exe ctrlpan.dll, Restore ControlPanel	CoolWebSearch parasite related.	X
readdb40	rundll32.exe (path) readdb40.dll,EnableRunDLL32	LZIO.com adware downloader	X
cfgmgr52	RunDLL32.EXE [path] cfgmgr52.dll,DllRun	BookedSpace Parasite	X
cfgmgr51	RunDLL32.EXE [path] cfgmgr51.dll,DllRun	BookedSpace Parasite	X
autoupdate	rundll32 [path] DATADX.DLL,SHStart	Added by a variant of the QOOLOGIC TROJAN!	X
123456	rundll32.exe shell32.dll, Control_RunDLL ...123456.cpl	Added by the KITRO.C (or DANDI.A) VIRUS! 123456 can be any random 3 to 6 digit number	X
sp	rundll32 (Path to Trojan DLL),DllInstall	Added by the Troj/Ablank-W and Troj/Ablank-Z TROJANS!	X
keymgrldr	rundll32 setupapi, InstallHinfSection... keymgr3.inf	CoolWebSearch parasite related	X
iel2cde8	rundll32.exe (path) iel2cde8.dll,EnableRunDLL32	LZIO.com adware downloader	X