rundll32.exe opens and closes continiously

hapEcat said:

It appears to be only running from, \Windows\System32\rundll32.exe, but not 100% positive. How do I find out?
It's in & out on "Process Explorer" so fast, I can't be sure.

From Process Explorer double click the rundll32.exe and from Image tab you can found out folder path of the rundll32.exe.

FreeBooter said:

From Process Explorer double click the rundll32.exe and from Image tab you can found out folder path of the rundll32.exe.

Don't think you and I know I'm not fast enough to "dbl clck" or just "sngl clck" the process. It's there & gone before you can make a move.

Please open Command Prompt as a administrator and execute below command:

Code:

Dir  /s /a /b  C:\rundll32.exe  | Clip

After above command finish executing right click empty space at your next post and select Paste and click post.

Code:

Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>Dir  /s /a /b  C:\rundll32.exe  | Clip

C:\WINDOWS\system32>

This is all I got... Took all of 35sec to run.

hapEcat said:

This is all I got... Took all of 35sec to run.

The last bit " | Clip " sends it to your clipboard. It means you don't see the results unless you paste it somewhere.

Try it without - this is my (normal for 64 bit Windows) result:

Code:

Microsoft Windows [Version 10.0.16299.64]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>Dir  /s /a /b  C:\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.16299.15_none_faf17d821c0f060e\rundll32.exe
C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.16299.15_none_054627d4506fc809\rundll32.exe

C:\WINDOWS\system32>

Did not realize the "clip" function.
Will try again.

Code:

C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.15063.0_none_e9192ac8e3b94c4c\rundll32.exe
C:\Windows\WinSxS\x86_microsoft-windows-rundll32_31bf3856ad364e35_10.0.15063.0_none_8cfa8f452b5bdb16\rundll32.exe

Mine looks similar to yours.

The rundll32.exe file is located at correct folders. If you want you can scan your computer with malwarebytes to make sure your computer not infected.