# multiple rundll32's

**URL:** <https://boards.straightdope.com/t/multiple-rundll32s/118945>\
**Category:** Factual Questions\
**Created:** [July 14, 2002, 8:48pm UTC](https://boards.straightdope.com/t/multiple-rundll32s/118945 "2002-07-14T20:48:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jb\_farley](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@jb\_farley](https://boards.straightdope.com/u/jb_farley)\
**Post date:** [July 14, 2002, 8:48pm UTC](https://boards.straightdope.com/t/multiple-rundll32s/118945/1 "2002-07-14T20:48:49Z")

</div>

upon startup, this computer i’m using has at _ **least** _ two copies of rundll32 running. how do i know? if i ctrl-alt-del immediately after startup, there they sit, laughing at me.

and, even if there is not a third running at startup, given a chance, there’s one running soon enough.

even if i force end the multiples, they come back. a box pops up saying “wait, end task, cancel”, and i choose end. the clone of rundll32 will disappear from my program manager dialog box, only to reappear in a sec at the bottom of the task list.

what gives? norton detects NOTHING.

jb

---

<div class="post-metadata">

**Author:** ![erislover](https://avatars.discourse-cdn.com/v4/letter/e/71e660/32.png) [@erislover](https://boards.straightdope.com/u/erislover)\
**Post date:** [July 14, 2002, 9:00pm UTC](https://boards.straightdope.com/t/multiple-rundll32s/118945/2 "2002-07-14T21:00:43Z")

</div>

Hmm… multiple instances yet Norton doesn’t catch it? I know there are some viruses which use rundlI32 but since lowercase ‘l’ and uppercase “i” look the same in the dialog box no one is technically the wiser… but if norton didn’t catch it???

---

<div class="post-metadata">

**Author:** ![EmbarrassingDad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/embarrassingdad/32/5441_2.png) [@EmbarrassingDad](https://boards.straightdope.com/u/EmbarrassingDad)\
**Post date:** [July 14, 2002, 9:13pm UTC](https://boards.straightdope.com/t/multiple-rundll32s/118945/3 "2002-07-14T21:13:58Z")

</div>

I’m not sure about that, but I highly doubt it’s a virus.

These links might be helpful:

[http://www.blkviper.com/WinXP/servicecfg.htm](http://www.blkviper.com/WinXP/servicecfg.htm)  
[http://www.pacs-portal.co.uk/startup\_content.htm](http://www.pacs-portal.co.uk/startup_content.htm)