| ( 1 ) "Added by the VB-ZD TROJAN! Note - this file is located in the C:Windowshelp folder and is not to be confused with the legitimate rundll32.exe file!" |
| ( 2 ) Displays battery status information on an IBM Thinkpad |
| ( 3 ) "Added by the LINEAG-ABD TROJAN! Note - this is not the legitimate rundll32.exe process which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in the ""inf"" sub-folder" |
| ( 4 ) "Added by the WOWCRAFT TROJAN!" |
| ( 5 ) "Added by the LEGMIR-AS TROJAN! Note - this is not the legitimate rundll32.exe process which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in the Root folder (C:) (D:) etc" |
| ( 6 ) "Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in the Windowsinf or Winntinf folder" |
| ( 7 ) "Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has ""powrprof.dll"" appended to the command/data line" |
| ( 8 ) "Added by the LINEAGE-BI TROJAN!" |
| ( 9 ) "Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process which is found in %Windir% (98ME) or %System% (NT2000XP). This one is located in %Windir%\dll" |
| ( 10 ) "Detected by Kaspersky as the RBOT.AIE BACKDOOR! See here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted" |
| ( 11 ) "Added by the WAYIC-A TROJAN! Note - this is not the legitimate rundll32.exe process which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). The file is located in C:Windows" |
| ( 12 ) "Added by the LINEAG-ADI TROJAN! Note - this is not the legitimate rundll32.exe process which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in an ""addins"" sub-folder" |
| ( 13 ) "Added by the DVLDR TROJAN! Note - this is not the valid ""Rundll32.exe"" as it's in the WindowsFonts directory" |
| ( 14 ) "Added by the SANKER WORM! Note - this is not the legitimate rundll32.exe process which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This one is is located in the Winnt or Windows folder" |
| ( 15 ) "Added by the AGENT-EZ TROJAN! Note - the real rundll32.exe resides in the System (9x/Me) or System32 (NT/2K/XP) folder whereas this file is found in a ""SHELLEXT"" subfolder" |