Debug socket requests through RUNDLL32

[John D]

I have a rampant DLL from my ISP connection manager that
continuously opens port 110 on mail server. Port Reporter
shows RUNDLL32 sources the request but I can't tell which
DLL is doing it. I have moaned to my ISP but they have
done nothing I can see so far. Is there a debug tool for
RUNDLL32 that will show me this info? Using Windows XP
Home SP1 with latest patches (not SP2 yet).

 

[Ken Wickes [MSFT]]

tlist /c can give you the command line the rundll32 was started with, that
might help.

from MSDN:

You can obtain Emcmd.exe or Tlist.exe from the Windows debugging package,
which is available from the following Microsoft Web site:
http://www.microsoft.com/ddk/debugging