simple Q for advanced: how to find out what rundll32.exe is executing?

[cap77]

hi, i have a pretty simple question for some that actually knows
Windows XP well! (am new to these tweaks, obviously....):

when i pull up the task bar in Windows XP, how can I find out what
exactly rundll32.exe is running?

i know enough to understand that this program helps run dlls as
executable programs in windows, but how can i figure out what specific
program it's running?

if i do cmd.exe, i can get a list of programs running that's a bit more
detailed than the task manager, but it's not really enough to confirm
it's not some hidden progam.

i do have anti-virus (symanted) running, and i do have spybot, but i am
just curious as to the experts' suggestions for understanding exactly
what's running on my computer underneath these general executable
programs.

thank you in advance!
Christina

 

[Ramesh, MS-MVP]

Christina,

List all processes and their Command-line parameters:
http://windowsxp.mvps.org/listproc.htm

What's the suspicious Rundll32.exe process?:
http://windowsxp.mvps.org/rundll32.htm

Sysinternals Freeware - Process Explorer:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


hi, i have a pretty simple question for some that actually knows
Windows XP well! (am new to these tweaks, obviously....):

when i pull up the task bar in Windows XP, how can I find out what
exactly rundll32.exe is running?

i know enough to understand that this program helps run dlls as
executable programs in windows, but how can i figure out what specific
program it's running?

if i do cmd.exe, i can get a list of programs running that's a bit more
detailed than the task manager, but it's not really enough to confirm
it's not some hidden progam.

i do have anti-virus (symanted) running, and i do have spybot, but i am
just curious as to the experts' suggestions for understanding exactly
what's running on my computer underneath these general executable
programs.

thank you in advance!
Christina

 

[cap77]

hi, thanks for the quick response. i dont mean to be obtuse here but i
still dont understand some of the information i get from Process
Explorer, for example. when i see what dll 's my rundll32.exe is
running, Process Explorer just gives me a list of like 10-12 different
dll's that are running under the process... few of which i can research
and get information on...

for example, Process Explorere tells me that rundll32 is executing
everything from shell32 (i understand the shell program) to
setupapi.dll (unclear if this runs all the time or if it's linked to a
specific aplication its setting up) to some things ive never heard of
like ctype.nls (and cant find in google groups)

the command you suggested which writes all the info onto a text file
was great, but bc i dont know all these processes as well as you guys
do, i cant tell if one looks out of place. Apologies in advance for
pasting such a long list here, but is this useful to one of the xppro
experts out there?

appreciate your thoughts. thanks


Image Name PID Modules

========================= ======
=============================================
rundll32.exe 2768 ntdll.dll, kernel32.dll, msvcrt.dll,

GDI32.dll, USER32.dll, IMAGEHLP.dll,

ShimEng.dll, AcGenral.DLL,
ADVAPI32.dll,
RPCRT4.dll, WINMM.dll, ole32.dll,

OLEAUT32.dll, MSACM32.dll,
VERSION.dll,
SHELL32.dll, SHLWAPI.dll, USERENV.dll,

UxTheme.dll, LPK.DLL, USP10.dll,

comctl32.dll, comctl32.dll,
pwrmonit.dll,
MFC42.DLL, setupapi.dll, powrprof.dll,

tppwrw32.dll, SynTPFcs.dll, MSCTF.dll

rundll32.exe 2904 ntdll.dll, kernel32.dll, msvcrt.dll,

GDI32.dll, USER32.dll, IMAGEHLP.dll,

ShimEng.dll, AcGenral.DLL,
ADVAPI32.dll,
RPCRT4.dll, WINMM.dll, ole32.dll,

OLEAUT32.dll, MSACM32.dll,
VERSION.dll,
SHELL32.dll, SHLWAPI.dll, USERENV.dll,

UxTheme.dll, LPK.DLL, USP10.dll,

comctl32.dll, comctl32.dll, MSCTF.dll,

SynTPFcs.dll, appHelp.dll, appwiz.cpl,

DUSER.dll, MSIMG32.dll, OLEACC.dll,

MSVCP60.dll, msi.dll, xpsp1res.dll,

xpsp2res.dll, NETAPI32.DLL,
CLBCATQ.DLL,
COMRes.dll, SETUPAPI.dll,
browseui.dll,
SHDOCVW.dll, CRYPT32.dll, MSASN1.dll,

CRYPTUI.dll, WINTRUST.dll,
WININET.dll,
WLDAP32.dll, mslbui.dll, LINKINFO.dll,

ntshrui.dll, ATL.DLL, MSGINA.dll,

WINSTA.dll, ODBC32.dll, comdlg32.dll,

odbcint.dll, sfc_os.dll, Secur32.dll,

MsiHnd.dll, IMM32.dll

 

[Ramesh, MS-MVP]

If you have XP Pro installed, then follow the instructions given in the link
#1 I posted earlier. That'll give you the exact command-line of rundll32.exe
process.

Using Process Explorer, double-click the rundll32.exe process. Then check
the ImagePath tab.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


hi, thanks for the quick response. i dont mean to be obtuse here but i
still dont understand some of the information i get from Process
Explorer, for example. when i see what dll 's my rundll32.exe is
running, Process Explorer just gives me a list of like 10-12 different
dll's that are running under the process... few of which i can research
and get information on...

for example, Process Explorere tells me that rundll32 is executing
everything from shell32 (i understand the shell program) to
setupapi.dll (unclear if this runs all the time or if it's linked to a
specific aplication its setting up) to some things ive never heard of
like ctype.nls (and cant find in google groups)

the command you suggested which writes all the info onto a text file
was great, but bc i dont know all these processes as well as you guys
do, i cant tell if one looks out of place. Apologies in advance for
pasting such a long list here, but is this useful to one of the xppro
experts out there?

appreciate your thoughts. thanks


Image Name PID Modules

========================= ======
=============================================
rundll32.exe 2768 ntdll.dll, kernel32.dll, msvcrt.dll,

GDI32.dll, USER32.dll, IMAGEHLP.dll,

ShimEng.dll, AcGenral.DLL,
ADVAPI32.dll,
RPCRT4.dll, WINMM.dll, ole32.dll,

OLEAUT32.dll, MSACM32.dll,
VERSION.dll,
SHELL32.dll, SHLWAPI.dll, USERENV.dll,

UxTheme.dll, LPK.DLL, USP10.dll,

comctl32.dll, comctl32.dll,
pwrmonit.dll,
MFC42.DLL, setupapi.dll, powrprof.dll,

tppwrw32.dll, SynTPFcs.dll, MSCTF.dll

rundll32.exe 2904 ntdll.dll, kernel32.dll, msvcrt.dll,

GDI32.dll, USER32.dll, IMAGEHLP.dll,

ShimEng.dll, AcGenral.DLL,
ADVAPI32.dll,
RPCRT4.dll, WINMM.dll, ole32.dll,

OLEAUT32.dll, MSACM32.dll,
VERSION.dll,
SHELL32.dll, SHLWAPI.dll, USERENV.dll,

UxTheme.dll, LPK.DLL, USP10.dll,

comctl32.dll, comctl32.dll, MSCTF.dll,

SynTPFcs.dll, appHelp.dll, appwiz.cpl,

DUSER.dll, MSIMG32.dll, OLEACC.dll,

MSVCP60.dll, msi.dll, xpsp1res.dll,

xpsp2res.dll, NETAPI32.DLL,
CLBCATQ.DLL,
COMRes.dll, SETUPAPI.dll,
browseui.dll,
SHDOCVW.dll, CRYPT32.dll, MSASN1.dll,

CRYPTUI.dll, WINTRUST.dll,
WININET.dll,
WLDAP32.dll, mslbui.dll, LINKINFO.dll,

ntshrui.dll, ATL.DLL, MSGINA.dll,

WINSTA.dll, ODBC32.dll, comdlg32.dll,

odbcint.dll, sfc_os.dll, Secur32.dll,

MsiHnd.dll, IMM32.dll

 

[cap77]

yes i have xp pro... i double clicked on the rundll32 line item in
process explorer, and the image tab states it's some sort of power
monitor setting associated with my thinkpad (pwrmonit)... from what i
can find out this is just an optimization setting on the screen of my
IBM thinkpad. i guess it's weird that it doesnt run like the other
thinkpad programs (all those annoying QCTRAY and QCWLICON executables
that automatically start up the thinkpad utilities and are in c\program
files), but i can be comfortable that it's not hiding some random
program.

thanks again for your help, really appreciate it.

 

[Ramesh, MS-MVP]

You're welcome!

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


yes i have xp pro... i double clicked on the rundll32 line item in
process explorer, and the image tab states it's some sort of power
monitor setting associated with my thinkpad (pwrmonit)... from what i
can find out this is just an optimization setting on the screen of my
IBM thinkpad. i guess it's weird that it doesnt run like the other
thinkpad programs (all those annoying QCTRAY and QCWLICON executables
that automatically start up the thinkpad utilities and are in c\program
files), but i can be comfortable that it's not hiding some random
program.

thanks again for your help, really appreciate it.

 

[jg]

Great tool, wmic, for listing processed for administrators

Is there something else in WinXp that does not need administrator power and
list only the one created by current user?

 

[Ramesh, MS-MVP]

WMI scripts are very powerful and can accomplish what you want.

Check here for samples:
http://www.microsoft.com/technet/scriptcenter/resources/qanda/default.mspx
http://www.microsoft.com/technet/scriptcenter/resources/qanda/hsgarch.mspx

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


Great tool, wmic, for listing processed for administrators

Is there something else in WinXp that does not need administrator power and
list only the one created by current user?

 

[cap77]

um, i am a bit confused here, you may be replying to the other poster
above.. are you suggesting there is a script i can run to see what
programs are being run by an administrator on my computer? or those
being run by the current user only? one of the links mentioned
something like that but it's a bit over my head...t

 

[Ramesh, MS-MVP]

I was replying to you.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


um, i am a bit confused here, you may be replying to the other poster
above.. are you suggesting there is a script i can run to see what
programs are being run by an administrator on my computer? or those
being run by the current user only? one of the links mentioned
something like that but it's a bit over my head...t

 

[cap77]

hi, sorry for the confusion (blame this on my lack of experience with
this stuff and the fact that ive been trying to fix my computer for
hours!)

when i link to the sites you posted, i cant see how exactly i would run
those scripts myself... do you just copy and paste the commands into my
cmd file? or do i need to launch some other wmi program (the articles
reference logging onto a wmi service?

as you can see, i need some help translating to plain english.

finally, do you have a suggestion to see all users (local or networked)
and what programs they are running?

i have a vpn connection to a closed-end server (thru work) and need to
know what i am sending over to that server on an ongoing basis. i' ve
only ever had a traditional LAN DSL connection from one independent
home computer, and am having a difficult time tracking processes and
programs running off of my home computer when i am logged on via VPN
and also my regular internet connection. does this make sense?
thx, appreciate your patience

 

[Ramesh, MS-MVP]

You may use the following script. Lists all the processes running in the
currently logged on user account.

- - -

strComputer = "."
Dim strUserName
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * From Win32_ComputerSystem")

For Each objItem in colItems
strUserName = objItem.UserName
Next

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
("SELECT * FROM Win32_Process")
For Each objProcess in colProcessList
colProperties = objProcess.GetOwner(strNameOfUser,strUserDomain)

If strUserDomain & "\" & strNameOfUser = strUserName Then
WScript.Echo "Process " & objProcess.Name & " is owned by " _
& strUserDomain & "\" & strNameOfUser & "."
End If
Next

- - -

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


hi, sorry for the confusion (blame this on my lack of experience with
this stuff and the fact that ive been trying to fix my computer for
hours!)

when i link to the sites you posted, i cant see how exactly i would run
those scripts myself... do you just copy and paste the commands into my
cmd file? or do i need to launch some other wmi program (the articles
reference logging onto a wmi service?

as you can see, i need some help translating to plain english.

finally, do you have a suggestion to see all users (local or networked)
and what programs they are running?

i have a vpn connection to a closed-end server (thru work) and need to
know what i am sending over to that server on an ongoing basis. i' ve
only ever had a traditional LAN DSL connection from one independent
home computer, and am having a difficult time tracking processes and
programs running off of my home computer when i am logged on via VPN
and also my regular internet connection. does this make sense?
thx, appreciate your patience