After being connected to the internet (True ADSL) for a while more often than not my IBM laptop seems to get very slow. Looking at the Task Manager I see that rundll32.exe is using all available CPU, usually 95%+ so that 100% of CPU is being used.

Surely this can't be normal. I have licensed WinXP Pro with the latest fixes. Internet searching tells me rundll32.exe is a genuine program and not a trojan/worm/virus/spyware or whatever. How can I be sure the program has not been hijacked ? If so, why is it using all available CPU ? How can I stop it ? If I cancel the process and the process tree it automatically restarts itself. If I cancel repeatedly (50+ times) it seems to eventually stop, but can start up again at any time.

What else to do ? Anyone had a similar problem ?

Edited October 17, 200619 yr by sibeymai

Rundll32.exe is the microsoft program to run .dll files as executables and is part of the system. Sometimes a trojan or a virus will replace it or even use it to run it's own code. Run uptodate virus scan and a program like Lavasoft Ad-Aware software to see if it finds something. Can look at this site for info also: http://www.neuber.com/taskmanager/process/rundll32.exe.html

Thanks for that info Twyais

I had mentioned in another thread how my cpu usage was high and pages were slow to open.

I ran NOD32 and it cleared out a little problem I had. My machines back to normal again.

"metasploit.exe - probably a variant of Win32/TrojanDownloader.Small.AWA trojan - deleted"

I have antivirus running with auto update at all times but it had slipped through

Cheers

Farma

Lavasoft Adware is not sufficient for detecting trojans and spyware anymore. I would recommend using a combination of Spybot, available from http://www.spybot.de and Kaspersky Antivirus/Internet Security. You can download a trial version of Kaspersky from http://www.kaspersky.com

It offers the best detection for viruses as well as malware and trojans. I will be posting more in-depth information regarding Kaspersky over the coming days so stay tuned.

thanks everyone. I'll check this out and see what results.