However, antivirus programs are not perfect, and occasionally malware that runs with rundll32 will avoid detection. Malwarebytes is an excellent choice and will take care of most malware, though there are other great antivirus software packages out there. Typically, the best thing to do if you suspect you have a malicious copy of rundll32.exe on your PC is to run a virus scan with Microsoft Defender or the antivirus program you prefer. You should immediately be suspicious of any rundll32 executable that is not located in your Windows folder, or a Windows subfolder.
Sometimes malware will use the same executable name and run from a different directory to disguise itself.
The two you'll commonly see are located in 'C:\Windows\System32\' and 'C:\Windows\SysWOW64', but if you perform a search, you'll find additional ones in the Windows folder. There are a few legitimate copies of the rundll32 executable contained in a Windows install.
