Does it say RunDLL.exe or RunDLL32.exe? The difference is important; it may be an indicator of a possible hijacking. RunDLL32 is supposed to launch-and-release under XP. If it fails to release...

Actually, it's an anti-hijacker. The page (http://mjc1.com/mirror/hjt) that Caperjack refers to is both a download link and a quick-start for beginners on HijackThis. I'm also writing a beginner...

That information is stored in the Registry, but there is a tool for it, TweakUI. I have not used it under XP, but if it's like all earlier versions of the utility, there's a tab labeled Paranoia...

EDIT: Shutdown.exe is part of an upgrade pack for 2000 (not included), but included in XP and Server 2003.

I know that I'm coming a little late to this party, but some important new information has come to light. It turns out that even with the MS patches applied, there are still DCOM/RPC...