a question about rundll32.exe

Once in a while i get an alert from Defense+ where rundll32.exe is trying to execute a file that has a .URL or .LNK extension. Here is a sample of some of the files it tried to execute:

  • visit ravenshield.com.url
  • view electronic manual.lnk
  • sqmapi.dll
  • technical help.lnk

In the defense log the action was listed as “Create Process, execute image”

Is this normal for windows vista? What is it trying to do?

I think that this is normal… What were you doing when these alerts have appeared?

these alerts happen and random times

May be this topic will shine a light on your situation:
https://forums.comodo.com/defense_help/rundll32dll_active_when_system_idle-t41620.0.html .