JB,
User Process Explorer which can be downloaded here:
Page:
http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx
Direct Download:
http://download.sysinternals.com/Files/ProcessExplorer.zip
Locate the RUNDLL32.EXE process, double-click it & scroll down the list of
'strings'. Do you see any rogue references to non Microsoft webpages etc? If
so, you can use that tool to suspend or kill the process. Once killed & it
pops back up it means there is another process watching it
You can also download & run the Autoruns tool to look for suspicious startup
entries that maybe watching its back. Here's the tool:
Page:
http://www.microsoft.com/technet/sysinternals/utilities/autoruns.mspx
Download:
http://download.sysinternals.com/Files/Autoruns.zip
Look on the LOGON tab & you'll see two registry keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Are there any references to the RUNDLL32.EXE there other than the soundcard?
Maybe when you delete them they come straight back, which means something is
watching their backs too & you have at least 2 processes keeping things
alive
If you see rubbish in the above keys for 'Qicktime Task' or 'Real Media
Update' (TKBell) then you can safely delete those as they aren't needed
Awaiting your feedback about the RUN keys & the process