Delete it, shut down, and restart. If another copy of windll.dll appears on restart, you've got BO . This search can take a very long time, depending upon the size and number of files on your system. It will be faster, but less thorough, if you confine the search to the Windows folder and its subdirectories. A clever intruder without programming skills can easily set up the BO server to be regenerated from a compressed file at each reboot.
File size is another clue.
Maximum can however be much longer. One person sent me a BO server that was 193,143 bytes in length. Exactly how big it can get is nonetheless unlimited . Using File Find to locate all files on all drives at least 122K in size, then sorting them by date to find the more recent, should yield a relatively short list of likely suspects. This works especially well if you have MSInfo or Wintop and compare the list to running applications.