• news
  • pics
  • linux
  • windows
  • proxmox
  • game
  • news
  • pics
  • linux
  • windows
  • proxmox
  • game
Home
windows

What Is rundll32.exe and Why Is It Running?

You are no doubt reading this article because you’ve looked in task manager and wondered what on earth all those rundll32.exe processes are, and why they are running… So what are they?

RELATED: What Is This Process and Why Is It Running on My PC?

This article is part of our ongoing series explaining various processes found in Task Manager, like svchost.exe, dwm.exe, ctfmon.exe, mDNSResponder.exe, conhost.exe, Adobe_Updater.exe, and many others. Don’t know what those services are? Better start reading!

Explanation

If you’ve been around Windows for any amount of time, you’ve seen the zillions of *.dll (Dynamic Link Library) files in every application folder, which are used to store common pieces of application logic that can be accessed from multiple applications.

Since there’s no way to directly launch a DLL file, the rundll32.exe application is simply used to launch functionality stored in shared .dll files. This executable is a valid part of Windows, and normally shouldn’t be a threat.

Note: the valid process is normally located at \Windows\System32\rundll32.exe, but sometimes spyware uses the same filename and runs from a different directory in order to disguise itself. If you think you have a problem, you should always run a scan to be sure, but we can verify exactly what is going on… so keep reading.

Research Using Process Explorer on Windows 10, 8, 7, Vista, etc

Instead of using Task Manager, we can use the freeware Process Explorer utility from Microsoft to figure out what is going on, which has the benefit of working in every version of Windows and being the best choice for any troubleshooting job.

Simply launch Process Explorer, and you’ll want to choose File \ Show Details for All Processes to make sure that you’re seeing everything.

image

Now when you hover over the rundll32.exe in the list, you’ll see a tooltip with the details of what it actually is:

image

Or you can right-click, choose Properties, and then take a look at the Image tab to see the full pathname that is being launched, and you can even see the Parent process, which in this case is the Windows shell (explorer.exe), indicating that it was likely launched from a shortcut or startup item.

image

You can browse down and view the details of the file just like we did in the task manager section above. In my instance, it’s a part of the NVIDIA control panel, and so I’m not going to do anything about it.

How to Disable the Rundll32 Process (Windows 7)

Depending on what the process is, you won’t want to necessarily disable it, but if you would like to, you can type msconfig.exe into the start menu search or run box and you should be able to find it by the Command column, which should be the same as the “Command line” field we saw in Process Explorer. Simply uncheck the box to prevent it from starting automatically.

image

Sometimes the process doesn’t actually have a startup item, in which case you’ll likely have to do some research to figure out where it was started from. For instance, if you open up Display Properties on XP you’ll see another rundll32.exe in the list, because Windows internally uses rundll32 to run that dialog.

Disabling in Windows 8 or 10

If you’re using Windows 8 or 10, you can use the Startup section of Task Manager to disable it.

Windows_10

Using Windows 7 or Vista Task Manager

One of the great features in Windows 7 or Vista Task Manager is the ability to see the full command line for any running application. For instance, you’ll see that I have two rundll32.exe processes in my list here:

image

If you go to View \ Select Columns, you’ll see the option for “Command Line” in the list, which you’ll want to check.

image

Now you can see the full path for the file in the list, which you’ll notice is the valid path for rundll32.exe in the System32 directory, and the argument is another DLL that is actually what is being run.

image

If you browse down to locate that file, which in this example is nvmctray.dll, you’ll usually see what it actually is when you hover your mouse over the filename:

image

Otherwise, you can open up the Properties and take a look at the Details to see the file description, which usually will tell you the purpose for that file.

image

Once we know what it is, we can figure out if we want to disable it or not, which we’ll cover below. If there isn’t any information at all, you should either Google it, or ask somebody on a helpful forum.

When all else fails, you should post the full command path over on a helpful forum and get advice from somebody else that might know more about it.

Previous article What Is the Service Host Process (svchost.exe) and Why Are So Many Running?
Next article 美国时尚风流杂志《花花公子》宣布停刊!再见,香艳美女们!

therock

12 Comments

  1. keto box
    July 7, 2021 at 5:25 am

    keto egg diet

  2. keto diet triglycerides
    July 7, 2021 at 2:51 am

    is keto diet bad for you

  3. keto pumpkin bars
    July 6, 2021 at 10:19 pm

    dr berg keto diet

  4. free to use bbw dating online
    June 24, 2021 at 4:57 am

    free lesbien dating

  5. dating sites online for free
    June 23, 2021 at 7:48 pm

    free online dating forum

  6. free classified dating sites
    June 2, 2021 at 12:48 pm

    free dating sites completely free

  7. drug free dating
    June 2, 2021 at 6:41 am

    free dating sites in phoenix

  8. new free dating site without credit card
    May 21, 2021 at 12:55 am

    tao of dating free ebooks

  9. 100 free latin dating sites
    May 20, 2021 at 6:00 pm

    browse free dating sites

  10. free twink dating in ma
    May 20, 2021 at 5:37 pm

    best free geek nerd dating sites

  11. free bisexual men dating sites
    May 19, 2021 at 7:08 pm

    free bisexual men dating sites

  12. hinge tinder
    May 16, 2021 at 1:17 pm

    hinge tinder

    What Is rundll32.exe and Why Is It Running? – rock funs

Meta
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org
Categories
  • game
  • linux
  • news
  • pics
  • proxmox
  • windows
Recent Posts
  • Proxmox VE 直通显卡方案及解决N卡Code43
  • Linux系统出现:You have new mail in /var/spool/mail/root 的原因及解决办法
  • debian系统解决中文乱码
  • pve添加git和pvetools
  • 流鼻血!这不“枣糕”的傲人身材加体现了出来~
Recent Comments
  • Paulvem on Proxmox VE 直通显卡方案及解决N卡Code43
  • Davidimmip on Proxmox VE 直通显卡方案及解决N卡Code43
  • Jimvem on Proxmox VE 直通显卡方案及解决N卡Code43
  • MichaelNat on Proxmox VE 直通显卡方案及解决N卡Code43
  • MiclBiG on Proxmox VE 直通显卡方案及解决N卡Code43
Archives
  • December 2022 (4)
  • November 2022 (6)
  • April 2022 (1)
  • February 2022 (5)
  • January 2022 (2)
  • December 2021 (3)
  • November 2021 (1)
  • October 2021 (2)
  • September 2021 (1)
  • August 2021 (1)
  • July 2021 (8)
  • June 2021 (14)
  • May 2021 (2)
  • April 2021 (2)
  • March 2021 (10)
  • January 2021 (4)
  • December 2020 (4)
  • November 2020 (13)
  • April 2020 (276)
  • March 2020 (1)
  • June 2019 (5)
  • May 2019 (10)
  • December 2015 (1)