rundll32.exe running all the time?

TastyCheese · 07 Mar 2012

I always check my processes from time to time and today I noticed that rundll32.exe appears to be running non-stop, which I don't remember it doing before. It's not really using any resources, but with me being paranoid, I'm really scared :/ Checked it with process explorer, this is what it yields:

Path:
C:\Windows\System32\rundll32.exe

Command line:

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding

The parent process is svchost.exe(668) which command line is:

C:\Windows\system32\svchost.exe -k DcomLaunch

Hovering above said svchost.exe shows the DCOM Server Process Launcher, Plug and Play and Power as its services.

Checked both files, they appear to be clean.

Is this completely normal or should I be worried?

Running W7 Home Premium 64-bit

**cluberti** · 07 Mar 2012

That GUID maps to the "Shell Hardware Mixed Content Handler", which is a COM handler that needs to run as "Interactive User", meaning run in a logged-on user's session (that's you :)). The reason it needs to run in the context of a logged-on user is that it's actually the Autorun handler (enabling Autorun on my own Win7 box causes the same process to be spawned).

If you don't want to see it, go into the control panel and disable Autorun. Otherwise, it needs to run for Autorun to work properly.

ianbrylle29 · 10 Mar 2012

ahh. I have the same problem when i PLay frozenthrone it always pops up in the task manager panel and make the game super lag.

alishathomaz · 13 Mar 2012

The rundll32.exe application is simply used to launch functionality stored in shared .dll files. This executable is a valid part of Windows, and normally shouldn’t be a threat.

Disabling the Process:

Depending on what the process is, you won’t want to necessarily disable it, but if you would like to, you can type msconfig.exe into the start menu search or run box and you should be able to find it by the Command column, which should be the same as the “Command line” field we saw in Process Explorer. Simply uncheck the box to prevent it from starting automatically.