SEARCH

How-To Geek

What is rundll32.exe And Why Is It Running?

You are no doubt reading this article because you’ve looked in task manager and wondered what on earth all those rundll32.exe processes are, and why they are running… So what are they?

Explanation

If you’ve been around Windows for any amount of time, you’ve seen the zillions of *.dll (Dynamic Link Library) files in every application folder, which are used to store common pieces of application logic that can be accessed from multiple applications.

Since there’s no way to directly launch a DLL file, the rundll32.exe application is simply used to launch functionality stored in shared .dll files. This executable is a valid part of Windows, and normally shouldn’t be a threat.

Note: the valid process is normally located at \Windows\System32\rundll32.exe, but sometimes spyware uses the same filename and runs from a different directory in order to disguise itself. If you think you have a problem, you should always run a scan to be sure, but we can verify exactly what is going on… so keep reading.

Using Windows Vista’s Task Manager

One of the great features in Windows Vista’s Task Manager is the ability to see the full command line for any running application. For instance, you’ll see that I have two rundll32.exe processes in my list here:

image

If you go to View \ Select Columns, you’ll see the option for “Command Line” in the list, which you’ll want to check.

image

Now you can see the full path for the file in the list, which you’ll notice is the valid path for rundll32.exe in the System32 directory, and the argument is another DLL that is actually what is being run.

image

If you browse down to locate that file, which in this example is nvmctray.dll, you’ll usually see what it actually is when you hover your mouse over the filename:

image

Otherwise, you can open up the Properties and take a look at the Details to see the file description, which usually will tell you the purpose for that file.

image

Once we know what it is, we can figure out if we want to disable it or not, which we’ll cover below. If there isn’t any information at all, you should either Google it, or ask somebody on a helpful forum.

Using Process Explorer on Vista or XP

Instead of using Task Manager, we can use the freeware Process Explorer utility from Microsoft to figure out what is going on, which has the benefit of also working in Windows XP.

Simply launch Process Explorer, and if you are using Vista you’ll want to choose File \ Show Details for All Processes.

image

Now when you hover over the rundll32.exe in the list, you’ll see a tooltip with the details of what it actually is:

image

Or you can right-click, choose Properties, and then take a look at the Image tab to see the full pathname that is being launched, and you can even see the Parent process, which in this case is the Windows shell (explorer.exe), indicating that it was likely launched from a shortcut or startup item.

image

You can browse down and view the details of the file just like we did in the task manager section above. In my instance, it’s a part of the NVIDIA control panel, and so I’m not going to do anything about it.

Disabling the Process

Depending on what the process is, you won’t want to necessarily disable it, but if you would like to, you can type msconfig.exe into the start menu search or run box and you should be able to find it by the Command column, which should be the same as the “Command line” field we saw in Process Explorer. Simply uncheck the box to prevent it from starting automatically.

image

Sometimes the process doesn’t actually have a startup item, in which case you’ll likely have to do some research to figure out where it was started from. For instance, if you open up Display Properties on XP you’ll see another rundll32.exe in the list, because Windows internally uses rundll32 to run that dialog.

When all else fails, you should post the full command path over on a helpful forum and get advice from somebody else that might know more about it.

Lowell Heddings, better known online as the How-To Geek, spends all his free time bringing you fresh geekery on a daily basis. You can follow him on if you'd like.

  • Published 07/30/08

Comments (69)

  1. Rohit

    Great Post,
    Thanks geek!

  2. Norcross

    is the ’32’ alluding to the 32 bit OS? If so, is there something different when using a 64 bit OS?

  3. Christopher

    Here is what I have found about rundll32: if it is running ALL THE TIME… you most likely have a program that is not written correctly OR a virus/spyware/whatever (malicious program) on your system.

    There is no reason (except for very few beta programs like NIS2009 that I was just testing) that a rundll32 should be running all the time on your system, and that’s coming straight from the guy at Microsoft who I talked with the other day.

  4. jd2066

    @Norcross: I think it is refering to the 32-bit OS from the 16-bit transition. There used to be a rundll.exe program that was for 16-bit dlls. From a few searchs online it seems it is still rundll32.exe on 64-bit. Not sure why that would be.

  5. bigminisachin1231

    I also have two rundll32.exe’s running in Task Manager; however the second one doesn’t list anything under Command Line – possible virus?

  6. Hydra

    i think the bigger question would be: why do i have 20 svchost.exes running, and why cant they consolidate them down to one, so i can see the rest of my programs?

  7. jd2066
  8. Hydra

    Thanks jd. I looked quickly, but i didn’t find it. You figure it would be in the related articles.

  9. Deof Movestofca

    You almost lost your geekhood status by simply mentioning Task Manager, but nicely redeemed yourself with the Process Explorer reference (although technically speaking, I believe Process Explorer is by Systinternals, although they are owned by Microsoft). Not that I claim to be a geek myself, but even I know that the latter is much more powerful, yet still a lot easier to understand.

    :oP

  10. vin-ay

    i have like 6 or 7 running at once. What should i do?

  11. jd2066

    @vin-ay: Use the information in this article to find the command line for each of the4 6 or 7 and post them on the forum. Someone should be able to tell you what they are for and if they are needed.

  12. Harjit

    not able to open the external harddrive, it says currupt, and gives gives the option to format, and I have some important data, and needs to back that up.

  13. jd2066

    @Harjit: Post your question on the forum. More people will see it and be able to help you.

  14. Spacegold

    I have a very modest hardware setup running vista, yet a search reveals over 100,000 DLLs. This is program fragmentation gone berserk. This says all that ever needs to be said about the Windows OS. It is a makework system for software developers (programmers).

  15. Thavi

    Very nice article! Thank you!

  16. allen

    which processes of the system can be ended…

    i have a 1gb ram….

    and nearly 45 processes running….it is said that minimum the processes the greater is the speed …!!!
    if it is so then tell me the processs that can be ended to tor my p.c faster… plz reply fast./..

  17. Mick

    On starting my PC I get the prompt ‘rundll32.exe’, has stopped running. Is this something I should worry about?

  18. Dan

    I also have this problem:

    I also have two rundll32.exe’s running in Task Manager; however the second one doesn’t list anything under Command Line – possible virus?

  19. Daniel

    How do you do this on xp? I can’t find the command line column.

  20. tj

    I have a problem running some software I downloaded and the provider told me to do the following, but I’m concerned about what it will do to my system. Can anyone explain what these things mean and what they do? Should I be concerned? Thanks:
    For Windows Vista please try the following steps:
    Ř Click Start
    Ř Select Run
    Ř Type cmd
    Ř Within the command prompt window
    o Type taskkill /F /IM rundll32.exe
    o Type cd C:\ProgramData\SysMon
    o Type rundll32.exe SysMon.dll rdl

  21. Dior

    thanks…well presented.

  22. Alex

    i do not have a SysMon

  23. taher

    if go to add/remove error msg says it cant locat Windows\System32\rundll32.exe, pls advice how to pix this as i dont hv win xp cd.
    Thanx.

  24. Mattanyah

    Incredible, just great.

    Should create a virus to sweep all other info sites, cause none of them are as accurate as yours, and explains everything that even a toddler could understand!!!!:)

    My only concern came up when I had to restart or shut down my system when the tab appears, “Closing program RUNDLL32.EXE,” and then it just laggs unless I then have to choose to end program, but I think am going to check msconfig.exe to find out wether it is a system command file, or any other related.

    shalom

  25. run32dll.exe

    I actually had 2 instances of rundll32.exe running on my machine. It was only after a system scan that this was able to be resolved.

  26. Mike J

    Like Daniel, I do not see this option in XP SP3.

  27. Mike J

    Allen–correct me if I am wrong, more knowledgeable people, but I think if you disable a herd of unnecessary Windows services, your process count will go down.

  28. UK

    Simply Great!!!
    I used the process explorer (Microsoft) but it is showing more than 20 rundll32.exe’s under a node of svchost.exe. But every exe is executing from System32 folder. What’s going on here?

  29. JJ

    I have one rundll32.exe file running from C:\WINDOWS\system32 and one in C:\WINDOWS\temp and i have a feeling the latter one shouldnt be there….am i right??

  30. DRyan

    I am having a issue opening my task manager or any program with the abilty to chase down these rundll32 bits. How can I sneak around them?

  31. Omar

    Hi im doing a power point presentation about “rundll32.exe.”And I have to explain the host processes and the error windows host process “rundll32” has stop working. Thanks.

  32. ALDO

    I have a hp vista laptop . I can’t find any of my
    files like pics, music, etc …the funny part is
    that it won’t let me do anything that has to
    go through cd drive and Internet based files.
    for eg; I can’t save an image from a web.
    Here’s where the main problem is. I had found
    just recently that the back up CDs for the drivers
    had to be made of course in my case I can’t
    do that with drivers that do not work . Well
    it’s from BEST BUY. So are this information .
    when I took it there for them to look at it, $75 just to
    look at it…$50 service charge $275 for the CDs
    and 2weeks of repair time and they do not guarantee
    if it’s repairable but you still have to pay for them to look
    and service fee $125+tax….I do not know
    much about the drivers but not stupid
    to pay that amount .. Can anyone pls help
    me how to make windows vista recovery CDs
    or pls pls let me know if best buy telling
    the truth or not…. thanks so much… I would
    appreciate it a lot in advance …. Aldo

  33. dave

    my rundll32 takes up 52% of cpu should i worry?

  34. steed

    hi.
    i loaded up some video footage from my sony cam and everytime i open the folder to view my videos, i get a message saying WINDOWS HOST PROCESS (rundll32) HAS STOPPED WORKING. and then another box comes up saying WINDOWS EXPLORER HAS STOPPED WORKING. this in turn causes the folder to crash and close and go back to the desktop screen.
    PLEASE HELP !
    thank you

  35. Steph

    I cant even get into my task manager!
    The it’s not letting me make any changes on my computer. Its not letting remove programs, change internet options, firewall, anything from the control panel!

  36. hacks

    rundll.exe is simply a malware made by microsoft for all pirated version os or a virus made by anti virus corp itself. yeah its true microsoft can make an os that world wide used.dont u think that in such a big corp can make an such a multi billion os cant totally dissable their own os by their genius programing capability? other activation loader made by microsoft itself and because it is only a loader its also activate the malware in it. then microsoft silently knows what youre doin in their os when your connected in internet instantly youre survey maker on their corp.and other reason is microsoft dont loose their trone in busines in os making althoug people uses pirated version they still sticking in their os. remember microsft is a bussines obviosly this thing have such a marketing plan that people not aware of it

  37. Sri Lankan User

    I have a problem that is what is winlogon.exe ? it’s destroy my computer and what is csrss.exe ? some one help me what is those applications mail me : kanushkadananjaya@gmail.com

  38. Brian

    I have only one rundll32.exe in my task manager but the command line is blank as well with csrss.exe, winlogon.exe, ati2evxx.exe with nothing in the command line. This concerns me as should it be listed in the proper folder? Also under User name column, every file is listed as Owner except the ones listed above, the user name colums is blank for these file? is these a virus or most most importantly spyware?

  39. Brian

    Also, FYI I have Vista if that makes a difference

  40. Hassoon3

    Best geeks ever! I like your geeky way of geekness!!! hehehe ;)

  41. Hussein

    when I write in yahoo messanger, nothing appear in the window. however the message is sent. This also is applied on what i receive. I only can read the messages in a small pop up over the clock but noting in the message window. It’s blank !!! what shall i do?

  42. jeff

    if go to add/remove error msg says it cant locat Windows\System32\rundll32.exe, or if i go to the control panel it shows on icons in there to. I do not have a windows xp disk can you help me please thank you!

  43. Jen

    Thank you!

  44. Ibrahim Manikfan Nabu

    when i am going to open a file in C drive or connected Hard disk in my sony vaio laptop everytime i open the folder to view my videos, i get a message saying WINDOWS HOST PROCESS (rundll32) HAS STOPPED WORKING. and then another box comes up saying WINDOWS EXPLORER HAS STOPPED WORKING. this in turn causes the folder to crash and close and go back to the desktop screen.
    PLEASE HELP !!!!
    thank you

  45. bryan

    yeah, i had this stupid process going after i installed the new ATI drivers for my laptop (Radeon Mobility HD 4200). I so pissed of because it was taking up 80% of my processing power. I decided to just restore my system image. I have all my games installed in to a different partition anyway, everything else, I just backed up into that partition, restored my primary, and called it a day. I guess it was the old “Dont fix it if it aint broke” deal. My old drivers work just as well… well at least i think so. Anyway, thanks for this info.

    Rundll32.exe was running. NOT rundll.32.exe. Cant fool me with your stupid capital R. thanks again.

  46. zip

    HI pals, Rundll.exe32 run to my pc when i play gamez only!!

  47. Nandini

    Thank you very much. I got much information about Rundll32.exe.

  48. Brianch

    When I run IE, after about 10-15 minutes many version of Rundll32.exe open pointing to C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess 10715

    What is inetcpl.cpl and why is it hogging my system memory?

  49. Jiggawut

    delete system 32:!?!?!?

  50. Hmmmm

    Does it mean your PC is infected if there is only 1 running?

  51. sharrow

    i am using win 7 home premium os.when i turn on my laptop it is showing me a window which say’s that win dll 32 module couldnot be found and i was unable to access my task manager and even i could’nt turn on windows fire wall ;and it says only administrator can do that even though i am using administrator account; i cannot make the file which are hidden re appear and that option is blank ; i scanned for virus for many times but it showed clean
    can plz help me

  52. sharrow

    i am using win 7 home premium os.when i turn on my laptop it is showing me a window which say’s that win dll 32 module couldnot be found and i was unable to access my task manager and even i could’nt turn on windows fire wall ;and it says only administrator can do that even though i am using administrator account; i cannot make the file which are hidden re appear and that option is blank ; i scanned for virus for many times but it showed clean
    can any one plz help me

  53. sharrow

    i cannot update my os even though it is a genuien one

  54. Ian

    I did this on Win7 Ult a while ago and in the command line it was just blank. I clicked End Process Tree and now everything is back to normal. I’m just worried what the blank Command Line means.

  55. macduff

    Thank you Mr. Geek

  56. AI

    I download and read manga off the internet as .rar files…rundll32.exe only shows up when I’m viewing the pictures themselves…
    I’m using wndows xp
    Also the rundll32.exe doesn’t show up under System, but under my user name…

    Is it a virus or are jpgs and other pictures based files consider dll and the program is using it to sort them out?

  57. Karen

    A few people have asked above what the deal is when the command lines shows no path. That’s the case with my machine which is running at a very slow unresponsiv speed.

    Can I disable those rundll32.exe tha have no command line?

  58. chuck

    Thank you for this info. You have helped me find a virus that even my anti-virus couldn’t.

  59. D.Amos

    I found a fix that works
    FIX for multiples of rundll32.exe in processes
    Look in windows (under computer)
    SysWow64
    go down the list and look for rundll32.exe and delete it.
    done.

  60. AJ

    I have only 1 rundll32.exe and my computer is on atleast 5 hours a day.
    After I shut it down then come back to it the next day, I do what I do on my computer, play games, do homework, etc… and when I check my task manager it’s still there.

    It that normal or should I do something about it?

  61. Dipesh

    rundll.exe comes in picture when only i try to start game. plz give solution.Thanks.

  62. Aykut

    I have 2 rundll.exe : the first is : rundll.exe and it’s running from system32, but the second is : rundll.exe*32 and it’s running from SysWOW64???

    Is that normal and what should I do?

  63. Salma Noreen

    I have 4 rundlll32.exe 3 are with the same name and 1 is rundll32.exe*32

    should I worry? is there any malware/virus or something like that in my system?

    please answer me.

  64. Vallas

    I HAVE A LITTLE PROBLEM I SEE rundll32.exe RUNNING ON THE ADMINISTRATOR INSTEAD OF THE SYSTEM IS IT SOMETHING TO WORRY ABOUT?

  65. scene2312

    I have a question if you can help…I viewed my wireless networks and went to close the window and the following message came up:

    wireless network connection: Explorer.ExE-application error under that it said the exception illegal instruction under that….an attempt was made to execute an illegal instruction. (0xc00000ld) occurred in the application at location 0xc00d6of71 WHAT IS THAT ALL ABOUT?

  66. sarathms

    how is rundll32.exe different from svchost.exe?
    Both are used to execute .dll files na..

  67. Chathuranga

    I have the same problem. Why they use both rundll32.exe and svchost.exe? Can’t use only one of those?

  68. manish

    sometime before my xp is infacted by a virus in form of an antivirus named”protection shield pro”.
    when i start windows its disable my all files and show them as a virus and ask me to delete them.
    From taskmanager i end the process of that virus and also remove its files from my computer.
    after that my rundll not working.everytime i want to open some prom os ask me “open with”.
    it also deny to acess control panel for making onother user account..

    plz plz help me to shortout this problem

  69. ESF

    Every time I open a movie folder it show me run32dll has stopped working. Very irritating, please help with a fix that I donot have to pay for

Enter Your Email Here to Get Access for Free:

Go check your email!