3

I recently clean-installed Win7 on my HP8530. Everything works well most of the time, but for the last few days, every morning after my computer has been idle overnight, I find that rundll32.exe is consuming a steady 50% of CPU (i.e. all of one processor). The only way I can make it go away is by restarting.

Process Explorer has no information on what the process is running. If I try to do anything to rundll32.exe (kill process, suspend, etc.) I get "Error opening process: Access is denied." None of the tabs in the ProcExp properties dialog has any information at all.

I have Norton Internet Security running with the latest definitions; I've run a full system scan and it gives me a clean bill of health.

How can I get more information on why this process is running?

Improve this question

5 Answers 5

Reset to default
5

We had this occur on several print servers that we had configured. When we looked at it in Process Explorer, we would get a command line such as

rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\hpmsn6bu.DLL,MonitorPrintJobStatus /pjob=135 /pname"PRINTER01"

After much research, we figured out that this only happened on machine that were using the HP Universal Printing Driver (both PCL 5 and PCL 6 flavors). This is a feature of of the HP UPD named Status Notification Pop-ups (SNPs). According to the HP website

SNPs provide immediate job information and printer status information by a small pop-up window on the client PC. SNPs also provide current information about printer consumables, such as toner levels and links to HP SureSupply ordering system and HP Instant Support page. The SNP feature, which displays during the submittal of a print job, is fully configurable through a variety of tools available to print administrators.

More information can be found here

Improve this answer
2
  • we had a lot of ldap queries (requiring rwdc) that were generated from some of our workstations. The SNP was the culprit.
    – Loïc MICHEL
    Nov 22, 2013 at 6:57
  • Two years after finding this answer, I came across this blog post which didn't work for me, but it led me to look in the registry and write a Powershell script to disable SNP for all the HP printers at once.
    – Michael come lately
    May 5, 2016 at 21:51
2

This is great info on how to diagnose a rundll.32 proceess

Explanation

If you’ve been around Windows for any amount of time, you’ve seen the zillions of *.dll (Dynamic Link Library) files in every application folder, which are used to store common pieces of application logic that can be accessed from multiple applications.

Since there’s no way to directly launch a DLL file, the rundll32.exe application is simply used to launch functionality stored in shared .dll files. This executable is a valid part of Windows, and normally shouldn’t be a threat.

Note: the valid process is normally located at \Windows\System32\rundll32.exe, but sometimes spyware uses the same filename and runs from a different directory in order to disguise itself. If you think you have a problem, you should always run a scan to be sure, but we can verify exactly what is going on… so keep reading.

Improve this answer
1

You need to look at what the command line used to launch the process was, what the actual path of the running process is ( to verify it's not malware masquerading as a legit process ), and what threads the process currently has running. All of these are available through Process Explorer

Improve this answer
1

Here's the piece I was missing: In Process Explorer, in the File menu there's an option to "Show Details for All Processes." As soon as I did that, all the information on the process rundll32.exe was running became available (it was the executescheduledsppcreation scheduled task, which creates system restore points).

Improve this answer
0

examine the process with AnVir Task Manager Free Portable

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .