Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following process seems to be running all the time:

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding

Anyone know what it is?

Scanned with MalwareBytes and Kaspersky Internet Security 2011

Using Windows 7 Ultimate 64 bits.

share|improve this question
rundll32.exe is a standard Windows/MS program to initialize a DLL. shell32.dll is a standard Windows/MS extension. The interesting part is the SHCreateLocalServerRunDll. Google doesn't shed any light on that. Does Registry Editor find anything in your registry for the hex argument at the end? – Nathan G. Jan 3 '11 at 0:17
@Nathan did not find anything of interest when looking for "995C996E-D918-4a8c-A302-45719A6F4EA7" – BloodPhilia Jan 3 '11 at 0:43
Why are you suspicious of this legit Windows system file? – Moab Jan 3 '11 at 1:26
@Moab because I can't seem to find the source of why this is running... I've never had this process before and I haven't installed anything in the meantime. – BloodPhilia Jan 3 '11 at 1:50
Try Process Explorer, a powerful tool if you know how to use – Moab Jan 3 '11 at 2:09
up vote 7 down vote accepted

It is a Microsoft Windows DistributedCOM server. It is safe as far as I can tell. I have seen it on other systems that were couple of weeks old and didn't get chance to get infected :).

share|improve this answer
+1 I couldn't find that anywhere. – digitxp Jan 3 '11 at 0:43
@digitxp - According to Wiki it's a long deprecated technology, why would this still be on my Win7 64 bits computer? – BloodPhilia Jan 3 '11 at 0:48
I guess backwards compatibility with .net frameworks – Mat Banik Jan 3 '11 at 0:53
Microsoft always uses long deprecated technology! You must be a Linux/Unix user. – Moab Jan 3 '11 at 1:16
@Moab Well mainly yes xD Is it that obvious huh? – BloodPhilia Jan 3 '11 at 1:51

This is an old question. But the correct answer can be found here:

That GUID maps to the "Shell Hardware Mixed Content Handler", which is a COM handler that needs to run as "Interactive User", meaning run in a logged-on user's session (that's you ). The reason it needs to run in the context of a logged-on user is that it's actually the Autorun handler (enabling Autorun on my own Win7 box causes the same process to be spawned).

If you don't want to see it, go into the control panel and disable Autorun. Otherwise, it needs to run for Autorun to work properly.

answered there by cluberti on 07 Mar 2012

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .