I have the process as mentioned in the question using nearly all my resources, both processing and memory, even though I have nothing else running.

When I end the process, it seems to just start automatically.

From this site it seems like this is malware.

Any advice on how to remove it?

When running Process Explorer I see the following under the image tab:


Command line:rundll32.exe msvcrt.dll,_sleep

  • 1
    msvcrt.dll is part of the Microsoft Visual C++ Runtime. This command line doesn’t cause any CPU usage whatsoever on my machine. Please provide the working directory of the process in question. – Daniel B Jun 5 '16 at 12:28
  • Process Explorer gives the 'Current Directory' of the process as C:\Windows\. Not sure if that's what you mean? – Jonny Jun 5 '16 at 12:32
  • Yeah, that’s what I was referring to. – Daniel B Jun 5 '16 at 12:33

Rundll32.exe is a Windows file. It is used to run code from DLL files without having to use a specific executable. It is needed by the OS, so don't try deleting it! Let's use a great tool to see what DLL it is running:

Download Process Explorer from Sysinternals, a tool that shows a list of processes and allows to see much more info than Task Manager. Run it and you'll see a list of running processes. You may see that there are multiple entries for rundll32.exe, don't worry. Find the right one by checking the CPU column for each of them and right click the one with the high CPU usage. Click Properties and a new window will open. Click the Image tab and check the text in the Command line box. You'll see something in the style of "C:\Windows\SysWOW64\rundll32.exe" C:\MyFolder\MyDLLName.dll,MyFunctionName.

"C:\MyFolder\MyDLLName.dll" is the path to the DLL that rundll32.exe is running. That will let you know what's hogging your CPU. When you know what software the DLL belongs to, you can decide between keeping it or removing it. If you want to keep it, look for updated versions of it, as it may be a known problem.

Since I don't have that information I can't tell you anything more on how to solve it. Please post the text from the Command line box and I'll expand on this answer.

  • Hi there. I did already identify that it is the C:\Windows\SysWOW64\Rundll32.exe file causing the problem. – Jonny Jun 5 '16 at 11:28
  • Please, follow the steps described. As explained in the answer, rundll32.exe does nothing on its own and is a Windows file. It needs parameters to run, and those parameters will tell you what is it running. – 35003500 Jun 5 '16 at 12:10
  • Cool, sorry about that. Updated my Q with that info. – Jonny Jun 5 '16 at 12:18
  • 1
    Not a problem. msvcrt.dll is again a Windows file and benign. We'll need to find what is calling rundll32.exe with those parameters. I'll try to help with that, but I have to brush up my Process Explorer knowledge first. Also, don't delete Process Explorer yet, we'll need it. – 35003500 Jun 5 '16 at 12:27
  • Do you know what the '_sleep' command means? My PC is also doing something funny where it will randomly wake up from sleep. Perhaps this issue is related. – Jonny Jun 5 '16 at 12:30

This file crops up when I start Tomraider 2 in Windows 7. It slows the game to a halt and drives CPU usage up to 100%. It seems that it is furiously looking for 3D graphic drivers used years ago and are now obsolete but pulls the CPU into a loop.

The syntax to start the system DLL is in the startup program for the game but I found once the game had loaded. Hit your windows key. Go into Task Manager and end the process there. It wont come back until you restart the game but your CPU usage will drop one hell of a lot and modern laptops and computers will run the game even better than before. Even with on board CPU chip graphics capabilities.

I wouldn't delete that file though as other programs may use it successfully. Just stop it from running when it is a problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.