I recently clean-installed Win7 on my HP8530. Everything works well most of the time, but for the last few days, every morning after my computer has been idle overnight, I find that rundll32.exe is consuming a steady 50% of CPU (i.e. all of one processor). The only way I can make it go away is by restarting.

Process Explorer has no information on what the process is running. If I try to do anything to rundll32.exe (kill process, suspend, etc.) I get "Error opening process: Access is denied." None of the tabs in the ProcExp properties dialog has any information at all.

I have Norton Internet Security running with the latest definitions; I've run a full system scan and it gives me a clean bill of health.

How can I get more information on why this process is running?


We had this occur on several print servers that we had configured. When we looked at it in Process Explorer, we would get a command line such as

rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\hpmsn6bu.DLL,MonitorPrintJobStatus /pjob=135 /pname"PRINTER01"

After much research, we figured out that this only happened on machine that were using the HP Universal Printing Driver (both PCL 5 and PCL 6 flavors). This is a feature of of the HP UPD named Status Notification Pop-ups (SNPs). According to the HP website

SNPs provide immediate job information and printer status information by a small pop-up window on the client PC. SNPs also provide current information about printer consumables, such as toner levels and links to HP SureSupply ordering system and HP Instant Support page. The SNP feature, which displays during the submittal of a print job, is fully configurable through a variety of tools available to print administrators.

More information can be found here

  • we had a lot of ldap queries (requiring rwdc) that were generated from some of our workstations. The SNP was the culprit. Nov 22 '13 at 6:57
  • Two years after finding this answer, I came across this blog post which didn't work for me, but it led me to look in the registry and write a Powershell script to disable SNP for all the HP printers at once.
    – Michael
    May 5 '16 at 21:51

This is great info on how to diagnose a rundll.32 proceess


If you’ve been around Windows for any amount of time, you’ve seen the zillions of *.dll (Dynamic Link Library) files in every application folder, which are used to store common pieces of application logic that can be accessed from multiple applications.

Since there’s no way to directly launch a DLL file, the rundll32.exe application is simply used to launch functionality stored in shared .dll files. This executable is a valid part of Windows, and normally shouldn’t be a threat.

Note: the valid process is normally located at \Windows\System32\rundll32.exe, but sometimes spyware uses the same filename and runs from a different directory in order to disguise itself. If you think you have a problem, you should always run a scan to be sure, but we can verify exactly what is going on… so keep reading.


You need to look at what the command line used to launch the process was, what the actual path of the running process is ( to verify it's not malware masquerading as a legit process ), and what threads the process currently has running. All of these are available through Process Explorer


Here's the piece I was missing: In Process Explorer, in the File menu there's an option to "Show Details for All Processes." As soon as I did that, all the information on the process rundll32.exe was running became available (it was the executescheduledsppcreation scheduled task, which creates system restore points).


examine the process with AnVir Task Manager Free Portable

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.