What is rundll32.exe?

The genuine rundll32.exe file is a software component of Microsoft Windows Operating System by Microsoft Corporation.
"RunDLL32.exe" is Microsoft's "Windows Host Process," (or, "Run a DLL as an app,") a powerful tool available since Windows Vista and Windows Server 2008. On 32-bit Windows systems, it resides in "C:\Windows\System32." On 64-bit systems, two "rundll32.exe" processes exist in "\System32" and "\SysWOW64" to call 64-bit and 32-bit DLL's respectively. In any other location this process name is probably disguised malware from trojans or viruses, especially in subfolders of the user's profile folder. Code in Dynamic Link Library (.DLL) files is not normally directly executable; it must be called from a process. Library files reduce RAM and disk usage by segmenting code loaded into active memory, and allowing multiple applications to call one copy of a commonly-used function (or "method"). Developers familiar with Windows API method names can use "rundll32.exe" commands in scripts to call specific methods within specific DLL's to perform Windows functions remotely and/or on a schedule.

rundll32 stands for Run a DLL as an App

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the rundll32.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for rundll32.exe related errors

Rundll32.exe file information

Windows Task Manager with rundll32 — Rundll32.exe process in Windows Task Manager

The process known as Windows host process (Rundll32) or Run a DLL as an App or Uob or hla or NEXT-Soft Hex-Editor MX or Tree Microsoft or endigué chaine' définirons or Windows ana bilgisayar iþlemi (Rundll32)

belongs to software Microsoft Windows Operating System or Lsz or hla or Hex-Editor MX or ecuma gourdirions or Microsoft Windows Ýþletim Sistemi

by Microsoft (www.microsoft.com) or Ocf or AVAST Software a.s or NEXT-Soft or judokas négligent.

Description: The original rundll32.exe from Microsoft is an important part of Windows, but often causes problems. Rundll32.exe is located in the C:\Windows\System32 folder or sometimes in the C:\Windows folder. Known file sizes on Windows 10/11/7 are 33,280 bytes (31% of all occurrences), 44,544 bytes and 27 more variants.
The process is the YzY5NDMxODdkZWYyZ service.
Rundll32.exe is a Windows core system file. The file is a Microsoft signed file. The program is not visible. Therefore the technical security rating is 6% dangerous, but you should also take into account the user reviews.

Recommended: Identify rundll32.exe related errors

Viruses with the same file name

Is rundll32.exe a virus? No, it is not. The true rundll32.exe file is a safe Microsoft Windows system process, called "Windows host process". However, writers of malware programs, such as viruses, worms, and Trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are for example WS.Reputation.1 (detected by Symantec), and Trojan-Dropper.Win32.Injector.ebsj or Trojan.Win32.Zapchast.acbp (detected by Kaspersky).
To ensure that no rogue rundll32.exe is running on your PC, click here to run a Free Virus Scan.

How to recognize suspicious variants?

If rundll32.exe is located in a subfolder of C:\Windows, the security rating is 8% dangerous. The file size is 44,544 bytes (64% of all occurrences), 45,056 bytes and 10 more variants. The program has no visible window. The file is a Windows core system file. It is a Microsoft signed file.
If rundll32.exe is located in a subfolder of the user's profile folder, the security rating is 72% dangerous. The file size is 24,576 bytes (16% of all occurrences), 120,992 bytes and 21 more variants. It is not a Windows core file. There is no description of the program. The program has no visible window. The process starts when Windows starts (see Registry key: MACHINE\Run, Run, MACHINE\RunOnce, User Shell Folders, DEFAULT\Runonce, DEFAULT\Run, RunOnce). Rundll32.exe is able to record keyboard and mouse inputs, monitor applications and manipulate other programs.
If rundll32.exe is located in a subfolder of Windows folder for temporary files, the security rating is 48% dangerous. The file size is 310,359 bytes (75% of all occurrences) or 44,544 bytes.
If rundll32.exe is located in a subfolder of "C:\Program Files", the security rating is 74% dangerous. The file size is 5,541,945 bytes (33% of all occurrences), 1,067,520 bytes or 290,816 bytes.
If rundll32.exe is located in a subfolder of C:\Windows\System32, the security rating is 49% dangerous. The file size is 167,936 bytes (50% of all occurrences) or 376,851 bytes.
If rundll32.exe is located in the Windows folder for temporary files, the security rating is 77% dangerous. The file size is 20,480 bytes (50% of all occurrences) or 737,280 bytes.
If rundll32.exe is located in a subfolder of C:\, the security rating is 24% dangerous. The file size is 44,544 bytes.

External information from Paul Collins:
There are different files with the same name:

"BatInfEx" can run at start up. Displays battery status information on an IBM Thinkpad
"LoadPowerProfile" definitely not required. Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has "powrprof.dll" appended to the command/data line
"Rundll32" definitely not required. Added by the DVLDR TROJAN! Note - this is not the valid "Rundll32.exe" as it's in the Windows\Fonts directory
"rundll32" definitely not required. Added by the SANKER WORM! Note that the valid "rundll32.exe" resides in C:\Windows\System32 wheras this version resides in C:\Windows
"TaskMan" definitely not required. Added by the DVLDR TROJAN! Note - this is not the valid "rundll32.exe" as it's in the Windows\Fonts directory
"UPDATEHOOK": ??
"Win32 Rundll Loader" definitely not required. Added by the SDBOT.A TROJAN! Note: Rundll32.exe is a valid Windows application called "Run a DLL as an App" and stored in the C:\Windows directory. The version created by this virus is saved in the C:\Windows\System directory
"Windows DLL Loader" definitely not required.

Important: Some malware disguises itself as rundll32.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the rundll32.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.

Score

User Comments

C:\Windows\SysWOW64\rundll32.exe

If it is found somewhere outside X:/USER/WINDOWS/SYSTEM32 then it is a malicious file or worse, a virus.
Arnelius

I have never see this in task manager until today I see it, I found out that this program is located in system32 folder
Arthur

There is a good file by microsoft called "rundll32.exe" located in System 32, but on 4/23/14, a virus under the same name that makes your system crazy slow or crash. It is a real virus. I believe it comes from a trojan called "slrundll."
TheCRTman

The windows required rundll32.exe... But the hackers attack this file ..to crash the pc And the most of the virus and malware s written by hackers for attack this file... If you want to prevent this .. Make your pc is well secured antivirus..
Rask in

The file itself is not a virus, but there is a virus under the same name.
Brii

This is a valid Windows program used to run DLLs (hence the name). YES there are also viruses out there that use the same name, and YES viruses can exploit and screw with your rundll32.exe file, just as they can screw with any of your files, and YES sometimes you will have system or registry errors that cause it to not run properly... but the file itself is safe, valid, and necessary for certain functions. If you're having rundll32.exe problems, rundll is not the cause, unless you have a second illegitimate rundll32 file hiding on your system somewhere.
mans

Just leave it it will dont do any thing ..... Dont rename it or dont do any more .....
diwan chowthry

More comments can be found here:
(further information)

Summary: Average user rating of rundll32.exe: based on 495 votes with 9 user comments. 179 users think rundll32.exe is essential for Windows or an installed application. 22 users think it's probably harmless. 121 users think it's neither essential nor dangerous. 70 users suspect danger. 103 users think rundll32.exe is dangerous and recommend removing it. 77 users don't grade rundll32.exe ("not sure about it").

Best practices for resolving rundll32 issues

A clean and tidy computer is the key requirement for avoiding problems with rundll32. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To get your computer running as fast as it did on day one, you can 8reset your PC. Your personal files will remain intact, but any programs you installed will need to be reinstalled.

To help you analyze the rundll32.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. A good Bantivirus software detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

avg secure search_toolbar.dll starwindserviceae.exe searchindexer.exe rundll32.exe hydradm.exe monitor.exe ipsbho.dll services.exe opera_crashreporter.exe flux.exe yontooieclient.dll [all]

	Do you have additional information?
What do you know about rundll32.exe:
How would you rate it:
Link for more info:
Your Name: