Windows 10: 3 RunDll32 processes opening on startup

Hi all,

(First off, I'd like to say that I've never done one of these before, so apologies if I lack the etiquette for this situation!)

I'll keep this short and sweet:

On startup, one rundll32 process is always opening (the one highlighted in the image), and shortly after a second one appears, and then a third one. They aren't in the startup tab of task manager, but they open every time. This worries me because...

1. I have had malware / trojan issues previously on this pc, but have reset it since and all has been well, except for this.
2. After looking online many people say that this is an indication of malware / bad business in general.

I've attached a screenshot of these in task manager as well as their file path.

Is there something wrong here?

[Windows Version number: Version 2004 (OS Build 19041.508)]




:)

 

What is Rundll32.exe and why has it started running in the background?

Doing a search on TenForums for rundll32.exe yields the following...

Rundll32 Commands List for Windows 10
Why is Windows Host Process (Rundll32) in my Startup?

There are more, but this should answer the question.

 

Windows host process rundll32 running 19 instances

That is certainly not normal, you will need to find out what processes are running on rundll32.exe

Rundll32 is just a host for other processes to run, to find out exactly what is running on this process, Click HERE to download the free ProcessExplorer
from TechNet

The app will download in a zip file (approx 1.84mb), unzip it and run the appropriate version (32bit or 64bit) for your system by right clicking the exe and choosing 'Run as Administrator'

You’ll want to choose File - Show Details for All Processes to make sure that you’re seeing everything

Hover over the rundll32.exe in the list, you’ll see a tooltip with the details of what it actually is:





Alternatively you can right-click, choose Properties

Then take a look at the Image tab to see the full pathname that is being launched

You can see the Parent process, which in this case is the Windows shell (explorer.exe), indicating that it was likely launched from a shortcut or startup item.





In general, processes running on rundll32.exe can be stopped from running when Windows starts up as follows:

• Press Windows + R keys together to open the run dialog
• Type msconfig and hit enter
• On the Startup Tab will be a list of processes that start with Windows
• Check the box marked Hide all Microsoft Services'
• Look down through the remaining list for items containing 'rundll32'
• If you find any erroneous entries, uncheck them . . .
• BE CAREFUL not to uncheck items like nVidia items which sometimes use rundll32

 

OVER 160 RunDll32.exe in TASK MANAGER !

Have you got lots of Rundll32.exe or svchost.exe processes running, or both?

On a normal Windows 10 system, you should not have any Rundll32.exe processes running at all. Check your startup apps the see what is causing this:

• Press Ctrl + Shift + Esc together to open Task Manager, click on the Startup Tab and see if there are any entries that are starting under rundll32, if there are, disable them
• Press WIndows + R keys together to open the run dialog, type msconfig and hit enter. Click on the services tab and check the box marked 'Hide all Microsoft Services'. Then scroll through the list of services looking for rundll32 entries, if you find any,
  uncheck them and reboot

With regards to svchost, i have noticed a huge increase in the number of these processes since the Creators Upgrade - I have 77 currently running on my system. They all are using 0% processor and HDD and on average about 1MB - 2MB, though this number does
seem excessive . . .