Windows 10: rundll32.exe opens and closes continiously

All this started back in early August, or about the time "Windows Creator" was installed.
I have sound notifications for processes that open or close, a paranoia from long ago, or I would have never known this was going on.

rundll32.exe continuously opens and closes (1-2sec intervals) when a "windows explorer" R click menu is pulled up. I can pull up "MS Process Explorer" and it all stops. Found the culprit process by 1st pulling up "Process Explorer" and then R click on any icon pinned to the taskbar. I could then see the process open and closing.

I'm sure someone will suggest to simply just turn off the sounds for opening and closing, but I like to know when something is happening that is not normal, and a continual opening and closing of a process is not normal.... Normally all is quiet.

:)

 

Strange White Window

i have something new. it happened on another computer. this time my dads laptop and i remotely viewed the processes and once i looked through it i started ending some process that i thought it was and could not figure it out. i did watch the entire
list and after i closed the windows i noticed a process was missing. rundll32.exe was there while the window was open and after i closed it rundll32.exe was gone. any ideas?

 

Prompt that says "What do you want to do with default.htm?"

Have you contacted the webmaster of the website? A file is attempting to download to your computer from the site. I believe this file is included in their coding package and they may need to adjust code on the site.

Steps to delete IE cache and retry the website. This is a thorough cleanse of cached files.

Open Command Prompt (Admin) and type or copy/paste the following commands pressing
Enter after each one.

Rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 8

Rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 255

Rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 32

Rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 16

Rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 2

Rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 1

Brief explanation of each command:

1. Deletes Temporary Internet Files, copies of webpages, images, and media that are saved for faster viewing,

2. Deletes All History,

3. Deletes Passwords,

4. Deletes Form Data,

5. Deletes Web Cookies from the Command line,

6. Deletes List of Visited Websites.

 

I would imagine it's some sort of context menu extension kicking in on the right click menu, what is on your right click context menus in explorer? Does it happen when right clicking on the desktop?

 

ScrnSht of Explorer R click.
and...
No, it does not happen from R click of desktop.

 

I can't see anything obvious on there, I thought there might be some sort of application extension installed which is initialising rundll32.exe whenever a right click is performed. Does this happen only when you right click on the taskbar? Or when you right click an empty part of the desktop too?

 

alexncfc....
Just now getting back in from 10 days in the woods, hunting...
Does not happen on "R" click of desktop.
Just from "R" click on task bar.
Also sometimes when a program such as Firefox or perhaps Thunderbird is minimized.

 

Rundll32.exe allows invoking a function exported from a DLL (Dynamic Link Library) files. The valid process is normally located at \Windows\System32\rundll32.exe, if the Rundll32.exe is running from any other directory it a malware infection.

 

It appears to be only running from, \Windows\System32\rundll32.exe, but not 100% positive. How do I find out?
It's in & out on "Process Explorer" so fast, I can't be sure.

 

You could run procmon.

Capture events (ctrl + E to start/stop) while you recreate the issue then search for rundll32.exe ( crtl + F )

Hover your mouse over the process name and it will tell you the path.

 

Will try "procmon" this evening, as we are driving up to the Carolinas for Thanksgiving, and report back sometime tomorrow.

 

From Process Explorer double click the rundll32.exe and from Image tab you can found out folder path of the rundll32.exe.

 

Don't think you and I know I'm not fast enough to "dbl clck" or just "sngl clck" the process. It's there & gone before you can make a move.

 

Please open Command Prompt as a administrator and execute below command:


Code: Dir /s /a /b C:\rundll32.exe | Clip[/quote] After above command finish executing right click empty space at your next post and select Paste and click post.

 

Code: Microsoft Windows [Version 10.0.15063] (c) 2017 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>Dir /s /a /b C:\rundll32.exe | Clip C:\WINDOWS\system32>[/quote] This is all I got... Took all of 35sec to run.