What Is Microsoft Windows Host Process Rundll32?

Updated July 19, 2017

Rundll32.exe is a program run by Microsoft required to run Dynamic Link Library (DLL) files. It is a necessary file from Microsoft, but spyware developers have also figured out how to run virus programs under the same name.

Purpose of Rundll.exe

Dynamic Link Libraries store information for every application in Windows. Microsoft's RunDll32.exe runs to launch functionalities in DLL files. However, spyware developers have discovered ways to run malicious programs as RunDll32.exe to disguise themselves. The best way to combat malicious software is to check for duplicates of the RunDll32.exe file.

Determining If RunDll32.exe Is Legitimate or Malicious

Search all drives in Windows for any duplicates of RunDll32.exe. The legitimate copy of RunDll32.exe can be found in \Windows\System32\rundll32.exe. Any other copies should be deleted. The Windows Task Manager can also determine any malicious copies of the file; press ctrl-alt-del to run the task manager, click the "processes" tab and hover the mouse over all instances of RunDll32.exe. The true identity of all malicious copies will show up.

Running Malware Scans

Malware-detection software is the safest way to browse your computer for malware and to protect it against future attacks. Check reliable sites such as for rated spyware and malware-detection and removal programs, and read reviews of any applications before downloading and installing any new files.

Cite this Article A tool to create a citation to reference this article Cite this Article

About the Author

Eleanor Evans began writing professionally in 1997. Her published work has appeared in "Arkansas Business," "New Orleans CityLife" and the "Arkansas Democrat-Gazette." Eleanor received her Bachelor of Arts in sociology from Hendrix College in 1999.