Windows host process (Rundll32)

[camouflage212]

Hi,
I recently re-formatted my hard drive, and noticed an icon in the task bar called "windows host process (Rundll32)". I looked it up and it said it could be malicious. I'm not sure if it is or not, but I ran Malwarebytes and nothing came up. Any ideas? Thanks in advance!

 

[pjmelect]

Rundll32 is perfectly normal to be seen in the task manager it is however not normal to see it in the task bar, are you sure that you got the name of the task bar correct?. If Malwarebytes says that it is not a virus then it is probably harmless. What happens when you delete the program or prevent it from starting up?

 

[camouflage212]

Hi, thank you for the reply.
I don't think I was clear enough in where I found it, and I apologize. In the lower right hand corner of the screen, I click the up arrow, which brings up "hidden" icons. In that list, I find an icon which is the same as the "safely remove USB device" icon. It says "windows host process (Rundll32)" I cannot click it (like the other icons) and it only gives me options to hide notifications, etc. I had a similar experience with Relevant Knowledge in the same place a while back. I'm not sure how to prevent it from starting up, or even delete it. I'm just a bit concerned is all. Thanks again.

 

[pjmelect]

I don’t think that it is a virus but you need to find out what it is. Type msconfig in the “RUN” box on the start menu to start msconfig. In the start-up tab untick half of the entries and restart the computer. Is the rundll32 still there? if it is untick half of the remaining entries and if it has gone then retick half of the entries that are not ticked restart the computer, and so on until you isolate the entry responsible for the rundll32.

 

[camouflage212]

I ended up un-ticking all of the entries, but it's still there. Just to clarify, it's in the taskbar customization window. rundll32 is still there, along with avgtray.exe and windows update, etc.

 

[pjmelect]

Try booting in safe mode, is it still there? If it is then it is probably a virus if it is not then it is either a driver or a service. You can stop all of the services in Msconfig the same way as you did for startup programs.

 

[DXRick]

RunDLL32 is a DLL used by Windows when executing an old visual basic program (pre .NET VB). I would definitely be suspicious of what old VB program is on the PC.

 

[camouflage212]

[/URL][/img]

So I just re-formatted again, and it was not there when everything was installed. I hooked up my external hard drive with my backup files, and once I unplugged the drive via USB, it was back in the taskbar customization menu. It's definitely caused by that external HDD. What could this mean?

 

[DXRick]

Is there an autorun file on the external HD?

 

[camouflage212]

There isn't a file that I can see on it, but it does autorun when it's plugged in.

 

[DXRick]

OK, I just plugged my external WD USB 3.0 hard drive into a USB3 port, and I see the same Rundll32 thing. I don't see it if I plug it into a USB2 port (which I tried last night).

So, I would guess that it is normal (I hope).

 

[camouflage212]

This would explain why my mom could not see it on her computer. Hers uses USB2 ports. We've used this external drive in the past without issue. I even scanned the whole thing before copying files. Thank you for all your help with this. It's good to know it's possibly normal.

 

[camouflage212]

Best answer selected by camouflage212.

 

[ziauddin]

Hi,
I recently re-formatted my hard drive, and noticed an icon in the task bar called "windows host process (Rundll32)". I looked it up and it said it could be malicious. I'm not sure if it is or not, but I ran Malwarebytes and nothing came up. Any ideas? Thanks in advance!

 

[nikorr]

This topic has been closed by Nikorr