Windows – this process

processwindows 7

The following process seems to be running all the time:

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding

Anyone know what it is?

Scanned with MalwareBytes and Kaspersky Internet Security 2011

Using Windows 7 Ultimate 64 bits.

Best Answer

It is a Microsoft Windows DistributedCOM server. It is safe as far as I can tell. I have seen it on other systems that were couple of weeks old and didn't get chance to get infected :).

Related Solutions

Windows – How to get more info on high-CPU rundll32.exe process

We had this occur on several print servers that we had configured. When we looked at it in Process Explorer, we would get a command line such as

rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\hpmsn6bu.DLL,MonitorPrintJobStatus /pjob=135 /pname"PRINTER01"

After much research, we figured out that this only happened on machine that were using the HP Universal Printing Driver (both PCL 5 and PCL 6 flavors). This is a feature of of the HP UPD named Status Notification Pop-ups (SNPs). According to the HP website

SNPs provide immediate job information and printer status information by a small pop-up window on the client PC. SNPs also provide current information about printer consumables, such as toner levels and links to HP SureSupply ordering system and HP Instant Support page. The SNP feature, which displays during the submittal of a print job, is fully configurable through a variety of tools available to print administrators.

More information can be found here

Windows – Cannot connect to telnet server

Have you tried disabling the auto-tuning diagnostic in Windows 7?

netsh int tcp set global autotuninglevel=disabled

Microsoft Support KB article:

When the receive window autotuning feature is enabled, older routers, older firewalls, and older operating systems that are incompatible with the receive window autotuning feature may sometimes cause slow data transfer or a loss of connectivity.

The default auto-tuning level is "normal", and the possible settings for the above command are:

disabled: uses a fixed value for the tcp receive window. Limits it to 64KB (limited at 65535).
highlyrestricted: allows the receive window to grow beyond its default value, very conservatively
restricted: somewhat restricted growth of the tcp receive window beyond its default value
normal: default value, allows the receive window to grow to accommodate most conditions
experimental: allows the receive window to grow to accommodate extreme scenarios (not recommended, it can degrade performance in common scenarios, only intended for research purposes. It enables RWIN values of over 16 MB)

Best Answer

Related Solutions

Windows – How to get more info on high-CPU rundll32.exe process

Windows – Cannot connect to telnet server

Related Question