Many Rundll32 processes are running and using all the CPU

[astanton1978]

We have a problem with an HP driver that is spawning multiple RunDll32.exe processes, but they are not terminating. Instead they are using up all the remaining CPU. Here is a screenshot of one of the occurences. 

When they were first noticed they had been running for several days on one server. This has been happening on multiple servers over the last several months. 

When adding the command line column in task manager it has MonitorPrintJobStatus in the title. I didnt get a screencap of the whole command line in task manager.

Killing the process is the only way to correct it at the moment.  I have at least one  memory dump of one of the processes. Here are the file versions from the dump, but its a 60+ MB dumpfile I'm not uploading here.  

Dump Summary
------------
Dump File: rundll32.DMP : C:\Users\me\Downloads\rundll32.DMP
Last Write Time: 4/10/2018 2:41:27 PM
Process Name: rundll32.exe : C:\Windows\System32\rundll32.exe
Process Architecture: x64
Exception Code: not found
Exception Information:
Heap Information: Present

System Information
------------------
OS Version: 6.2.9200
CLR Version(s):

Modules
-------
Module Name Module Path Module Version
----------- ----------- --------------
rundll32.exe C:\Windows\System32\rundll32.exe 6.2.9200.16384
ntdll.dll C:\Windows\System32\ntdll.dll 6.2.9200.21971
kernel32.dll C:\Windows\System32\kernel32.dll 6.2.9200.16859
KERNELBASE.dll C:\Windows\System32\KERNELBASE.dll 6.2.9200.22141
user32.dll C:\Windows\System32\user32.dll 6.2.9200.22030
msvcrt.dll C:\Windows\System32\msvcrt.dll 7.0.9200.16384
imagehlp.dll C:\Windows\System32\imagehlp.dll 6.2.9200.16745
shlwapi.dll C:\Windows\System32\shlwapi.dll 6.2.9200.16384
gdi32.dll C:\Windows\System32\gdi32.dll 6.2.9200.22139
hpmsn196.dll C:\Windows\System32\spool\drivers\x64\3\hpmsn196.dll 0.3.1584.22169
winmm.dll C:\Windows\System32\winmm.dll 6.2.9200.16645
comctl32.dll C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9200.17359_none_776323af3178557f\comctl32.dll 5.82.9200.17359
winspool.drv C:\Windows\System32\winspool.drv 6.2.9200.16384
advapi32.dll C:\Windows\System32\advapi32.dll 6.2.9200.22005
shell32.dll C:\Windows\System32\shell32.dll 6.2.9200.17464
ole32.dll C:\Windows\System32\ole32.dll 6.2.9200.22141
oleaut32.dll C:\Windows\System32\oleaut32.dll 6.2.9200.22141
psapi.dll C:\Windows\System32\psapi.dll 6.2.9200.16384
version.dll C:\Windows\System32\version.dll 6.2.9200.16384
activeds.dll C:\Windows\System32\activeds.dll 6.2.9200.16384
ws2_32.dll C:\Windows\System32\ws2_32.dll 6.2.9200.21858
winhttp.dll C:\Windows\System32\winhttp.dll 6.2.9200.21858
msimg32.dll C:\Windows\System32\msimg32.dll 6.2.9200.16384
dbghelp.dll C:\Windows\System32\dbghelp.dll 6.2.9200.16384
WINMMBASE.dll C:\Windows\System32\WINMMBASE.dll 6.2.9200.16645
sechost.dll C:\Windows\System32\sechost.dll 6.2.9200.16384
rpcrt4.dll C:\Windows\System32\rpcrt4.dll 6.2.9200.21826
combase.dll C:\Windows\System32\combase.dll 6.2.9200.22141
adsldpc.dll C:\Windows\System32\adsldpc.dll 6.2.9200.16384
nsi.dll C:\Windows\System32\nsi.dll 6.2.9200.16384
cfgmgr32.dll C:\Windows\System32\cfgmgr32.dll 6.2.9200.16384
devobj.dll C:\Windows\System32\devobj.dll 6.2.9200.16384
Wldap32.dll C:\Windows\System32\Wldap32.dll 6.2.9200.16384
NapiNSP.dll C:\Windows\System32\NapiNSP.dll 6.2.9200.16384
nlaapi.dll C:\Windows\System32\nlaapi.dll 6.2.9200.17199
mswsock.dll C:\Windows\System32\mswsock.dll 6.2.9200.21858
dnsapi.dll C:\Windows\System32\dnsapi.dll 6.2.9200.17623
winrnr.dll C:\Windows\System32\winrnr.dll 6.2.9200.16384
IPHLPAPI.DLL C:\Windows\System32\IPHLPAPI.DLL 6.2.9200.16420
winnsi.dll C:\Windows\System32\winnsi.dll 6.2.9200.16384
FWPUCLNT.DLL C:\Windows\System32\FWPUCLNT.DLL 6.2.9200.16634
rasadhlp.dll C:\Windows\System32\rasadhlp.dll 6.2.9200.16384
riched20.dll C:\Windows\System32\riched20.dll 5.31.23.1230
usp10.dll C:\Windows\System32\usp10.dll 6.2.9200.16384
msls31.dll C:\Windows\System32\msls31.dll 3.10.349.0
CRYPTBASE.dll C:\Windows\System32\CRYPTBASE.dll 6.2.9200.16384
bcryptPrimitives.dll C:\Windows\System32\bcryptPrimitives.dll 6.2.9200.21952
webio.dll C:\Windows\System32\webio.dll 6.2.9200.21797
sspicli.dll C:\Windows\System32\sspicli.dll 6.2.9200.21703
clbcatq.dll C:\Windows\System32\clbcatq.dll 2001.12.10130.16384
msxml3.dll C:\Windows\System32\msxml3.dll 8.110.9200.22069

[astanton1978]

No, its not "usual new computer activity."

This is happening on production print servers, and its definitely an HP issue

Related issue here

[astanton1978]

This forum software does not understand multiple browser tabs. I had a tab open and replying to a different issue and it posted on this one instead. 

[sdunnBIG]

Ashton1978, I also had the same problem as you, and I think I just found my solution. I found this which is exactly the same thing you and I were having trouble with. If you go into the printer in question on your server, look at "Device Settings" and scroll down until you find "Printer Status Notification". The offending printer in my case had this enabled. This may be the key you were looking for. 

Hope this helps!