Malware ?

daopa · May 3, 2026

After some hair pulling scenes, I ran MSRT, twice and it twice died at :

Windows System32\rasadhlp.dll.

What gives ? Should there be something to do to it ?

I am all eyes and have a nice day. Daopa

WindowsForum AI · May 3, 2026

Hi Daopa,
What gives is usually this:
rasadhlp.dll is a legitimate Windows system file. It is related to Remote Access / dial-up / VPN helper functions. If MSRT stops or crashes when it reaches that file, it does not automatically mean the file is malware.

First answer

No, do not delete or manually replace rasadhlp.dll just because MSRT stopped there.
The more likely causes are:

MSRT itself is hanging or crashing while scanning that file.
The file or Windows component store may be corrupted.
A third-party security tool may be interfering.
If the file is not in the normal Windows folder, then it may be suspicious.

Before doing repairs

Create a restore point.
If you have important files, make a quick backup first.

Step 1: Confirm the file location

The normal file is usually here:
C:\Windows\System32\rasadhlp.dll
On 64-bit Windows you may also see one under:
C:\Windows\SysWOW64\rasadhlp.dll

Check it

Open File Explorer.
Browse to C:\Windows\System32.
Find rasadhlp.dll.
Right-click it > Properties.
Open the Digital Signatures tab.

You want to see Microsoft Windows or Microsoft Corporation as signer.
If the file is somewhere else, or has no Microsoft signature, tell me immediately.

Step 2: Repair Windows system files

Open Command Prompt as Administrator and run these commands one at a time:
DISM /Online /Cleanup-Image /RestoreHealth
Wait for it to finish, then run:
sfc /scannow

Expected result

DISM repairs the Windows component store.
SFC checks system files and repairs bad copies.

If either command reports errors, post the exact message.

Step 3: Don’t rely only on MSRT

MSRT is useful, but it is not the main Windows malware scanner.
Run Microsoft Defender Offline:

Open Windows Security.
Go to Virus & threat protection.
Click Scan options.
Choose Microsoft Defender Offline scan.
Start the scan.

This is often better when malware is suspected.

Step 4: Check the MSRT log

MSRT writes a log here:
C:\Windows\Debug\MRT.log

Check it

Press Win + R.
Type:

notepad C:\Windows\Debug\MRT.log

Look at the last lines.

If you want, copy the last 20 to 30 lines into your next reply.

Step 5: Try MSRT again after a clean boot

Sometimes antivirus or startup tools interfere.

Press Win + R.
Type msconfig
On the Services tab, tick Hide all Microsoft services.
Click Disable all.
On the Startup tab, open Task Manager.
Disable startup items.
Restart.
Run MSRT again.

Undo

Open msconfig again.
Re-enable normal startup items and services.

Step 6: A quick malware sanity check

Also run:
mrt /f:y
That forces a fuller scan. If it still dies at the same spot, that points more toward MSRT trouble or file corruption than a confirmed infection.

My best read so far

Based on what you wrote, I suspect one of these two:

Corrupted Windows file/component store
MSRT choking on a legitimate system DLL

Not my first guess: active malware in rasadhlp.dll.

What I would do in your place

Check the file’s exact location and digital signature.
Run DISM and SFC.
Run Defender Offline.
Read C:\Windows\Debug\MRT.log.

Please reply with these 3 items

The exact full path of the rasadhlp.dll that MSRT stopped on.
Whether the file shows a Microsoft digital signature.
The final result of:

Code:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

If you post those, I can tell you the next safe step without any more hair-pulling.

daopa · May 3, 2026

Chat, hello. I am following you instructions', way ove my head.

WindowsForum AI · May 3, 2026

Of course, Daopa — let’s make it very simple.
You are dealing with MSRT stopping at C:\Windows\System32\rasadhlp.dll.

The short version

Do not touch that file.
Do not delete anything.
Let’s do one easy check only.

Please do just this

Open Windows Security.
Click Virus & threat protection.
Click Quick scan.
Wait for it to finish.
Tell me one of these two things:
No threats found
Threats found

Why this is the best next step

It is safe.
It is easy.
It tells us whether this looks like a real malware problem, without asking you to use difficult commands.

For now

Ignore MSRT.
Do not worry about rasadhlp.dll yet.
Just run the Quick scan and report back.

If you want, after that I can guide you one click at a time, with no technical jargon.

daopa · May 5, 2026

Chat, good morning.
I followed all you instructions and mostly got " nothing found "
So in despair, I went to my other machine and an MSRT on it good. It completed.
So to help my cause I did a clone of that machine and it was total success. Talk about being lucky.
Now I can leave you alone !

Do tell me how I can undo typos ? It iks me to leave bad text.
Thanks a mega.

WindowsForum AI · May 5, 2026

Good morning, Daopa — and that is excellent news.
You do not have to leave me alone after a success story; those are the nice ones. Well done on getting the clone done and ending the headache.

About the typos

If you mean while you are still typing, use:

Ctrl + Z = undo the last typing change.
Ctrl + Y = redo.
On some programs, Ctrl + Shift + Z also redoes.

If the message is already posted on the forum

Look for an Edit button under your post.
Click Edit.
Correct the text.
Click Save.

If there is no Edit button

That usually means one of these:

The forum allows editing only for a limited time.
The post has already passed the edit window.
You may need to add a short follow-up correction post.

Easy typo tips

Type your message in Notepad first if you want to proofread calmly.
Then copy and paste it into the forum.
Most browsers also underline misspelled words in red.
Right-click the underlined word to see suggested corrections.

One small note on your fix

Since the cloned system is now working, that strongly suggests the original problem was with the old Windows installation rather than proof of active malware. So your result makes sense.
Glad this ended happily, Daopa. If you want, I can also show you a very simple way to enable spell check in your browser so typos get caught before you post.

daopa · Sunday at 10:04 AM

Chat, good moRning.
I got the machine to moRe oRless a woRking state. I will take a Rest now and let you be. I have heRe 2 DDS, both of 1TB. The machine boots on the mechanical HD and it has not been damaged by this update the flushed my task baR and I am unable to boot fRom the NVMe that is D when the otheR is C, tRy as I might. I have pulled the logic cable on the mechanical HD so it boots fRom the fast NVMe.
WRite at you late. J.

WindowsForum AI · Sunday at 10:05 AM

Good morning, J. I’m glad you have the machine more or less working. Please take your well-earned rest.
From your description:

The mechanical hard drive boots normally when connected.
The NVMe appears as D: when Windows starts from the mechanical drive.
Disconnecting the mechanical drive’s SATA data cable allows the computer to boot from the faster NVMe.

That is encouraging: the NVMe installation is probably still bootable. The BIOS/UEFI may simply be choosing the mechanical drive first. Also, drive letters such as C: and D: can change depending on which Windows installation starts—this is normal.
For now:

Do not format or erase either drive.
Leave the computer in its currently working arrangement.
When you return, we can identify the correct Windows Boot Manager and make the NVMe the first boot choice.
After that, we can reconnect the mechanical drive and use it for storage or backup.

Rest first; we will tackle it calmly when you are ready.

daopa · Sunday at 12:43 PM

daopa said:
After some hair pulling scenes, I ran MSRT, twice and it twice died at :

Windows System32\rasadhlp.dll.

What gives ? Should there be something to do to it ?

I am all eyes and have a nice day. Daopa

Chat, I just noticed that this R problem started after 3rd May. I am using ASCII 114 to have the proper character here; see r .

Messrs · 2026-08-18T17:04:56-0400

Hello, I having exactly same issue with System32\rasadhlp.dll
Windows update on, security update on. Also no other antivirus software.
DISM /Online /Cleanup-Image /RestoreHealth completed.
sfc/scannow have no issue.
Disk healthy, memory double pass.
Windows security - Custom scan worked fine, I did full custom scan all my disk volume and found no issue.
Windows security - Quick scan failed with event ID7023 ID7031.
Microsoft defender offline scan stuck at 91, had to manually close to reboot.

Not sure what to do now, I am also all ears looking for the solutions.
Have a nice day.

WindowsForum AI · 2026-08-18T17:14:01-0400

Hello Messrs. Your results suggest a Defender scan/service problem rather than proof that rasadhlp.dll is infected. The filename shown when a scan stops is often merely the last file displayed.
Also, Event IDs 7023 and 7031 are generic Service Control Manager events. We need the service name and error text from their General tab.

1. Update Defender and restart

Open Windows Security.
Select Virus & threat protection.
Under Virus & threat protection updates, select Protection updates.
Select Check for updates.
Restart Windows.
Try one Quick scan.

2. Check the correct Defender log

Press Win + R.
Enter eventvwr.msc and press Enter.
Open Applications and Services Logs.
Open Microsoft > Windows > Windows Defender > Operational.
Find events occurring at the exact time the Quick scan failed.

Relevant scan events include:

1000 — scan started
1001 — scan completed
1002 — scan stopped before completion

Please post the Event ID and complete General-tab message for the failure. Do the same for System events 7023 and 7031, including the named service.

3. Check Defender services

The exact PowerShell diagnostic cannot be shown as a live demo here, so please copy it as text.

Right-click Start.
Select Terminal (Admin).
Paste this command and press Enter:

Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status

Normally, WinDefend, WdFilter, SecurityHealthService, and wscsvc should be running. It is normal for WdBoot to show Stopped after Windows has booted.

4. For now, do not modify `rasadhlp.dll`

Do not delete, rename, replace, or exclude:
C:\Windows\System32\rasadhlp.dll
Because DISM and SFC passed and a complete custom disk scan found nothing, there is currently no strong evidence that this DLL is malicious.
Please reply with:

The complete 7023 General-tab message.
The complete 7031 General-tab message.
Any Defender Operational event around the failure.
The output from the PowerShell service command.

Those details will tell us whether the Defender engine, Windows Security service, or another service is crashing.

Navigation section

Malware ?

Excellent Member

The short version​

Please do just this​

Why this is the best next step​

AI

First answer​

Before doing repairs​

Step 1: Confirm the file location​

Check it​

Step 2: Repair Windows system files​

Expected result​

Step 3: Don’t rely only on MSRT​

Step 4: Check the MSRT log​

Check it​

Step 5: Try MSRT again after a clean boot​

Undo​

Step 6: A quick malware sanity check​

My best read so far​

What I would do in your place​

Please reply with these 3 items​

Excellent Member

AI

The short version​

Please do just this​

Why this is the best next step​

For now​

Excellent Member

AI

About the typos​

If the message is already posted on the forum​

If there is no Edit button​

Easy typo tips​

One small note on your fix​

Excellent Member

AI

Excellent Member

Member

AI

1. Update Defender and restart​

2. Check the correct Defender log​

3. Check Defender services​

4. For now, do not modify rasadhlp.dll​

Similar threads

The short version

Please do just this

Why this is the best next step

First answer

Before doing repairs

Step 1: Confirm the file location

Check it

Step 2: Repair Windows system files

Expected result

Step 3: Don’t rely only on MSRT

Step 4: Check the MSRT log

Check it

Step 5: Try MSRT again after a clean boot

Undo

Step 6: A quick malware sanity check

My best read so far

What I would do in your place

Please reply with these 3 items

The short version

Please do just this

Why this is the best next step

For now

About the typos

If the message is already posted on the forum

If there is no Edit button

Easy typo tips

One small note on your fix

1. Update Defender and restart

2. Check the correct Defender log

3. Check Defender services

4. For now, do not modify `rasadhlp.dll`