How Important is rundll32.exe?

[Comatose]

Basically, My question is this:

Is rundll32.exe ESSENTIAL to the OS, Or is it just a nice tool to have, that you could actually function without? I mean, would it be possible to rename completely, or even remove it, or does windows actually load files with it?

[1o0oBhP]

I think i've accidentally ctrl-alt-deleted it away before but it was loaded again a while later. Seems it interfaces windows with its DLLs (as dlls are full of compiled code) as a runtime sorta thing! -> as you can see im just going by the name! run<B>DLL</B>32 :)

[Comatose]

Yeah, I know it loads DLL into Memory for use with programs. I'm just not so sure that WINDOWS requires it. I know that a TON of spyware and adware is run as DLL files... so, if I could completely disable rundll32.exe (which loads a lot of the spyware dll's) then I could effectively stop the dll's from loading (things like bho's) while I remove them manually (or with a small peice of code that I'd write).

[pcpalct]

Lets see if this explanation suffices

Microsoft Windows 95, Windows 98, and Windows Millennium Edition (Me) contains two command-line utility programs named Rundll.exe and Rundll32.exe that allow you to invoke a function exported from a DLL, either 16-bit or 32-bit. However, Rundll and Rundll32 programs do not allow you to call any exported function from any DLL. For example, you can not use these utility programs to call the Win32 API (Application Programming Interface) calls exported from the system DLLs. The programs only allow you to call functions from a DLL that are explicitly written to be called by them. This article provides more details on the use of Rundll and Rundll32 programs under the Windows operating systems listed above.

MIcrosoft Windows NT 4.0, Windows 2000, and Windows XP ship with only Rundll32. There is no support for Rundll (the Win16 utility) on either platform.

The Rundll and Rundll32 utility programs were originally designed only for internal use at Microsoft. But the functionality provided by them is sufficiently generic that they are now available for general use. Note that Windows NT 4.0 ships only with the Rundll32 utility program and supports only Rundll32.

[1o0oBhP]

crystal clear! :)

[Comatose]

*wipes his forehead*

whew.

Thanks.

[pcpalct]

Any time :lol:

[1o0oBhP]

I suppose the next logical question is how to write a DLL SPECIFICALLY for rundll32 (i CAN write a dll....) lol keep going pcpalct;)

[Comatose]

Well I can certainly code a dll, but for rundll32.exe is a whole different discussion

[1o0oBhP]

I do not understand how you can write a DLL specifically FOR a certain exe? and Why you would want to MAKE a DLL depend on rundll32? therefore im not going to ask :p my dlls work fine at the moment without NEEDING rundll32 :)

[Comatose]

After Taking The plunge, and going ahead and deleting rundll32.exe, I found some things in the system DID NOT WORK. So, it turns out that the OS (WINDOWS) actually DOES use rundll32.exe. It's not just some program that's fun to have. It wouldn't let me load properties of my computer (right click on my computer, properties) and things of that nature. :)

[pcpalct]

:eek:

lol....told ya so :p
j/k

:cheesy:

[jwenting]

After Taking The plunge, and going ahead and deleting rundll32.exe, I found some things in the system DID NOT WORK. So, it turns out that the OS (WINDOWS) actually DOES use rundll32.exe. It's not just some program that's fun to have. It wouldn't let me load properties of my computer (right click on my computer, properties) and things of that nature. :)

That's what "internal use" means, it's used internally by Windows :p :mrgreen:

[crassus]

I'm sorry if this is a wrong place to ask but I'm becoming desperate.

I removed rundll32.exe from my computer [partly accidently as I thought it was a virus] and now I want it back.

Can I find it somewhere? Search in the internet has not given any results.

[pcpalct]

Usually you can just copy it back into the hard drive from the Windows XP / 2000 CD (provided you either find the file or the cab containing it and extract it to the proper location)

A few creative ways to do this, but too many to list and too little time to formulate them in my head.

Good luck!
:cheesy:

[Comatose]

I'm sorry if this is a wrong place to ask but I'm becoming desperate.

I removed rundll32.exe from my computer [partly accidently as I thought it was a virus] and now I want it back.

Can I find it somewhere? Search in the internet has not given any results.

What Operating system are we talking about?

[caperjack]

I'm sorry if this is a wrong place to ask but I'm becoming desperate.

I removed rundll32.exe from my computer [partly accidently as I thought it was a virus] and now I want it back.

Can I find it somewhere? Search in the internet has not given any results.

If you are using winxp .go to start/run /type in SFC /SCANNOW [ note there is a space between the SFC and the / ]and it should find that rundll32.exe is missing and replace it ,you will need you widows dis in the cdrom for this to work .also if you are not using winxp ,just type in SFC .

Rundll32 .exe can be virus/trojan releated but usually only if its found on the root of C:\ or in a folder outside the System or System32 folders .

To check right click on the file in question and hit properties ,and look for microsoft in the info

[crassus]

Hi,

I'm running win 2000. I typed SFC, but only a black box appeared for a second on the screen. Then I typed the SFC /SCANNOW and it started to check the protected files. After the check it did nothing :( The file can't still be found.

By searching the cd-rom I can find the file there but when clicking it, it doesn't work. Would it help if I would install win 2000 again to the computer? I just don't want to loose all my files and programs :rolleyes:

Only problem is that it won't work as it complains about the product key being wrong. I have a 14 figures key and it wants 25 figures key.

Any other way to get the file?
Now I can see I can't even run any computer setting...

[caperjack]

Hi,

By searching the cd-rom I can find the file there but when clicking it, it doesn't work. Would it help if I would install win 2000 again to the computer? I just don't want to loose all my files and programs :rolleyes:

Don't click on it ,right click and copy it then go to your c:\windows\system folder or system32 folder and paste it into there ,

[crassus]

Still doesn't work. The file is .ex_ Is it the wrong one? In the cd-rom it was under the folder I386. Properties says it is unknown application [? I don't know the word].

[Comatose]

you need to type
expand rundll32.ex_

at a command prompt, or from start/run (expand filename) without the ()

Basically, Expand takes a compressed file and makes it uncompressed for the purposes of installation. So, Expand the file, and then copy to %windir%\system32

[crassus]

Thanks :)

I got the file back and was able to transfer my webpages. The problem was the firewall. I removed whole F-Secure and it started to work. Crazy thing is that it even effected the webmail I used from sendin e-mails... I hope I can manage with the free firewall and virus protection.

[Comatose]

You're Very Welcome, and Good Luck To You With That.

[caperjack]

Thanks :)

I got the file back and was able to transfer my webpages. The problem was the firewall. I removed whole F-Secure and it started to work. Crazy thing is that it even effected the webmail I used from sendin e-mails... I hope I can manage with the free firewall and virus protection.

Links in the following Info to free firewall and virus scanner !!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

1. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

   See this link for a listing of some online & their stand-alone antivirus programs:

   Virus, Spyware, and Malware Protection and Removal Resources

2. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   Antivirus
   
3. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
   FIREWALL

   For a tutorial on Firewalls and a listing of some available ones see the link below:

   Understanding and Using Firewalls

4. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
5. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

   A tutorial on installing & using this product can be found here:

   Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

6. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

   A tutorial on installing & using this product can be found here:

   Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

7. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

   A tutorial on installing & using this product can be found here:

   Using SpywareBlaster to protect your computer from Spyware and Malware

8. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
   

Follow this list and your potential for being infected again will reduce dramatically.