Printable View
In my ZoneAlarm programs, I have a listing for, "Run a DLL as an App."
Product Name: Run DLL as an App.
File Name: C:\Windows\Rundll32.exe
Any reason why this would be there. Never seen before. (?)
It's not normal for a DLL to want to access the net is it?
Thanks...
I doubt you claim to posting that as a fact. Zonelabs would like to hear from you also.
mach
Chould it be spyware using it?
This guy did a search on the url that rundll was accessing.
Turns out in his case the url was "www.new.net" and the rundll was acessing an auto-update server for New.net applications.
http://www.faqchest.com/msdn/winnt-l...421_32400.html
Scroll down to........
Date: Sat, 4 Aug 2001 15:44:59 -0400
From: Bob Belas <[PRIVACY PROTECTION]>
Subject: Re: Rundll answer
I'm not quite sure as to the meaning of your post, Mach.Quote:
Originally posted by MACH2
I doubt you claim to posting that as a fact. Zonelabs would like to hear from you also.
mach
If you are questioning my post as factual, I assure you I dont come to VrDr. to play silly games. And leave it at that. If you would like a snapshot of the ZA 'programs' from my computer ask and instruct me how to upload to this site. I would have print screen and done that if I knew the how to's of doing that.
VirtualMe. I really dont know. That's why I have this post here. Maybe to get some answers and direction on what or where to proceed. The link sounds like my situation. I havent had any unusual problems. But would like direction from some on what to do about it.
AdAware and AVG show no problems.
Hi carson - lets have a look at your startups. Go to Start > Run and type
msinfo32
On the left side, select software environment and then Startup Programs.
Then go to Edit > Select All
And then Edit > Copy
Then paste the list back into this thread.
Here they are.
ScanRegistry Registry (Machine Run) C:\WINDOWS\scanregw.exe /autorun
SystemTray Registry (Machine Run) SysTray.Exe
That's it. Tried to copy ZA - programs page but couldnt.
Thats OK, I think we will have to delve a bit deeper. Go here and download and run StartUp Log. Its just a little program and it will generate a log file. Can you please paste the log file back into this thread (as an attachment).
carson,
Rundll32.exe is part of MS's Win 98 OS and appears not only in my Zone Alarm Programs' list but also 3 times in System Config. Utility Startup (against LoadPowerProfile, Tweak UI and Nvidia Display Adapter); if you do a Cntrl+Alt+Delete you will also see it featured there.
I am running Win 98SE and the version of Rundll32.exe I have is 4.10.1998.
What part it plays in the scheme of things and why it (Run a DLL as an App) happens to be in the Zone Alarm list, I wouldn't have a clue but suffice to say I do not recollect ZA ever asking whether I wished to allow it to access the Internet (I have it on 'Always Ask Permission' settings).
Perhaps someone will come along to throw some light on its actual function but, IMHO, it is nothing to worry about.
I have seen that particular message before in ZA. I had installed a Ms Agent related program. It tried to access the internet, later I found out it was adware was trying to download ads to show me. I disallowed access via ZA. Then it used rundll32 to run a dll to then try to access the internet. It certainly did try to get out, I disallowed it also. I got rid of the program, can't remember the name or the dll it used at this time. Though I am sure it started with a R, may have been Rnasmm.dll.
I gotta hand it to ZA for blocking access.
carson--Not really much to do with your ZA question, but here is how you post an image on VirtualDr
http://discussions.virtualdr.com/mis...bbcode#imgcode
You do not actually post the image, but rather a link to it. And that link has to be some web storage location like
http://www.webshots.com/homepage.html
which permits access by the public. Just having the image on your PC won't do.
Here you go, with thanks.Quote:
Originally posted by AnnMarie
Thats OK, I think we will have to delve a bit deeper. Go here and download and run StartUp Log. Its just a little program and it will generate a log file. Can you please paste the log file back into this thread (as an attachment).
And thanks to all that for lending time to offer advise.
Guess I can just delete it from ZA programs or "X" on allowances.
carson.
Startlog is clean.
In fact, too clean!!
Where is ZoneAlarm??
Where is your antivirus?
If you are running them manually before you connect to the net, be aware that the whole purpose of ZA starting at boot time, is to allow IT to be installed and active, before anything else gets up and running. If you start it manually, a trojan could start from your startups or elsewhere, and then manage to shutdown ZA, or make it appear that it is active when it is not.
Have you run a full virus scan with updated defs?
And, have you deleted this Rundll from the ZA program list, and then noticed when it reappears, and requests access?
I believe the "Run a DLL as an App" in ZA is related to networking. I know on my home network that unless I give it permission to access, I do not see all my network. This is with a mix of WIN98FE & SE and XPHE - used the XPHE network setup Wizard on the 98 machines. Can't prove it, just speculation on my part, but it was not in list prior to setting up network.
Try this link. It will probably say you don't need the fix. Otherwise, download and install it. It fixes a problem with schannel.dll that might cause your problem.
http://www.microsoft.com/windows/ie/...y/schannel.asp
Thanks for the tip, WhitPhil. I do a lot of stuff off line so I just put the ZA and AVG shortcuts on the desktop so to click them before going online. Trying to save the C\A\D\ time when not going online. So you suggest running at startup. I understand and will go in msconfig and recheck them.Quote:
Originally posted by WhitPhil
Startlog is clean.
In fact, too clean!!
Where is ZoneAlarm??
Where is your antivirus?
If you are running them manually before you connect to the net, be aware that the whole purpose of ZA starting at boot time, is to allow IT to be installed and active, before anything else gets up and running. If you start it manually, a trojan could start from your startups or elsewhere, and then manage to shutdown ZA, or make it appear that it is active when it is not.
Have you run a full virus scan with updated defs?
And, have you deleted this Rundll from the ZA program list, and then noticed when it reappears, and requests access?
I have the updated AVG and it has found no problems. I havent deleted the program from the ZA programs just in case I had to prove my sincerity about it being there.
Wino, thanks, but I'm not networking.
jerryctx, thanks, will try the link.
Again, thanks to everyone for the help.
Just remembered, about a month ago my AVG poped up with a warning about a possible virus trying to be added to my Temporary Internet folder, to which I had AVG to delete and after the scan showed clean.This tried to load from just clicking a link from a page on the net. Maybe that is when it appeared in the programs.
Dont know for sure...thanks all...
carson.