Printable View
In my ZoneAlarm programs, I have a listing for, "Run a DLL as an App."
Product Name: Run DLL as an App.
File Name: C:\Windows\Rundll32.exe
Any reason why this would be there. Never seen before. (?)
It's not normal for a DLL to want to access the net is it?
Thanks...
I doubt you claim to posting that as a fact. Zonelabs would like to hear from you also.
mach
Chould it be spyware using it?
This guy did a search on the url that rundll was accessing.
Turns out in his case the url was "www.new.net" and the rundll was acessing an auto-update server for New.net applications.
http://www.faqchest.com/msdn/winnt-l...421_32400.html
Scroll down to........
Date: Sat, 4 Aug 2001 15:44:59 -0400
From: Bob Belas <[PRIVACY PROTECTION]>
Subject: Re: Rundll answer
I'm not quite sure as to the meaning of your post, Mach.Quote:
Originally posted by MACH2
I doubt you claim to posting that as a fact. Zonelabs would like to hear from you also.
mach
If you are questioning my post as factual, I assure you I dont come to VrDr. to play silly games. And leave it at that. If you would like a snapshot of the ZA 'programs' from my computer ask and instruct me how to upload to this site. I would have print screen and done that if I knew the how to's of doing that.
VirtualMe. I really dont know. That's why I have this post here. Maybe to get some answers and direction on what or where to proceed. The link sounds like my situation. I havent had any unusual problems. But would like direction from some on what to do about it.
AdAware and AVG show no problems.
Hi carson - lets have a look at your startups. Go to Start > Run and type
msinfo32
On the left side, select software environment and then Startup Programs.
Then go to Edit > Select All
And then Edit > Copy
Then paste the list back into this thread.
Here they are.
ScanRegistry Registry (Machine Run) C:\WINDOWS\scanregw.exe /autorun
SystemTray Registry (Machine Run) SysTray.Exe
That's it. Tried to copy ZA - programs page but couldnt.
Thats OK, I think we will have to delve a bit deeper. Go here and download and run StartUp Log. Its just a little program and it will generate a log file. Can you please paste the log file back into this thread (as an attachment).
carson,
Rundll32.exe is part of MS's Win 98 OS and appears not only in my Zone Alarm Programs' list but also 3 times in System Config. Utility Startup (against LoadPowerProfile, Tweak UI and Nvidia Display Adapter); if you do a Cntrl+Alt+Delete you will also see it featured there.
I am running Win 98SE and the version of Rundll32.exe I have is 4.10.1998.
What part it plays in the scheme of things and why it (Run a DLL as an App) happens to be in the Zone Alarm list, I wouldn't have a clue but suffice to say I do not recollect ZA ever asking whether I wished to allow it to access the Internet (I have it on 'Always Ask Permission' settings).
Perhaps someone will come along to throw some light on its actual function but, IMHO, it is nothing to worry about.
I have seen that particular message before in ZA. I had installed a Ms Agent related program. It tried to access the internet, later I found out it was adware was trying to download ads to show me. I disallowed access via ZA. Then it used rundll32 to run a dll to then try to access the internet. It certainly did try to get out, I disallowed it also. I got rid of the program, can't remember the name or the dll it used at this time. Though I am sure it started with a R, may have been Rnasmm.dll.
I gotta hand it to ZA for blocking access.
carson--Not really much to do with your ZA question, but here is how you post an image on VirtualDr
http://discussions.virtualdr.com/mis...bbcode#imgcode
You do not actually post the image, but rather a link to it. And that link has to be some web storage location like
http://www.webshots.com/homepage.html
which permits access by the public. Just having the image on your PC won't do.
Here you go, with thanks.Quote:
Originally posted by AnnMarie
Thats OK, I think we will have to delve a bit deeper. Go here and download and run StartUp Log. Its just a little program and it will generate a log file. Can you please paste the log file back into this thread (as an attachment).
And thanks to all that for lending time to offer advise.
Guess I can just delete it from ZA programs or "X" on allowances.
carson.
Startlog is clean.
In fact, too clean!!
Where is ZoneAlarm??
Where is your antivirus?
If you are running them manually before you connect to the net, be aware that the whole purpose of ZA starting at boot time, is to allow IT to be installed and active, before anything else gets up and running. If you start it manually, a trojan could start from your startups or elsewhere, and then manage to shutdown ZA, or make it appear that it is active when it is not.
Have you run a full virus scan with updated defs?
And, have you deleted this Rundll from the ZA program list, and then noticed when it reappears, and requests access?
I believe the "Run a DLL as an App" in ZA is related to networking. I know on my home network that unless I give it permission to access, I do not see all my network. This is with a mix of WIN98FE & SE and XPHE - used the XPHE network setup Wizard on the 98 machines. Can't prove it, just speculation on my part, but it was not in list prior to setting up network.
Try this link. It will probably say you don't need the fix. Otherwise, download and install it. It fixes a problem with schannel.dll that might cause your problem.
http://www.microsoft.com/windows/ie/...y/schannel.asp
Thanks for the tip, WhitPhil. I do a lot of stuff off line so I just put the ZA and AVG shortcuts on the desktop so to click them before going online. Trying to save the C\A\D\ time when not going online. So you suggest running at startup. I understand and will go in msconfig and recheck them.Quote:
Originally posted by WhitPhil
Startlog is clean.
In fact, too clean!!
Where is ZoneAlarm??
Where is your antivirus?
If you are running them manually before you connect to the net, be aware that the whole purpose of ZA starting at boot time, is to allow IT to be installed and active, before anything else gets up and running. If you start it manually, a trojan could start from your startups or elsewhere, and then manage to shutdown ZA, or make it appear that it is active when it is not.
Have you run a full virus scan with updated defs?
And, have you deleted this Rundll from the ZA program list, and then noticed when it reappears, and requests access?
I have the updated AVG and it has found no problems. I havent deleted the program from the ZA programs just in case I had to prove my sincerity about it being there.
Wino, thanks, but I'm not networking.
jerryctx, thanks, will try the link.
Again, thanks to everyone for the help.
Just remembered, about a month ago my AVG poped up with a warning about a possible virus trying to be added to my Temporary Internet folder, to which I had AVG to delete and after the scan showed clean.This tried to load from just clicking a link from a page on the net. Maybe that is when it appeared in the programs.
Dont know for sure...thanks all...
carson.
If my memory serves me correctly, I think my Ad-Aware program determined rundll32.exe to be spyware? Do you use KaZaa, because there is something in that program that AdAware identifies as spyware, too, even in the "clean" copy.
I had the same entry in my ZA Programs page (rundll32.exe as an app) and after reading this:
http://www.thescarms.com/VBasic/rundll.asp
I am sure it came with a program called 1St Clock that was designed to sycronize your time/date with any one of a number of servers that used time generated by an atomic clock. When running 1ST Clock my Date/Time Properties box would pop up.
Leurgy,
I run my Cel366 @ 550. If your MB and ram will support a FSB of 100 MHz, you might think about trying it. My cpu runs cool and has no stability problems and the increase to 550 is
very noticable and appreciated.
Carson,
Go ahead and delete that item from ZA and then if it comes back, you should X it out in ZA and see if any problems develop.
You should install AdAware and let it check you system for spyware. It is a great program and it is free.
This file can be downloaded from
AdAware
I went to theScarms page you suggested, Leurgy. Based on that, it appears that it's not spyware, but it seems that it's what AdAware found. Could that be possible?
Old news, but the following is what I got from ZA regarding the RunDLL when it tried to run.
"Run a DLL as an App is attempting to connect to the Internet or your local network.
ZoneAlarm has stopped RUNDLL32.EXE from connecting to the Internet or your local network. No breach in your security has occurred. Your computer is safe. ZoneAlarm will not allow it access if you don't give it permission. What happened?
ZoneAlarm detected Run a DLL as an App attempting to connect to the Internet or your local network and has asked your permission to allow it access.
Run a DLL as an App has attempted to connect to the network before.
Who is this?
Should I be concerned?
No, it is normal behavior for Run a DLL as an App to request Internet access though conditions apply. Refer to the Details section for additional information.
Details
What should I do?
Run a DLL as an App does not require Internet access to perform any functions. It is not necssary to grant this application Internet access."
psny513:
Could rundll32 be spyware? I don't know, sounds like a good one for the Internet Security forum.
Buffalo:
Thanks for the info, nice to hear from another satisfied user. When I bought this machine it was new (November, 1999, a graduation present to myself, after completing MicroComputer Maintenance and Support, a seven month, full time course at a local College) and a lot of people advised against a Celeron. I am still happy with my choice.
I'm going to start a thread in the Hardware forum concerning your suggestion about overclocking, as I have tried it, and it doesn't seem to work. Maybe you can have some input, and if so, thanks.