[computer help] What does the program rundll32 do?

[RangerWickett]

I've been having a lot of annoying frikkin' pop-ups lately, and people in the meta forum haven't replied fast enough, so I was hoping someone here could help me out. I kept trying to Ctrl-Alt-Delete to close unnecessary programs so I could try to figure out what was going on. Whenever a pop-up opens up, I see that there's a program called rundll32 running, and I want to know what it does. If it's something necessary for my computer, I'll be back to square one. But otherwise I'll track down the frikkin file and kill it with a rusted spoon.

 

[Maldur]

I have no Idea!

But, have you tried running adaware?!

(btw why oops in the Phone for piratecat thread)

 

[Alzrius]

I'm no computer expert, but a quick Google search under "popups rundll32" should give you something to work with. I did this and found some page talking something about a "SirCam worm" in the computer. Get more info though before doing anything rash.

And you know better than putting this here than in the Software & Computers forum. Bad Wickett! Bad!

 

[MerricB]

RunDLL32 is a system file that Windows needs! Don't delete it!

Programs written with Visual Basic and similar use it. Your pop-ups probably qualify, but are themselves not rundll32.exe

Cheers!

 

[Saeviomagy]

Rundll32 runs .dll files as executables.
What it's actually DOING is entirely dependant upon what .dll file it is running.
It can do anything from call up the control panel, to shut down your system, to add tweakUI to your control panel, to run any nefarious program someone wants.

I'd suggest you take a look in your registry, under

hkey_local_machine\software\microsoft\windows\currentversion\run
hkey_local_machine\software\microsoft\windows\currentversion\runonce
hkey_current_user\software\microsoft\windows\currentversion\run
hkey_current_user\software\microsoft\windows\currentversion\runonce

(note that the second-to-last-part of those is "currentversion", there are not supposed to be linebreaks...)

each contains a list of things which start on your system at boot.

Chances are, if rundll32 is ALWAYS running, then it's being called from somewhere in those. The full command line for rundll32 is what you want to look at.

Also - to the best of my knowledge, VB uses a file entitled vbrunXX.dll, and shouldn't require rundll32 at all. Certainly not for popup windows.

 

[ced1106]

Try out Panicware.com's Pop-Up Stopper.


Cedric.
aka. Washu! ^O^

 

[RangerWickett]

The oops in that other thread was because I inadvertently hit reply instead of new thread.

And I ran ad-aware, and got rid of some stuff, but this is still happening.

Do you know what 'internat' is, and what it does? I'm using Windows 98, second edition, for the record.

I can, . . . um, try to do that registry thing . . . but how do I do it, and what am I looking for? Thanks for the quick replies, by the way.

 

[fba827]

<snip>
I can, . . . um, try to do that registry thing . . . but how do I do it, and what am I looking for? Thanks for the quick replies, by the way.

If you've never edited your registry before, I'd caution you to be very very careful ... (and if you're computer setup allows you to make a backup of important system files, make one before you edit.)

Start -> Run -> type in "regedit"

(another way to make a backup of it is once you open up regedit, do the Registry -> Export to save it to floppy)

if i've made you even slightly paranoid about opening your registry and editing, that is the intent -- proceed with caution. noth that you can't/shouldn't .. just, once unintended _anything_ in the registry causes issues...

 

[Gizzard]

I assume you didnt download anything like "Helpful Happy Desktop Clock Helper"? Something that claims to provide some minor, useful functionality? Like "Improve your Toolbar!" There are plenty of harmless looking things you can DL that really are rather sinister in terms of what they actually do once they get onto your machine. (Remember, there is no free lunch. Ask why someone wants you to DL their software before you do.)

Ad-aware is a good thing for ferreting out this stuff, though it probably wont be on top of the latest scams.

Another useful thing is they Symantec website. They have a collection of all the worms, trojans and other bad things that you might get infected with. If theres anything distinct about what you are seeing your machine do you might take a search for it there. If nothing else, it might be good for you to scan through some of the lastest trojan reports and see how those things are spread.

 

[RangerWickett]

One interesting thing I noticed is . . . okay, do any of you have a little icon in the taskbar on the bottom right of the screen, next to the clock, that determines your local language settings? For instance, mine is a light green square that has "En" in it, for English. I never use it, though I got it as an update from the Windows Update site . . . oh, two or three years ago, when I wanted to be able to read non-Roman alphabetical language pages (like Japanese).

Anyway, when I open up IE now, I go from having one icon to two icons, both identical. It's a bit strange, no?

Then again, most computers more than a year old end up having quirks, simply because of how many weird things we do to them. I'm just glad mine is still running smoothly.