Re: Can a DLL be a virus?

From: Ian Kenefick (flick_at_iol.ie)
Date: 05/03/04 

Date: Mon, 03 May 2004 22:32:05 +0100

cquirke (MVP Win9x) wrote:

> On Mon, 03 May 2004 17:01:40 +0100, Ian Kenefick <flick@iol.ie> wrote:
>
>
>> to answer your question about a dll being a virus.
>
>
> Yes, .DLL can be viral in various ways...
> - existing .DLL infected by Win32 code infector
> - pure malware .DLLs that form part of the malware
> - pure malware .DLLs that *are* the malware
>
> RATs like to use .DLL, getting these to run when Windows starts via
> RunDLL.exe or RunDLL32.exe - as they then pass through firewalls via
> the RunDLL "wrapper" that's usually known and accepted by the firewall
>
>
>
>>-- Risk Management is the clue that asks:
>
> "Why do I keep open buckets of petrol next to all the
> ashtrays in the lounge, when I don't even have a car?"
>
>>----------------------- ------ ---- --- -- - - - -
Good answer ;-)

Relevant Pages

  • Re: .Net packaging/wrapper application?
    ... it just didn't work well in reality due to DLL ... Windows works is to look in the executable's directory for a needed DLL ... the way apps used to work when they developed Windows. ... Looks to me like Jim is looking for the .NET equivalent of compiling ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Unnown process... 5eplorer.exe
    ... do not remove the cause (a "super"-hidden .dll program) but only remove ... symptom files and registry settings. ... It has all permissions but 'copy' denied to everyone, ... then by using the Windows XP Recovery Console. ...
    (microsoft.public.win2000.general)
  • Re: WinSxS, functional under 2k ?
    ... The newSide-by-Side Assembly technology was introduced with Windows XP to help reduce or eliminate DLL Hell. ... If you recall earlier Windows versions, like Windows 95, when you installed an application you were warned if the installer tried to replace a DLL from the system folder with an older version and you were asked if you wanted to accept the change. ... Until Windows XP it wasn't so easy to use different versions of shared system DLLs, that is what the new Side-by-Side assemblies attempts to resolve. ...
    (microsoft.public.win2000.general)
  • rundll.32
    ... Microsoft's "Run a DLL as an App". ... RUNDLL and RUNDLL32 are the Microsoft Windows ... you have a virus. ...
    (microsoft.public.windowsxp.help_and_support)
  • rundll32.exe
    ... Microsoft's "Run a DLL as an App". ... RUNDLL and RUNDLL32 are the Microsoft Windows ... you have a virus. ...
    (microsoft.public.windowsxp.general)