Re: More apparent M$ spyware

From: Erik Funkenbusch (erik_at_despam-funkenbusch.com)
Date: 03/28/05 

Date: Mon, 28 Mar 2005 09:45:56 -0600

On 28 Mar 2005 06:51:04 -0800, Yef wrote:

> Second:
>
> rundll32.exe, version 5.1.2600.2180 (xpsp_sp2_rtm.[some #s])
> dest IP = 63.218.7.132 protocol HTTP
> I assume on port 80, as the firewall doesn't say.

> I am guessing that someone is deliberately spying.
> Whether Beyond the Network is actively helping or is just
> a conduit, I cannot determine.
>
> But clearly there is a DLL that is a part of Service Pack 2
> that is the second program trying to send out info.

This is a misunderstanding on your part. RunDLL is not a DLL, as the .exe
on the end of it shows. It's a "host" program that, as the name implies,
"Runs DLL's". It takes a DLL name as a parameter and an entry point
ordinal as the other and calls whatever function that is.

RunDLL is used by all kinds of programs, including third party apps, to
run. RunDLL itself doesn't access the internet, but whatever DLL it's
hosting might.

As an example:

http://www.robvanderwoude.com/index.html

As usual, your "shoot first and ask questions later" approach is wrong.

Relevant Pages

  • rundll.32
    ... Microsoft's "Run a DLL as an App". ... RUNDLL and RUNDLL32 are the Microsoft Windows ... you have a virus. ...
    (microsoft.public.windowsxp.help_and_support)
  • rundll32.exe
    ... Microsoft's "Run a DLL as an App". ... RUNDLL and RUNDLL32 are the Microsoft Windows ... you have a virus. ...
    (microsoft.public.windowsxp.general)
  • RE: rundll32.exe using 99% of my CPU
    ... Microsoft’s “Run a DLL as an App”. ... Microsoft Windows programs that need to be used to load DLLs into memory so ... RUNDLL and RUNDLL32 do not normally appear in the ... software, boot into Safe Mode, and run a full virus scan on your PC. ...
    (microsoft.public.windowsxp.perform_maintain)
  • RE: dll problems
    ... An online virus scan would be a goos idea as well ... Microsoft’s “Run a DLL as an App”. ... Microsoft Windows programs that need to be used to load DLLs into memory so ... RUNDLL and RUNDLL32 do not normally appear in the ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: RunDLL
    ... exported function from that DLL. ... it sounds like RunDLL is attempting to load image.dll and ... call a function in the same way but Windows cannot find image.dll. ... When Windows attempts to load a DLL it will ...
    (microsoft.public.windowsxp.video)