what is rundll32.exe and why does it keep trying to access the internet from my computer?

[Wah]

Zonealarm keeps asking if want to allow "Run DLL as an App" to access the internet? I found the file... rundll32.exe in my windows/system folder.

advice please.

 

[jaywallen]

I'm assuming Win98SE from your profile. My comments are mostly applicable to all Windows versions, Win95 on up.

RUNDLL.EXE and RUNDLL32.EXE are executables designed to take advantage of DLLs that have been specifically written so that certain functions within them can be called from the command line, through the use of RUNDLL.EXE for 16-bit functions and the use of RUNDLL32.EXE for 32-bit functions. (NT4 and W2K only allow use of RUNDLL32.EXE.)

So this means that something along the lines of a batch process, a script, or a registry entry is trying to cause RUNDLL.EXE or RUNDLL32.EXE to either try to access and run something on the Internet, OR it is trying to cause one of the executables to run some other process that wants access to the Internet. Neither one is particularly good if you don't know why it's happening.

This could be quite innocent, like a failed installation that left behind a RUNDLL call that's still trying to run or some application you have on the system which is set to periodically access the Internet to retrieve mail or "phone home". Or it could be something like an attempt by someone or a Trojan to cause your system to establish a connection surreptitiously.

If I were you, I'd find out what's causing it. In addition to checking things like the above-mentioned items, you might get something like the "spyware" detector called Ad-Aware from Lavasoft.

It might be helpful to those reading this thread if you provided us with a little more information. Does this seem to happen in response to something you do as a user? Does it seem to be a response to something else that happens on the system, like receipt of an email or fax or something? Does it happen only at startup? Does it happen over and over again with a regular periodicity? (To help with the troubleshooting, if you've set ZoneAlarm to not ask you any more, you'll need to get rid of the rule so that ZA starts asking you again whenever the phenomenon happens.)

I imagine there are many other possibilities, but I'm not thinking too clearly due to high pollen count and serious quantities of anti-histamines on board!

Please give us more of the sort of information I indicated, and maybe somebody will have a bright idea.

Regards,
Jim

Ooops! Sorry, I meant to include a couple of links to some general info on the RUNDLL functions.

http://support.microsoft.com/support/kb/articles/Q164/7/87.asp

http://www.microsoft.com/TechNet/IE/reskit/ie5/part3/ch18post.asp

Nothing specific to your situation, but some info that mike make a light bulb light up.

 

[Wah]

wow, thanks for such a detailed response!!!
I haven't noticed a pattern on when zonealarm blocks rundll32.exe, but i will take a note of which programs are running when it pops up again.

Thanks again.

 

[jaywallen]

Okay. We'll look forward to seeing what you learn.

Regards,
Jim

 

[Paladinexe]

For a more thorough examination of your harddrive try The Cleaner. It is a 30 day trial so you will have to register to use it afterwards (well there are other ways, but this would be the best).
It also has an active monitor that will "watch" your registry and sound an alarm if something tries to access the registry to add/change things. This could be handy or annoying while surfing depending on your preference for security. The "monitor" can easily be toggled on/off. It also displays what changes are being made to the registry.

Just tested the link and they have a new element. Distributed computing for cancer research. Anyway the link you want is the one labelled simply "Download" on the left side.