Using Rundll32.exe in Windows XP

ADVERTISEMENT

Author

pradeep ( Team Leader )

Yet to provide details about himself

All articles By pradeep

Recent Articles

• Basics of Pocket PC, Started by sureshvaikuntam in Engineering concepts
• Vogel Approximation Method, Started by Nadr in Engineering concepts
• Behind the Browser !, Started by Bhullarz in Engineering concepts
• The background view of Multicore Computing Technology, Started by Tango Issac Debian in Engineering concepts
• Enabling SSL on IIS with a self-signed certificate, Started by pradeep in Engineering concepts

Similar Articles

• Basic BIOS password crack, Started by vishal sharma in Ethical hacking
• Startup Problems -sys hack, Started by vishal sharma in Ethical hacking
• Windows Environment Variables in VB, Started by shabbir in Visual Basic [VB]

Although they are not directly executable as programs, the many DLL files present in Windows contain libraries of functions that are used throughout the operating system and in application software. Generally, these functions are used internally by programs and are not directly visible to the computer user. However, Windows XP contains a filerundll32.exe that allows command line access to certain functions that are explicitly written to be available to this executable file.In this article we discuss how to use some of these.

Syntax for using Rundll32.exe

The syntax for using Rundll32.exe must be followed precisely and is as follows:
RUNDLL32.EXE ,

The DLL name may not contain any spaces, commas or quotation marks.If the DLL name does contain spaces, use the short (8.3) version of the file name. Note that there must be a comma between the DLL name and the entry point. Also, the name of the entry point function is case-sensitive,and there can't be any spaces between the DLL name, the comma, and the entry point function name. If the DLL file is not in a folder contained in the system path environment, then the full path must be used for the DLL name. See the Microsoft Knowledge Base for more details.

There are a number of commands employing Rundll32.exe that can be entered into Start-Run, a command window, or used in scripts. A common use is to open various Control Panel applets. For example, to open the Control Panel applet for configuring the display properties enter.
RUNDLL32.EXE SHELL32.DLL,Control_RunDLL desk.cpl,,0

Different tabs for the Desktop applet can be opened by changing the number at the end that is part of the argument. All of the Control Panel applets and their tabs can be opened this way by using the relevant CPL file and the appropriate tab number as arguments. The operating system also uses this method to display Control Panel. In fact, Control Panel applications are the most commonly mentioned examples in discussions of using Rundll32.exe. Examples of some different applications are discussed below.

Applications accessible by using Rundll32.exe

Rundll32.exe is used internally by Windows for a variety of DLL functions not exposed to the PC user but there are a number of DLLs that contain entry points available for external use. The most useful of these DLLs is shell32.dll. As illustrated above, this is the DLL that can be used to open various Control Panel applets.

Here are some lists of available commands (Note: some of the listed commands are for Win98 and do not work in Win XP.)

* Dx21 Reference Guide (Had 176 instances when I last looked)
* Vbexplorer.com
* Text version of above
* Media Chance Rundll FAQ
* Rob van der Woude's site

The last site listed above has a discussion of the many options for command line printer control using Rundll32.exe and printui.dll. The discussion is for Windows 2000 Professional but seems to work the same on my Windows XP Professional system. (I do not know if it applies to XP Home.) If you open a command window and enter the line below an extensive list of options will be shown. There are a variety of possible uses.

RUNDLL32 PRINTUI.DLL,PrintUIEntry /?

Another example is a command that allows you to switch the mouse-buttons for left-hand use. Unfortunately, once the switch is made it seems that it can only be undone by the old-fashioned method of going to Control Panel. In other words, it doesn't act as a toggle but seems to be one way. The command is
RUNDLL32.EXE USER32.DLL,SwapMouseButton

If you need to switch the button settings back and forth, the command given below will take you to the mouse settings dialog
RunDLL32.EXE shell32.dll,Control_RunDLL main.cpl @0,0

A further example is a command that brings up the "Open with.." dialog box for a particular file myfile.ext given as an argument.The full path for myfile.ext must be used unless its folder is in the path environment.
RUNDLL32.EXE SHELL32.DLL,OpenAs_RunDLL

An Internet Explorer application that will clear out the branding that some ISP's like AOL stick into the IE title bar is
RUNDLL32.EXE IEdkcs32.dll,Clear

The foregoing examples are a only a few of those listed in the references given above. Depending on their pattern of usage and level of computer expertise, PC users may find a variety of others that they can use.

Making shortcuts using Rundll32.exe

Many of the commands using Rundll32.exe are more likely to be found in scripts rather than in shortcuts for everyday use. However, creating a shortcut using one of the commands is very easy. Right-click in an empty spot in the folder where you want the shortcut to be located and choose New-Shortcut from the context menu. Enter the desired command in the line "Type the location of the item." Click "Next," choose a name, and click "Finish."

A shortcut that I personally like opens the dialog box for editing the Favorites in Internet Explorer. The command is

RUNDLL32.EXE shdocvw.dll,DoOrganizeFavDlg

In Windows 98/Me two of the most commonly used shortcuts using Rundll32.exe allowed for a quick computer shutdown or for an easy reboot. These do not work in Windows XP. A different method is available using the file shutdown.exe.
Error messages involving Rundll32.Exe

Since Rundll32.exe is involved with many processes in Windows, it isn't uncommon that error messages crop up that include references to it. That does not mean that Rundll32.exe is itself the actual culprit. More often than not the problem lies elsewhere, such as the DLL file that is being called. Persistent error messages may also indicate infection by a virus or a spyware or Trojan problem. Regular scans with an anti-virus and spyware removal software with updated definitions should be made. There are too many possible reasons for error messages to be discussed here but H. Leboeuf has a Web page with a large catalog of articles from the Microsoft Knowledge Base that are about Rundll32.exe error messages.

Difference between Rundll32.exe and Rundll.exe

Note that Windows 9X/Me still had some 16-bit operating system files so a 16-bit relative of rundll32.exe called rundll.exe was also present in the older versions of Windows. Windows XP is a pure 32-bit system and rundll.exe is not present.

[ReekenX]

Can be run32.dll used for viruses?

[shabbir]

Originally Posted by ReekenX

Can be run.dll used for viruses?

Its not run.dll but run32.dll. Dont just concentrate on putting your links in the post but just get the post also correct.

[vsarahman]

Hi!Pradeep.

when i starting the windows ctfmon.exe is automatically runnig,how can i stop that,and
it takes about 11 to 17 usage of my cpu.
pls Help me stop that from the start up.
tnx

[pradeep]

It's a MS Office process, read more about it here http://www.liutilities.com/products/...ibrary/ctfmon/

[sanjujoshhi]

hi!!!
when my window loads it shows virusremoval.vbs missing type massage.
can anyone help me?????????

[pradeep]

Probably You run a virus scan program and then deleted it, but since it is still trying to run at boot up it means that is still part of your Start Up procedure.

[sanjujoshhi]

thanks but.................
hey is there any way to get rid of it??????????

[pradeep]

Goto Start->Run type msconfig and press enter, goto Startup tab find the program and remove it.