Where are rundll32 parameters located

  • Thread starter Thread starter vfclists
  • Start date Start date
V

vfclists

I was looking in my Scheduled Tasks and found a task whose command was
'rundll32 dokv.bna, ypzcfawb" which I believe was some spyware I
disabled some time ago.

How does rundll32.exe locate such parameters and execute them?
 
Hello vfclists,
How does rundll32.exe locate such parameters and execute them?
Click to expand...

It doesn't.

'rundll32.exe' is just a shell to enable you to execute an otherwise
un-executable file, that DLL. The provided parameters are not used by
'rundll32.exe', but areactually directly transferred to the executed DLL as
its arguments.

In short: The arguments are of/for the DLL executed, and only the person who
created that DLL knows what those parameters mean/do (just like for an .EXE
file).

Hope that helps/clarifies it.

Rudy Wieser


-- Origional message:
 
Back
Top