Search in uioop.blogspot.com

Tuesday, November 4, 2008

Using Rundll32.exe in Windows XP

Although they are not directly executable as programs, the many DLL files present in Windows contain libraries of functions that are used throughout the operating system and in application software. Generally, these functions are used internally by programs and are not directly visible to the computer user. However, Windows XP contains a file rundll32.exe that allows command line access to certain functions that are explicitly written to be available to this executable file. In this article we discuss how to use some of these.


Syntax for using Rundll32.exe

The syntax for using Rundll32.exe must be followed precisely and is as follows:

RUNDLL32.EXE ,

The DLL name may not contain any spaces, commas or quotation marks. If the DLL name does contain spaces, use the short (8.3) version of the file name. Note that there must be a comma between the DLL name and the entry point. Also, the name of the entry point function is case-sensitive, and there can't be any spaces between the DLL name, the comma, and the entry point function name. If the DLL file is not in a folder contained in the system path environment, then the full path must be used for the DLL name. See the Microsoft Knowledge Base for more details.

There are a number of commands employing Rundll32.exe that can be entered into Start-Run, a command window, or used in scripts. A common use is to open various Control Panel applets. (Another method specific to Control Panel is discussed here.) For example, to open the Control Panel applet for configuring the display properties enter

RUNDLL32.EXE SHELL32.DLL,Control_RunDLL desk.cpl,,0

Different tabs for the Desktop applet can be opened by changing the number at the end that is part of the argument. All of the Control Panel applets and their tabs can be opened this way by using the relevant CPL file and the appropriate tab number as arguments. The operating system also uses this method to display Control Panel. In fact, Control Panel applications are the most commonly mentioned examples in discussions of using Rundll32.exe. Examples of some different applications are discussed below.

Applications accessible by using Rundll32.exe

Rundll32.exe is used internally by Windows for a variety of DLL functions not exposed to the PC user but there are a number of DLLs that contain entry points available for external use. The most useful of these DLLs is shell32.dll. As illustrated above, this is the DLL that can be used to open various Control Panel applets.

Here are some lists of available commands (Note: some of the listed commands are for Win98 and do not work in WinXP.)

The last site listed above has a discussion of the many options for command line printer control using Rundll32.exe and printui.dll. The discussion is for Windows 2000 Professional but seems to work the same on my Windows XP Professional system. (I do not know if it applies to XP Home.) If you open a command window and enter the line below an extensive list of options will be shown. There are a variety of possible uses.

RUNDLL32 PRINTUI.DLL,PrintUIEntry /?

Another example is a command that allows you to switch the mouse-buttons for left-hand use. Unfortunately, once the switch is made it seems that it can only be undone by the old-fashioned method of going to Control Panel. In other words, it doesn't act as a toggle but seems to be one way. The command is

RUNDLL32.EXE USER32.DLL,SwapMouseButton

If you need to switch the button settings back and forth, the command given below will take you to the mouse settings dialog

RUNDLL32.EXE SHELL32.dll,Control_RunDLL main.cpl @0,0

A further example is a command that brings up the "Open with.." dialog box for a particular file myfile.ext given as an argument. The full path for myfile.ext must be used unless its folder is in the path environment.

RUNDLL32.EXE SHELL32.DLL,OpenAs_RunDLL

An Internet Explorer application that will clear out the branding that some ISPs like AOL stick into the IE title bar is

RUNDLL32.EXE IEdkcs32.dll,Clear

The Safely Remove Hardware icon that is displayed in the notification area (also called the System Tray) when USB devices are attached can sometimes fail to appear. The utility can be opened by a command

RUNDLL32.EXE SHELL32.DLL,Control_RunDLL HotPlug.dll

The foregoing examples are a only a few of those listed in the references given above. Depending on their pattern of usage and level of computer expertise, PC users may find a variety of others that they are of interest.

Making shortcuts using Rundll32.exe

Many of the commands using Rundll32.exe are more likely to be found in scripts rather than in shortcuts for everyday use. However, creating a shortcut using one of the commands is very easy. Right-click in an empty spot in the folder where you want the shortcut to be located and choose New-Shortcut from the context menu. Enter the desired command in the line "Type the location of the item." Click "Next," choose a name, and click "Finish."

A shortcut that I personally like opens the dialog box for editing the Favorites in Internet Explorer. The command is

RUNDLL32.EXE shdocvw.dll,DoOrganizeFavDlg

In Windows 98/Me two of the most commonly used shortcuts using Rundll32.exe allowed for a quick computer shutdown or for an easy reboot. These do not work in Windows XP. A different method is available using the file shutdown.exe. However, to put your computer into hibernation mode (assuming your power management supports this) the command for a shortcut is

RUNDLL32.EXE PowrProf.dll,SetSuspendState

Error messages involving Rundll32.Exe

Since Rundll32.exe is involved with many processes in Windows, it isn't uncommon that error messages crop up that include references to it. That does not mean that Rundll32.exe is itself the actual culprit. More often than not the problem lies elsewhere, such as the DLL file that is being called. Persistent error messages may also indicate infection by a virus or a spyware or Trojan problem. Regular scans with an anti-virus and spyware removal software with updated definitions should be made. There are too many possible reasons for error messages to be discussed here but H. Leboeuf has a Web page with a large catalog of articles from the Microsoft Knowledge Base that are about Rundll32.exe error messages.

Determining which modules are being executed by Rundll.32.exe

The Windows XP tool Tasklist can be used to determine what program modules are currently being executed by rundll32.exe. (For discussion of Tasklist, go to this page.) To create a list of running tasks, open a Command Prompt window and enter the following command:

tasklist /m /fi "IMAGENAME eq rundll32.exe" >C:\rundll32.txt

This will create a text file rundll32.txt on the C: drive that lists the running modules. If you prefer a different location for the text file, modify the command accordingly. Also, to simply view the running tasks in the command window, omit the part of the command that does file redirection, >C:\rundll32.txt.

Difference between Rundll32.exe and Rundll.exe

Note that Windows 9X/Me still had some 16-bit operating system files so a 16-bit relative of rundll32.exe called rundll.exe was also present in the older versions of Windows. Windows XP is a pure 32-bit system and rundll.exe is not present.

---------------------------------------------------------------------------

http://www.instant-registry-fixes.org/using-rundll32exe-in-windows/

What is Rundll32.exe?

Dynamic Link Libraries (Dlls) are used by Windows operating systems, such as Windows XP and applications installed on it to perform various functions. Most of these functions are used internally and you don’t get to know about them. However, Windows comes equipped with Rundll32.exe, which is a command-line utility that you can use to invoke certain functions exported from DLLs. In this article, we will discuss how to use Rundl32.exe and go through a few examples.

Syntax to Use Rundll32.exe

The syntax to use Rundll32.exe is:

RUNDLL32.EXE ,

The command should follow the following standards:

DLL_Name: Do not include spaces, commas, or quotation marks in the DLL name. If the DLL name consists of spaces, then you must use the 8.3 version or the short name of the DLL.

Entry_Point: Entry point is case sensitive, therefore, you must follow exact casing while adding this value. Also, remember that if the DLL file does not exist in the system folder then you may need to enter the full path for the DLL name.

Optional_Arguments: This part is used to specify any additional task that you want the command to perform. For instance, if you run the following command:

RUNDLL32.EXE SHELL32.DLL,Control_RunDLL desk.cpl,,0

This opens the Display Properties dialog box with the Desktop tab open. Now, you can change the value of the number at the end to specify the tab you want to open with the command.

Note: While running the command you must be sure to follow the exact syntax, otherwise, you may receive an error message.

Rundll32.exe Examples

Let’s now see a few examples of using the Rundll32.exe file. To run the commands discussed here, open Start > Run, enter the command in the ‘Open’ field and select ‘OK’.

Switch Mouse Buttons

To switch mouse buttons for a left-handed user, run the following command.

RUNDLL32.EXE USER32.DLL,SwapMouseButton

This command cannot be used to switch back to default settings, To switch back, you will have to go to Control Panel and open the Mouse Properties dialog box. However, you can directly open the Mouse Properties dialog box by running the command given below.

RUNDLL32.EXE SHELL32.dll,Control_RunDLL main.cpl @0,0

Clear Internet Explorer Title

Some ISPs and software programs modify the title of the Internet Explorer to include their brand name. You can remove this added information and clear the Internet Explorer title bar by running the following command.

RUNDLL32.EXE IEdkcs32.dll,Clear

View Printer Options

To view various print and printer setting related options available on your system, run the command given below.

RUNDLL32 PRINTUI.DLL,PrintUIEntry /?

Hibernate Your System

The power options of some computers—laptops and notebooks—enable you to hibernate them instead of performing a system shutdown. You can use this option when you are going to be away from your PC for a short time. To quickly hibernate your PC, run the command given below.

RUNDLL32.EXE PowrProf.dll,SetSuspendState

Rundll32.Exe Error Messages

Generally, rundll32.exe error messages are displayed when you accidentally download malicious software such as viruses, Trojans, spyware, and adware on your system. These malicious software programs are downloaded when you access dubious websites, open suspicious email attachments, and download uncertified freeware programs. Rundll32.exe errors can also be caused by incorrect software install/uninstall and a damaged registry.

To keep your PC free from rundll32.exe error messages, you must be a vigilant user and be very careful about what you access on the Internet, and what files you download on your system. You must follow correct install/uninstall procedures and use a registry cleaner program to regularly scan and repair the system registry.

Runndll32.exe is used to invoke functions exported from DLLs to perform various tasks. Although, an application may use Rundll32.exe to perform various functions, you can use it to perform a few functions manually. In other words, Rundll32.exe commands can be used as a shortcut to perform certain tasks that otherwise, would have required you to navigate through a number of dialog boxes and windows. To keep your PC free of rundll32.exe error messages, you must keep your antivirus software up-to-date and regularly run antivirus and registry cleaner scans on your system.

Monday, November 3, 2008

IE HomePage Hijacked - 6700.cn 清除方法

http://www.pengzao.com/article/6700.html

电脑的 IE 浏览器被强制设置了主页,变为 www.6700.cn 了,试了很多方法都不能修改回来,包括用优化大师、修改注册表。虽然我很少用 IE ,但有时还是不得不用它,比如使用网银、支付宝的时候。没办法,只好求助于搜索引擎了。

搜索 6700.cn ,网上骂声一片,看来不少人都中过它的招,据说 IE6 升级 IE7 或者卸载 IE7 降回 IE6 都不能解决。各种清除流氓软件的工具、杀毒软件都有人试过了,都不是有效的解决途径。我也试了几种据说一定能解决的办法,结果还是不行。试了多个关键 词:6700.cn 专杀、清除 6700.cn、6700.cn 病毒,方法都是大同小异的,结果都是——不行。在 IE 里设置了主页为空白页,好像成功了,但是重启后还是那样! :fiery:

强制设置主页这个恶意行为实在令人反感,不清除它我心里也不甘。花了不知多少时间,终于在某人的新浪博客里受到启发:在设备管理器(Device Manager)里点击“查看(View) ”-“显示隐藏的设备(Show Hidden Devices)”,可以在“非即插即用驱动程序(non-plug and play drivers)”里看到一些隐藏的驱动程序。一些流氓软件、恶意程序、病毒往往隐藏在这里。经过排除和判断,终于被 我找到了元凶——hgjzo(Different Computer has different name) ,把这个驱动程序停用之后,IE 主页可以自由修改了! :yes:

-------------------------------------------------------------------------

www.6700.cn/?z清除心得

想把的主页去掉,需要以下步骤:

1、使用杀毒软件和360等各种软件杀毒,清理恶意软件、插件。

2、下载电脑报HOST或360版HOST,然后进安全模式,用新HOST替换原来的HOST,这样,再进系统后,原来被病毒屏蔽的360论坛等很多杀毒软件的网站就可以进了。

3、下载SReng,点启动项目,将检测的错误的启动项目改为默认值,SReng会提示默认值是什么,照填就行。使用SReng的系统修复,将能修复的都修复了。

4、桌面属性-桌面-自定义桌面-web-把里面的网页全部删掉-点确定

5、在桌面点右键-排列图标-取消“在桌面上锁定web项目”前面的勾,这样图标后面就不会有小方块了。

6、更改IE主页,杀毒,杀完毒后重启看效果如何。

-----------------------------------------------------------------

主页修复工具Xindex

直接点“修复主页”,只需1下
就可以解决浏览器首页被木马病毒修改问题

下载地址 http://www.antidu.cn/board/xindex/

-----------------------------------------------------------------

IE中毒.

用360或者超级兔子都可以很好的修复这样的问题.
尽量不要上一些不良的网站.以免中招.

超级兔子尽量用强力修复.因为你的IE被篡改的很厉害.

使用超级兔子定期清理系统垃圾.设置上网拦截选项.可以避免一些不良广告.弹出窗口和网站的侵扰.强力修复后电脑重启一下就会好的

奇虎360下载地址:
http://www.360.cn/

超级兔子下载地址:http://www.skycn.com/soft/2993.html

修复好了给分.没有修复好请告诉我.我会继续帮你想办法

还是不行是吧?那再给你办法:
您的IE发生问题时,我们可以通过运行系统中命令的方法恢复IE的本来面目。单击“开始”/“运行”,输入 rundll32.exe iedkcs32.dllClear 按“确定”按钮生效。需要注意的是Clear中的C一定要大写。如果您的IE被恶意修 改,请重新启动IE看看,IE的所有设置都会被快速恢复回来,默认的网页也改为微软的网站。该技巧同样适用于IE界面发生问题以及被恶意修改IE设置等任 何情况。

借助现成的工具软件恢复IE

由于IE被无端修改现象司空见惯,一些编程人员通过深入研究,开发出简便易行的IE反修改工具。这些工具不需要使用者进行任何设置,只要有针对性 地做出选择,程序就会轻松按照你的意愿通过对注册表的修改,达到你的要求。目前,这类的工具软件很多。一个叫“菜鸟不菜(NoCheat)”的小工具,可 以防止注册表被屏蔽、自由设定IE首页和标题(title)、取消恶意代码造成的右键广告、取消恶意代码造成的开机自动进入某网站的问题。可在 http://www.etextwizard.com/cn/download/ncdown.html处 下载。其使用方法是:启动“菜鸟不菜”程序,点击“IE首页及Title”按钮,分别设置IE默认首页和IE默认标题,然后选中“程序运行就恢复默认设置 ”,最后点击“应用”按钮退出,再启动IE,您的意愿实现了。类似的工具还有“IE保护器(HKIE)”,保护IE默认主页、恢复IE标题、恢复系统登录 标题功能,软件在运行的时候彻底保护系统不受非法站点的有害脚本影响。下载地址http://goseaside.8u8.com/hkie.htm。最 为出色,针对IE被无端修改预防恢复功能最全的工具目前当属IEProSetup,IE所受到的轻度、中度、重度伤害它都能一一化解,可称得上是IE设置 选项完全控制工具,可以控制IE选项中的所有内容,包括标题、主页等设置修改等,同时还可以解除Regedit.exe被锁定的难题。下载地址 http://ytianlong.3322.net/document/ieprosetup.htm。

通过手工操作恢复IE

这种方法带有一些风险,需要有一定的系统操作功底,但实践性很强,如果你想得到乐趣,不妨使用此类方法。

一是针对IE标题栏被修改的情况,请在“运行”中键入“regedit”启动注册表编辑器,分别打开 “HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main”和 “HKEY_LOCAL_MACHINE\Software\Microsoft\InternetExplorer\Main”,分别将 “StartPage”、“WindowTitle”两个主键删除,默认标题栏就会得以恢复。

二是针对IE首页被修改的情况,比较简单的办法是在IE的设置中即可完成,此处不赘述。当然你也可以在注册表编辑器中,通过“编辑/查找”方式, 在“查找”对话框中输入你不愿看到的网址或关键词,一处一处查找,然后一一将其删除。但有些情况比较复杂,有的在你的硬盘中写入了程序,首页改过之后,一 启动计算机又被重新改过来。这时请在“运行”中键入“msconfig”启动“系统配置实用程序”,点击“启动”标签,将你不希望看到的网址钩号选掉。由 于对其禁用,当计算机重新启动后,该首页不会再随系统启动。

三是针对一开启机器弹出窗口,让你先进入这个首页,否则无法进入操作系统情况,请在注册表编辑器中找到 “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon” 主键,将其下的“LegalNnoticeCaption”和“LegalNnoticeText”主键删除即可。

-----------------------------------------------------------------

6700.cn清除方法:
1、安装360
2、下载Unlocker
3、用360导出诊断报告,在041项下可以找到
c:\windows\system32\drivers\*****.sys
是一个由5个英文字母组成的文件名。
4、用Unlocker删除这个文件
5、在IE浏览器中将默认主页改回你想要的。
6、用Regedit将注册表中6700.cn的内容全部删除
7、重启计算机
8、这个世界清净了。

---------------------------------------------------------------------

下面的方法可以解决
每次一开机打开浏览器就会发现主页被篡改成www.6700.cn?=102743改回来下次开机还会这样


IE主页被6700的网站锁定、

开始-----运行------输入 gpedit.msc 确定,会进入到组策略

用户配置-----管理模板-----Windows Components----------Internet Explorer
----------1. “阻止执行首次运行自定义设置”(勾选“已启用”,选择“直接转到主页”)

2. “禁用更改主页设置”(勾选“已启用”,主页“你喜欢的网站例如:www.google.cn”)



Sunday, November 2, 2008

Start Windows in Clean Boot mode

Start Windows in Clean Boot mode

Note: You must be logged on as an administrator or a member of the Administrators group to complete this procedure.

1) Click Start.

2) Copy and paste "msconfig" (without the quotation marks) in the Start Search box, and click Enter.

3) Switch to Services tab and then Check Hide All Microsoft Services.

4) Click Disable All.

5) Switch to the Startup tab and then Click Disable all.

6) Click OK.

7) Click Restart to restart the computer and test the issue.

Friday, October 31, 2008

PC in using half-way and restart again

PC in using half-way and restart.

Sometime is able run it till 2-3 hours long and restart suddenly.

but sometime just 10 to 15 mins will restart.

Especially when CD-ROM is running, it will within 2-3mins get restart.

1stly suspect is power supply problem but not. After change a new one problem still remain.

Unplugged CD-ROM, problem still same.

After format system problem still remain.

Lastly, after change CPU then everything in fine.

After Shutdown PC will turn on itself

XP systemis working fine.

But everytime after PC completely shutdown and PC will restart again.

After swapped all the parts in the system unit (CPU, Power supply, RAM, Graphic Card), BIOS cleared and upgraded. Problem remain.

Suspect Mother Board faulty.

After change a new motherboard then everthing be fine.

AVG Internet Security 2013

Total Pageviews

Contributors