Newbie Firewall Question DLL

[suzkaw]

I am newbie so this may be a dumb question.
I am running Zone Alarm and it keeps popping up asking if I would want to run DLL as app.
What is this? Should I be running this?

Thanks,
Eric

[VictorKaum]

what dll ?

Give more details and we will be able to hlep you.
Is it an application called DLL or some file with the extension DLL?

[suzkaw]

Here is what the firewall says.
Product Name: Run Dll as app
File Name: c:\windows\rundll32.exe
Product Version: 4.10.1998
Create Date 4.23.99

[VictorKaum]

rundll32.exe is a windows component, so if the create date is the same as your windows date than there's no prob running this as an app.
I have this dll on my 98 box too, I did a fast search, however it is not in the firewall trusted app's list. So you can set it to ask instead of allow until you know why it pops-up.

I will search for more info on my Win98 box in a minute... give me 5 secs...

[VictorKaum]

The rundll32.exe enables to run a 32 bit function exported from a DLL

This could be with malicious intend, the Sircam worm for instance uses rundll32.exe

W32/sircam:

If the worm finds any open network share, it will attempt to copy itself into the Windows directory on the machine with an open share, with the filename rundll32.exe. The original rundll32.exe file is renamed to run32.exe. If this is successful, the worm changes the file autoexec.bat so that it includes a command to run the worm file previously dropped to the C:\recycled directory.

from: http://www.sophos.com/virusinfo/anal...32sircama.html


So check your file, if it is exactly yhe same as on the CD, it is the one from Microsoft...

If you do not trust that app don't allow it. However some other progs or plug-ins need the run32dll otherwise they will not work properly.