Where are rundll32 parameters located

[vfclists]

I was looking in my Scheduled Tasks and found a task whose command was
'rundll32 dokv.bna, ypzcfawb" which I believe was some spyware I
disabled some time ago.

How does rundll32.exe locate such parameters and execute them?

 

[R.Wieser]

Hello vfclists,

How does rundll32.exe locate such parameters and execute them?

It doesn't.

'rundll32.exe' is just a shell to enable you to execute an otherwise
un-executable file, that DLL. The provided parameters are not used by
'rundll32.exe', but areactually directly transferred to the executed DLL as
its arguments.

In short: The arguments are of/for the DLL executed, and only the person who
created that DLL knows what those parameters mean/do (just like for an .EXE
file).

Hope that helps/clarifies it.

Rudy Wieser


-- Origional message: