Saturday, February 25, 2012

Rundll32.exe With Windows

Syntax for using Rundll32.exe

The syntax for using Rundll32.exe must be followed precisely and is as follows:
RUNDLL32.EXE ,

There are a number of commands employing Rundll32.exe that can be entered into Start-Run, a command window, or used in scripts. A common use is to open various Control Panel applets. (Another method specific to Control Panel is discussed here.) For example, to open the Control Panel applet for configuring the display properties enter

RUNDLL32.EXE SHELL32.DLL,Control_RunDLL desk.cpl,,0

Different tabs for the Desktop applet can be opened by changing the number at the end that is part of the argument. All of the Control Panel applets and their tabs can be opened this way by using the relevant CPL file and the appropriate tab number as arguments. The operating system also uses this method to display Control Panel. In fact, Control Panel applications are the most commonly mentioned examples in discussions of using Rundll32.exe. Examples of some different applications are discussed below.

The last site listed above has a discussion of the many options for command line printer control using Rundll32.exe and printui.dll. The discussion is for Windows 2000 Professional but seems to work the same on my Windows XP Professional system. (I do not know if it applies to XP Home.) If you open a command window and enter the line below an extensive list of options will be shown. There are a variety of possible uses.

RUNDLL32 PRINTUI.DLL,PrintUIEntry /?
Another example is a command that allows you to switch the mouse-buttons for left-hand use. Unfortunately, once the switch is made it seems that it can only be undone by the old-fashioned method of going to Control Panel. In other words, it doesn't act as a toggle but seems to be one way. The command is

RUNDLL32.EXE USER32.DLL,SwapMouseButton
If you need to switch the button settings back and forth, the command given below will take you to the mouse settings dialog

RUNDLL32.EXE SHELL32.dll,Control_RunDLL main.cpl @0,0
A further example is a command that brings up the "Open with.." dialog box for a particular file myfile.ext given as an argument. The full path for myfile.ext must be used unless its folder is in the path environment.

RUNDLL32.EXE SHELL32.DLL,OpenAs_RunDLL
An Internet Explorer application that will clear out the branding that some ISPs like AOL stick into the IE title bar is

RUNDLL32.EXE IEdkcs32.dll,Clear
The Safely Remove Hardware icon that is displayed in the notification area (also called the System Tray) when USB devices are attached can sometimes fail to appear. The utility can be opened by a command

RUNDLL32.EXE SHELL32.DLL,Control_RunDLL HotPlug.dll

Making shortcuts using Rundll32.exe

Many of the commands using Rundll32.exe are more likely to be found in scripts rather than in shortcuts for everyday use. However, creating a shortcut using one of the commands is very easy. Right-click in an empty spot in the folder where you want the shortcut to be located and choose New-Shortcut from the context menu. Enter the desired command in the line "Type the location of the item." Click "Next," choose a name, and click "Finish."

A shortcut that I personally like opens the dialog box for editing the Favorites in Internet Explorer. The command is

RUNDLL32.EXE shdocvw.dll,DoOrganizeFavDlg

In Windows 98/Me two of the most commonly used shortcuts using Rundll32.exe allowed for a quick computer shutdown or for an easy reboot. These do not work in Windows XP. A different method is available using the file shutdown.exe. However, to put your computer into hibernation mode (assuming your power management supports this) the command for a shortcut is

RUNDLL32.EXE PowrProf.dll,SetSuspendState

Error messages involving Rundll32.Exe

Since Rundll32.exe is involved with many processes in Windows, it isn't uncommon that error messages crop up that include references to it. That does not mean that Rundll32.exe is itself the actual culprit. More often than not the problem lies elsewhere, such as the DLL file that is being called. Persistent error messages may also indicate infection by a virus or a spyware or Trojan problem. Regular scans with an anti-virus and spyware removal software with updated definitions should be made. There are too many possible reasons for error messages to be discussed here but H. Leboeuf has a Web page with a large catalog of articles from the Microsoft Knowledge Base that are about Rundll32.exe error messages.

Determining which modules are being executed by Rundll.32.exe

tasklist /m /fi "IMAGENAME eq rundll32.exe" >C:\rundll32.txt

This will create a text file rundll32.txt on the C: drive that lists the running modules. If you prefer a different location for the text file, modify the command accordingly. Also, to simply view the running tasks in the command window, omit the part of the command that does file redirection, >C:\rundll32.txt.

No comments:

Post a Comment