What Does The rundll32.exe Icon Look Like?

I thought the rundll32.exe had the typical Windows .exe icon look, as a default application that didn't have an icon attached to it, the white box with the blue trim at the top.

Here's a screenshot of what I'm seeing:

http://img81.imageshack.us/img81/6761/89893141.jpg



THANKS

 

I have this same (blue 33 KB). It's Microsoft gift, OK., no worry.

P.

 

On Win2k it's a different icon than from that in WinXP:

​

It's not a normal executable file. Note the description:

​

If you d-click on it, nothing happens. It needs an argument, that is, a DLL to load, such as:

​

which will launch Internet Explorer to connect to the WindowsLive login:

​

If you looked at the analysis of the conficker worm USB exploit, you would have seen the trick where the autorun.inf file contained a shellexecute command to load the malicious DLL -- spoofed with .vmx file extension:

Code:

shelLExECUte=[B]RuNdLl32.EXE[/B] .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\[B]jwgkvsq.vmx[/B], ahaezedrn

That's why this trusted EXE can be so dangerous when used by malware writers.

----
rich

 

THANKS

 

Ohh.. agian u remind me. The clever conflicker worm, love it. Was very nice n interesting testing indeed.