Windows Firewall Exception: RunDLL32

Is it normal for RunDLL32 to show up in the Windows Firewall Exception list?
How about Explorer.exe?

--

Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com/articles/cleanboot.htm
http://grystmill.com/articles/security.htm

Pandaman
Sun Nov 12 14:23:01 CST 2006

No . I have never seen them appear automatically in *Windows Firewall's*
exception list . Place a tick on "Don't allow exceptions" and check for
virus/malware infiltrations
http://pandaman.my.contact.bg/check.htm


--
Panda_man
Silver level Contributor



"Gary S. Terhune" wrote:

> Is it normal for RunDLL32 to show up in the Windows Firewall Exception list?
> How about Explorer.exe?
>
> --
>
> Gary S. Terhune
> MS-MVP Shell/User
> http://grystmill.com/articles/cleanboot.htm
> http://grystmill.com/articles/security.htm
>
>
>
>

Gary
Sun Nov 12 14:54:43 CST 2006

Thanks, Panda_man. I've been playing with Spywarebot.com crap to help out
someone else, and when I was finished, Spybot S&D flagged the Explorer entry
but not the Rundll32 entry. Thought I'd ask around.

I will, of course, continue with further tests to make sure everything else
is hunky dory. I know I should be using RegSnap or similar to track changes,
but I'm living dangerously today, <s>. I'll give your scanners a try.

--

Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com/articles/cleanboot.htm
http://grystmill.com/articles/security.htm

"Panda_man" <Pandaman@discussions.microsoft.com> wrote in message
news:E7867E60-E839-4F7A-AC5B-75520C1CE08D@microsoft.com...
> No . I have never seen them appear automatically in *Windows Firewall's*
> exception list . Place a tick on "Don't allow exceptions" and check for
> virus/malware infiltrations
> http://pandaman.my.contact.bg/check.htm
>
>
> --
> Panda_man
> Silver level Contributor
>
>
>
> "Gary S. Terhune" wrote:
>
>> Is it normal for RunDLL32 to show up in the Windows Firewall Exception
>> list?
>> How about Explorer.exe?
>>
>> --
>>
>> Gary S. Terhune
>> MS-MVP Shell/User
>> http://grystmill.com/articles/cleanboot.htm
>> http://grystmill.com/articles/security.htm
>>
>>
>>
>>

Pandaman
Sun Nov 12 15:33:01 CST 2006

"Gary S. Terhune" wrote:

> Thanks, Panda_man. I've been playing with Spywarebot.com crap to help out
> someone else, and when I was finished, Spybot S&D flagged the Explorer entry
> but not the Rundll32 entry. Thought I'd ask around.
>
> I will, of course, continue with further tests to make sure everything else
> is hunky dory. I know I should be using RegSnap or similar to track changes,
> but I'm living dangerously today, <s>. I'll give your scanners a try.
>
> --

You are welcome !

Gary , sorry , I didn't notice were MS-MVP .

Yes , it would be a great idea to check because this smells of malware ;-)
:-) :-)


--
Panda_man
Silver level Contributor

Gary
Sun Nov 12 15:42:29 CST 2006

Running IE7 on WinXPx64

You probably already know that Avast! flags your OCX as a virus. I stopped
Avast! scanning and continued, but the at the end, the OCX control had some
error. So I closed everything, removed the OCX control using IE
Options>Programs tab>BHOs and tried again. Same results. (No active
background scanners in operation this time.)

When that "propaganda" window pops up after permitting the installation of
the OCX, all I can see is to close it, at which point I get an error that
prompts me to refresh. "To display the page, Internet Explorer needs to
resend the information you've previously submitted -- Retry/Cancel." I click
Retry, then Scan. There is then a prompt to install asinst.cab. I permit
that. It downloads, installs, and then the scan continues. Every time, at
the end, I get:
*********************
An error has occurred downloading Panda ActiveScan. Please repeat the
process. If the error occurs again, restart your system and try again
Possible causes of this error are:

Not allowing the application's ActiveX control to be downloaded.

Problems with the Internet connection.

The error could be due to a download error or an installation error due to
lack of hard disk space, privileges etc.,...
**********************

I've restarted and retried, removed the OCX and deleted TIFs and restarted
and retried and still get the same. Any ideas?

--

Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com/articles/cleanboot.htm
http://grystmill.com/articles/security.htm

"Panda_man" <Pandaman@discussions.microsoft.com> wrote in message
news:E7867E60-E839-4F7A-AC5B-75520C1CE08D@microsoft.com...
> No . I have never seen them appear automatically in *Windows Firewall's*
> exception list . Place a tick on "Don't allow exceptions" and check for
> virus/malware infiltrations
> http://pandaman.my.contact.bg/check.htm
>
>
> --
> Panda_man
> Silver level Contributor
>
>
>
> "Gary S. Terhune" wrote:
>
>> Is it normal for RunDLL32 to show up in the Windows Firewall Exception
>> list?
>> How about Explorer.exe?
>>
>> --
>>
>> Gary S. Terhune
>> MS-MVP Shell/User
>> http://grystmill.com/articles/cleanboot.htm
>> http://grystmill.com/articles/security.htm
>>
>>
>>
>>

Pandaman
Sun Nov 12 15:55:01 CST 2006

"Gary S. Terhune" wrote:

> I've restarted and retried, removed the OCX and deleted TIFs and restarted
> and retried and still get the same. Any ideas?
>
>


Yes . Leave it ;-) Instead you can go through the malware removal
instructions here in my site http://pandaman.my.contact.bg/Gen_MRI.htm


--
Panda_man
Silver level Contributor

Pandaman
Sun Nov 12 15:58:01 CST 2006

Other alternatives to Panda's scan (which defintions are detected by Avast
because Panda Software doesn't encrupt their signatures) are Kaspersky's
online scanner (it is very slow by the way
http://www.kaspersky.com/virusscanner


--
Panda_man
Silver level Contributor



"Gary S. Terhune" wrote:

> Running IE7 on WinXPx64
>
> You probably already know that Avast! flags your OCX as a virus. I stopped
> Avast! scanning and continued, but the at the end, the OCX control had some
> error. So I closed everything, removed the OCX control using IE
> Options>Programs tab>BHOs and tried again. Same results. (No active
> background scanners in operation this time.)
>
> When that "propaganda" window pops up after permitting the installation of
> the OCX, all I can see is to close it, at which point I get an error that
> prompts me to refresh. "To display the page, Internet Explorer needs to
> resend the information you've previously submitted -- Retry/Cancel." I click
> Retry, then Scan. There is then a prompt to install asinst.cab. I permit
> that. It downloads, installs, and then the scan continues. Every time, at
> the end, I get:
> *********************
> An error has occurred downloading Panda ActiveScan. Please repeat the
> process. If the error occurs again, restart your system and try again
> Possible causes of this error are:
>
> Not allowing the application's ActiveX control to be downloaded.
>
> Problems with the Internet connection.
>
> The error could be due to a download error or an installation error due to
> lack of hard disk space, privileges etc.,...
> **********************
>
> I've restarted and retried, removed the OCX and deleted TIFs and restarted
> and retried and still get the same. Any ideas?
>
> --
>
> Gary S. Terhune
> MS-MVP Shell/User
> http://grystmill.com/articles/cleanboot.htm
> http://grystmill.com/articles/security.htm
>
> "Panda_man" <Pandaman@discussions.microsoft.com> wrote in message
> news:E7867E60-E839-4F7A-AC5B-75520C1CE08D@microsoft.com...
> > No . I have never seen them appear automatically in *Windows Firewall's*
> > exception list . Place a tick on "Don't allow exceptions" and check for
> > virus/malware infiltrations
> > http://pandaman.my.contact.bg/check.htm
> >
> >
> > --
> > Panda_man
> > Silver level Contributor
> >
> >
> >
> > "Gary S. Terhune" wrote:
> >
> >> Is it normal for RunDLL32 to show up in the Windows Firewall Exception
> >> list?
> >> How about Explorer.exe?
> >>
> >> --
> >>
> >> Gary S. Terhune
> >> MS-MVP Shell/User
> >> http://grystmill.com/articles/cleanboot.htm
> >> http://grystmill.com/articles/security.htm
> >>
> >>
> >>
> >>
>
>

Gary
Sun Nov 12 16:37:34 CST 2006

I'll be running Kaspersky later as part of a Multi_AV scan (while I make
five gallons of chile.)

Anyway, just figured you'd like to hear of my experiences, <s>. thanks for
everything.

--

Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com/articles/cleanboot.htm
http://grystmill.com/articles/security.htm

"Panda_man" <Pandaman@discussions.microsoft.com> wrote in message
news:6E2142BD-C940-48D1-9909-839A22796063@microsoft.com...
> Other alternatives to Panda's scan (which defintions are detected by Avast
> because Panda Software doesn't encrupt their signatures) are Kaspersky's
> online scanner (it is very slow by the way
> http://www.kaspersky.com/virusscanner
>
>
> --
> Panda_man
> Silver level Contributor
>
>
>
> "Gary S. Terhune" wrote:
>
>> Running IE7 on WinXPx64
>>
>> You probably already know that Avast! flags your OCX as a virus. I
>> stopped
>> Avast! scanning and continued, but the at the end, the OCX control had
>> some
>> error. So I closed everything, removed the OCX control using IE
>> Options>Programs tab>BHOs and tried again. Same results. (No active
>> background scanners in operation this time.)
>>
>> When that "propaganda" window pops up after permitting the installation
>> of
>> the OCX, all I can see is to close it, at which point I get an error that
>> prompts me to refresh. "To display the page, Internet Explorer needs to
>> resend the information you've previously submitted -- Retry/Cancel." I
>> click
>> Retry, then Scan. There is then a prompt to install asinst.cab. I permit
>> that. It downloads, installs, and then the scan continues. Every time, at
>> the end, I get:
>> *********************
>> An error has occurred downloading Panda ActiveScan. Please repeat the
>> process. If the error occurs again, restart your system and try again
>> Possible causes of this error are:
>>
>> Not allowing the application's ActiveX control to be downloaded.
>>
>> Problems with the Internet connection.
>>
>> The error could be due to a download error or an installation error due
>> to
>> lack of hard disk space, privileges etc.,...
>> **********************
>>
>> I've restarted and retried, removed the OCX and deleted TIFs and
>> restarted
>> and retried and still get the same. Any ideas?
>>
>> --
>>
>> Gary S. Terhune
>> MS-MVP Shell/User
>> http://grystmill.com/articles/cleanboot.htm
>> http://grystmill.com/articles/security.htm
>>
>> "Panda_man" <Pandaman@discussions.microsoft.com> wrote in message
>> news:E7867E60-E839-4F7A-AC5B-75520C1CE08D@microsoft.com...
>> > No . I have never seen them appear automatically in *Windows
>> > Firewall's*
>> > exception list . Place a tick on "Don't allow exceptions" and check for
>> > virus/malware infiltrations
>> > http://pandaman.my.contact.bg/check.htm
>> >
>> >
>> > --
>> > Panda_man
>> > Silver level Contributor
>> >
>> >
>> >
>> > "Gary S. Terhune" wrote:
>> >
>> >> Is it normal for RunDLL32 to show up in the Windows Firewall Exception
>> >> list?
>> >> How about Explorer.exe?
>> >>
>> >> --
>> >>
>> >> Gary S. Terhune
>> >> MS-MVP Shell/User
>> >> http://grystmill.com/articles/cleanboot.htm
>> >> http://grystmill.com/articles/security.htm
>> >>
>> >>
>> >>
>> >>
>>
>>

David
Sun Nov 12 18:04:47 CST 2006

From: "Gary S. Terhune" <grystnews@mvps.org>

| I'll be running Kaspersky later as part of a Multi_AV scan (while I make
| five gallons of chile.)
|
| Anyway, just figured you'd like to hear of my experiences, <s>. thanks for
| everything.
|


Did I read chile ? Yummmmmm :-)

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Gary
Sun Nov 12 19:18:38 CST 2006

Yup. Kind that's made with burger & kidney beans, though. Needed to quickly
use up a large chunk of ground and figured we could use some winter stocks.
Gonna freeze most of it. This isn't one of my summer chiles, with lots of
tender steak, big chunks of everything else...

--

Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com/articles/cleanboot.htm
http://grystmill.com/articles/security.htm

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:ulCMWdrBHHA.3536@TK2MSFTNGP03.phx.gbl...
> From: "Gary S. Terhune" <grystnews@mvps.org>
>
> | I'll be running Kaspersky later as part of a Multi_AV scan (while I make
> | five gallons of chile.)
> |
> | Anyway, just figured you'd like to hear of my experiences, <s>. thanks
> for
> | everything.
> |
>
>
> Did I read chile ? Yummmmmm :-)
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>