Sean
Sean

Reputation: 1403

How to find what is loading specific dlls and mapped files?

I'm working on a large application that has uses many diverse libraries, but does not interop with Microsoft Office or Internet Explorer. By looking at the virtual memory with VMMap, however, I see that the following large files are being loaded into my application's virtual memory space.

C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL

C:\Documents and Settings...\LocalSettings\Temporary Internet Files\Content.IE5\index.dat

How can I track down what is loading these files?

Upvotes: 0

Views: 646

Answers (3)

Filipe YaBa Polido
Filipe YaBa Polido

Reputation: 1674

Both Adam and Ray options are great, but try GMER or some debugging with OllyDebug. Maybe one of those libs you're using is calling some function at MSO.DLL and for some weird reason reading the IE history :|
Can you provide further information about the program? or the libs you're using?!
Edit: OllyDebug can trace when, where, and who called mso.dll+function(s)

Upvotes: 0

Adam Norberg
Adam Norberg

Reputation: 3076

I would recommend Process Monitor, part of the Windows Sysinternals suite. In Process Monitor, set a filter that looks for LoadLibrary events on those particular DLLs, and you can find which process fired it.

Upvotes: 1

Ray
Ray

Reputation: 21905

Try Process Explorer from Sysinternals

Upvotes: 0

Related Questions