How to find what is loading specific dlls and mapped files?
I'm working on a large application that has uses many diverse libraries, but does not interop with Microsoft Office or Internet Explorer. By looking at the virtual memory with VMMap, however, I see that the following large files are being loaded into my application's virtual memory space.
C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
C:\Documents and Se开发者_开发百科ttings...\LocalSettings\Temporary Internet Files\Content.IE5\index.dat
How can I track down what is loading these files?
I would recommend Process Monitor, part of the Windows Sysinternals suite. In Process Monitor, set a filter that looks for LoadLibrary events on those particular DLLs, and you can find which process fired it.
Try Process Explorer from Sysinternals
Both Adam and Ray options are great, but try GMER or some debugging with OllyDebug.
Maybe one of those libs you're using is calling some function at MSO.DLL and for some weird reason reading the IE history :|
Can you provide further information about the program? or the libs you're using?!
Edit: OllyDebug can trace when, where, and who called mso.dll+function(s)
精彩评论