Saturday, October 16, 2010

windows: which processes have loaded xyz.dll?

Example: find all processes that have loaded msvcrt.dll:
C:\Users\ambars>tasklist /m /fi "modules eq msvcrt.dll"


Image Name                     PID Modules                                     
========================= ======== ============================================
csrss.exe                      748 ntdll.dll, CSRSRV.dll, basesrv.DLL,         
                                   USP10.dll, msvcrt.dll, sxssrv.DLL, sxs.dll, 
                                   RPCRT4.dll, CRYPTBASE.dll                   

wininit.exe                    800 ntdll.dll, kernel32.dll, KERNELBASE.dll,    
                                   USER32.dll, GDI32.dll, LPK.dll, USP10.dll,  
                                   msvcrt.dll, RPCRT4.dll, sechost.dll,        
                    
csrss.exe                      808 ntdll.dll, CSRSRV.dll, basesrv.DLL,              
                                   USP10.dll, msvcrt.dll, sxssrv.DLL, sxs.dll, 
                                   RPCRT4.dll, CRYPTBASE.dll  
[SNIP/]

No comments: