This tip was printed from the MalekTips Computer and Technology Help and Tips website at http://malektips.com.

Windows XP and DOS - List all DLLs Loaded on a System

SUMMARY: The listdlls command displays a list of Dynamic Link Library (dll) files loaded on a Windows XP system.

For computer management, software error diagnosis, or spyware or virus diagnosis, it may prove useful to display the list, size, and version of all DLLs currently loaded on a particular Windows XP machine. This can be done on the command prompt with the listdlls command, available from the SysInternals site, part of Microsoft Technet.

Simply download the zip file, unzip the executable inside listdlls.zip to your main Windows directory, and you can display the list of loaded DLLs at the command prompt:

listdlls

You should either pipe the results to more or to a text file as the list is rather lengthy.

A few command line arguments are supported:

process name or PID

Displays the list of DLLs associated with the process name or PID (partial process names are accepted).

For example, the following command displays all DLL files associated with Windows Notepad:

listdlls notepad

-d DLLNAME

Displays the processes that have loaded the DLL file DLLNAME.

For example, do you need to determine if your machine is still vulnerable to the GDI+ vulnerability involving buffer overruns when processing JPEG files (refer to Microsoft Security Bulletin MS04-028)? The following command displays which currently-loaded processes load gdiplus.dll and which versions are loaded:

listdlls -d gdiplus

	The above command is NOT a complete substitute for using Microsoft's vulnerability tools mentioned in the security bulletin, as you may have applications installed that use vulnerable versions of this DLL, but are not currently running!

-r

Flags relocated DLLs that did not load at the base address.

Sysinternals ListDlls - http://www.microsoft.com/technet/sysinternals/
Utilities/ListDlls.mspx