Finding out what is using a DLL

[kentishFledgling]

I have a DLL that keep running at startup that I want to possibly get rid of.

Is there anyway I can find a list of running DLLs, and what is causing them to run? Then if it's not vital, I'll disable the program and zap the DLL files.

Many thanks,
Ed Ludlow

PS I've tried googling it, and nothing came up.

 

[tsuji]

Hello kentishfledgling,

Start|Run > msinfo32

and click to software environment | startup where info is available.

regards - tsuji

 

[kentishFledgling]

Thanks.

There's no reference to the file (6co4svc.dll) in startup, but there's a reference in "loaded modules."

Any idea what it could be, and how I could get rid of it?

Thanks,
Ed

 

[bcastner]

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

http://www.beyondlogic.org/consulting/processutil/processutil.htm

 

[tsuji]

Hello again,

[1] I have never heard of it! But, I do not claim any authority on this matter. In any case, I would run a virus scan first.
[2] From the info, you can sure locate the dll. From its location, for a legitimate software, it would tell you a lot what software package it is related to. Anything strange about it?
[3] You can then locate all the references to it in the registry to get a better idea what it is.
[4] You can thereafter consider unregister it with:
regsvr32 /u 6co4svc.dll (add path if necessary)
But then the calling executive would show up in the runtime error. Progressively you would get better idea what it comes from.

regards - tsuji

 

[kentishFledgling]

Thanks for the replies everyone.

tsuji - I think the DLL is strange, because as you say, there's no info about it, except it's from NicTech Networks Inc.

Googling this comes up that they're associated with the "look2me" spyware, but I can't find this on my system, and attempts to remove it fail as it's not there.

There are registry entries in....

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian

I've tried deleting all these references, but it does nothing - it still loads it on startup!

I've also tried programs to delete the file on the next Windows startup, but these don't work - Windows gets in and starts the file before it can deleted I think!

Any more ideas?

Thanks,
Ed Ludlow

 

[bcastner]

Are you sure this is not 6to4svc.dll?

If so this is a legitimate XP file used by the IPv6 advanced networking package.

 

[kentishFledgling]

Definately 6co4svc

E

 

[bcastner]

Use regedit and deny read access to the local system account to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian

It cannot load then.

 

[kentishFledgling]

How do I deny access? I've found the key in regedit..now what?

Thanks,
Ed

 

[bcastner]

Right-click and set Permissions

 

[kentishFledgling]

MAny thanks - problem solved!

E