Pull out the DLL black hand in the system

        In Windows, almost all applications use DLL (Dynamic Link Library) files, and its normality is related to whether the software can run normally. Many software failures are also directly related to it. But applications often call dozens of DLL programs, how to determine who is the "culprit"?

Case Playback: After an illegal operation, Windows XP “Search Assistant” becomes a “whiteboard”. Not only that, but the “User Account” item in “Control Panel” also appears “faceless”. Click "Start → Help and Support", the mouse flashes but there is no trace of the "Help and Support" program interface.

Case Study: By feeling, I believe that a DLL file in the system has been logged out, lost or damaged. But almost every program in Windows has to call up to hundreds of DLL files. If you look for analysis one by one in the usual way, it is tantamount to finding a needle in a haystack. Considering that three programs are "disfigured" at the same time, they should be affected by the same (or several) DLL files. To do this, you must find the DLL file that is used together by the above three programs, and then find out the "behind the scenes".

Finding and Comparing

Step 1: Start with the Search Assistant and find out the “life experience”. Open "Search Assistant" on another machine with Windows XP, and press Ctrl+Alt+Del to bring up the "Task Manager". In the "Applications" tab, select "Search Assistant" and right click, select "Switch" To the process", huh, it turned out to be part of Explorer.exe (resource manager).

Step 2: Use a similar method to know that "Help and Support" belongs to the process Helpctr.exe, but in the "User Account", you can only use the method of observation and comparison to find out the home process mshta.exe.

Tips

You can determine the process to which you belong by comparing the changes in the Task Manager by opening or closing the User Account. You can also open the Search Assistant. Enter "tasklist /fo table>C:\\acc1.txt" in the "Command Prompt". After closing the program, enter "tasklist /fo table>C:\\acc2.txt" in the "Command Prompt" Then use the fc command to compare "fc C:\\acc1.txt C:\\acc2.txt>C:\\acc.txt", and the extra items obtained by the comparison are the processes to which the program belongs.

Step 3: Restart the computer. Please check the software LISTDLLS. Download the software here, then move listdlls.exe to C:\\Windows, press Ctrl+R to open the "Run" box, type "cmd", and type in the "Command Prompt":

listdlls -r explorer .exe>C:\\explorer1.txt.

Then open the "Search Assistant" and type again in the "Command Prompt": listdlls -r explorer.exe>C:\\explorer2.txt

Finally compare with the fc command: < Br>

fc C:\\explorer1.txt C:\\explorer2.txt>C:\\explorer.txt.

This opens the C:\\explorer.txt file. The extra file after comparison is the DLL file called by the Search Assistant.

Tips

The usage of ListDlls is: listdlls [-r] [processname pid] or listdlls [-r] [-d dllname]

Step 4: Restart On the computer, use the command "listdlls -r helpctr.exe>C:\\helpctr.txt" to get the DLL file used by "Help and Support". The restart here is to unload the DLL files that have not been used from the memory.

Step 5: Restart again, use the command "listdlls -r mshta.exe>C:\\mshta.txt" to get the DLL file used by the "user account".

Filtering the last "true murder"

Analyze the DLL file in explorer.txt, where the file directory contains "srchasst", which are all files called by the "search assistant". The remaining files are sxs.dll, vbscript.dll, and JScript.dll files in the C:\\Windows\\system32 directory. Using the "search" method, you can find that the above files exist in the files helpctr.txt and mshta.txt. It seems that the "culprits" are not the three.

Back to the original computer, I found that all three files existed and were not damaged. Register with the regsvr32 command. Sure enough, after registering the jscript.dll file (using the command regsvr32 JScript.dll), the "whiteboard" program finally restored its beautiful "face".

Xiaobian has something to say:

Many software failures in the system are caused by DLL files. In the past, we often paid more attention to whether the DLL file was lost. In fact, there are still many reasons why no registration was successful. After reading the method described in this article, we can easily filter out the DLL file that caused the failure and finally solve the problem.