I would look to sysinternals.com and a program called handle.exe that can dump the currently open file handles (and filenames) of a process running as a service.

The other goodie might be TLIST.EXE to dump the currently open DLLs a process running as a service will have open.

-Shawn