Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

As we know, virus and malware will change or replace the important files on our system,is there any way to know it when this change happened?it is for windows 7,by the way.

share|improve this question

3 Answers 3

the .NET Framework has a FileSystemWatcher component, which you can use to monitor file structures for changes, I assume you could, if you were inclined, either write a powershell component to monitor and log changes to certain folders, or a full-blown windows forms application.

This might be useful if you were expecting certain changes to happen, such as file downloads, file updates during an installation, or similar.

Are are you trying to determine when files changed after a malware infection ?

Personnaly I prefer prevention and run an effective Anti-Virus / Spyware application (My personal recommendation, the one I sing from the rooftops about, is VIPRE from Sunbelt Software (www.sunbeltsoftware.com) . I have it running on my desktop, laptop and netbook machine.

EDIT: If you want a GUI application then I'd highly recommend ProcessMonitor from www.sysinternals.com

share|improve this answer

There is a tool for spotting the signs of shady things happeing called the 'RootkitRevealer' on the sysinternals site.

They also have other tools for monitoring the filesystem and registry for changes in real time. Procmon is one of those. There are a lot of other useful utilities on the SysInternals site that you may find useful too.

share|improve this answer

If you know the location of the file you want to modify www.FolderTrack.com may be a good solution. It is free if you use discount code: bos.

This depends on the virus though.

Disclaimer I wrote FolderTrack

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.