Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As we know, virus and malware will change or replace the important files on our system,is there any way to know it when this change happened?it is for windows 7,by the way.

share|improve this question

the .NET Framework has a FileSystemWatcher component, which you can use to monitor file structures for changes, I assume you could, if you were inclined, either write a powershell component to monitor and log changes to certain folders, or a full-blown windows forms application.

This might be useful if you were expecting certain changes to happen, such as file downloads, file updates during an installation, or similar.

Are are you trying to determine when files changed after a malware infection ?

Personnaly I prefer prevention and run an effective Anti-Virus / Spyware application (My personal recommendation, the one I sing from the rooftops about, is VIPRE from Sunbelt Software ( . I have it running on my desktop, laptop and netbook machine.

EDIT: If you want a GUI application then I'd highly recommend ProcessMonitor from

share|improve this answer

There is a tool for spotting the signs of shady things happeing called the 'RootkitRevealer' on the sysinternals site.

They also have other tools for monitoring the filesystem and registry for changes in real time. Procmon is one of those. There are a lot of other useful utilities on the SysInternals site that you may find useful too.

share|improve this answer

If you know the location of the file you want to modify may be a good solution. It is free if you use discount code: bos.

This depends on the virus though.

Disclaimer I wrote FolderTrack

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .