Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a virus file that gets re-created by some other infected file/process. Antivirus catches it, but the file still gets created once in a while.

Is there a way to figure out/catch which process created the file? I'm open to any solutions. If it requires a 3-rd party app, so be it. This is all happening on a Win7 32-bit MacBook Pro. Thanks!

share|improve this question
up vote 3 down vote accepted

Process Monitor, from SysInternals, might be what you're looking for. It can be filtered to show just filesystem changes, and then you have the enviable task of filtering it manually to exclude the usual things like Windows Explorer.

EDIT: As a side-note, you may be able to eliminate the malware completely with ComboFix. This is available from BleepingComputer (but does not work on 64-bit Windows).

share|improve this answer
You can also add a filter to show only the CreateFile operations (and derivatives) to help you narrow it down. – heavyd Sep 28 '10 at 3:13
Does ComboFix still work with Windows 7? My impression was it only worked on Windows XP (probably even Windows 2k). – Isxek Sep 28 '10 at 8:05
The newest version (it updates very frequently) does work on Vista and 7, but only 32-bit. – user3463 Sep 28 '10 at 15:31
@heavyd Thanks for that tip on CreateFile. – user3463 Sep 28 '10 at 15:32
THanks a bunch. I'll try both of those methods – MK_Dev Sep 28 '10 at 16:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .