Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a virus file that gets re-created by some other infected file/process. Antivirus catches it, but the file still gets created once in a while.

Is there a way to figure out/catch which process created the file? I'm open to any solutions. If it requires a 3-rd party app, so be it. This is all happening on a Win7 32-bit MacBook Pro. Thanks!

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Process Monitor, from SysInternals, might be what you're looking for. It can be filtered to show just filesystem changes, and then you have the enviable task of filtering it manually to exclude the usual things like Windows Explorer.

EDIT: As a side-note, you may be able to eliminate the malware completely with ComboFix. This is available from BleepingComputer (but does not work on 64-bit Windows).

share|improve this answer
2  
You can also add a filter to show only the CreateFile operations (and derivatives) to help you narrow it down. –  heavyd Sep 28 '10 at 3:13
    
Does ComboFix still work with Windows 7? My impression was it only worked on Windows XP (probably even Windows 2k). –  Isxek Sep 28 '10 at 8:05
    
The newest version (it updates very frequently) does work on Vista and 7, but only 32-bit. –  user3463 Sep 28 '10 at 15:31
    
@heavyd Thanks for that tip on CreateFile. –  user3463 Sep 28 '10 at 15:32
    
THanks a bunch. I'll try both of those methods –  MK_Dev Sep 28 '10 at 16:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.