Is there a way to find out what process created certain file?

Question

I have a virus file that gets re-created by some other infected file/process. Antivirus catches it, but the file still gets created once in a while.

Is there a way to figure out/catch which process created the file? I'm open to any solutions. If it requires a 3-rd party app, so be it. This is all happening on a Win7 32-bit MacBook Pro. Thanks!

Solution

Process Monitor, from SysInternals, might be what you're looking for. It can be filtered to show just filesystem changes, and then you have the enviable task of filtering it manually to exclude the usual things like Windows Explorer.

EDIT: As a side-note, you may be able to eliminate the malware completely with ComboFix. This is available from BleepingComputer (but does not work on 64-bit Windows).

Comments

[heavyd]

You can also add a filter to show only the CreateFile operations (and derivatives) to help you narrow it down.

[Admin]

The newest version (it updates very frequently) does work on Vista and 7, but only 32-bit.