Recently i found a trojan program running in my system, it copies some random name exe to my drives(except C:) and also copies random name exe to temp and which in turn asks firewall network connection request(from this i figured it’s trojan)..also it changes the registry value for hidden files….
The main problem is that i can’t find it in taskmanager…even checked all svchosts process location…im stuck!
So is there any way i can monitor particular registry key and know which program is modifying it…?
Thnx!!
Look at RegMon:
http://technet.microsoft.com/en-us/sysinternals/bb896652