Spyware file handles

[rbdietz]

What application would possibly want to open a source code file while I was working on it? To get the answer to that question I turned to Process Explorer. I opened Process Explorer, clicked on the Find Handle toolbar button, and entered “dfrgcmdr.cppâ€, the name of the file in question, as the search text. Process Explorer populated the search results with one entry that identified the guilty process and when I double clicked on the entry I was taken to the specific handle representing the open of the file in Process Explorer’s handle view for that process:

Mark's BlogHe's not talking about spyware, but this technique can probably be applied to some troublesome spyware that keeps restoring deleted files (actual deleted files - not just deleted registry entries).