Cheat Engine

[Chase Payne]

I have a undetected malware that is starting to annoy me:
http://forums.mozillazine.org/viewtopic.php?f=38&t=1954541&p=9678755#p9678755

And the only way to fix is by a bat file I made, but I'd rather remove it from my computer completely.

Are there any tools where I can prevent ANY changes to a certain folder, or find out what is changing it, like a troubleshoot?


Setting it to read only won't work, and again I wish too have the malware removed.

NOTE: THIS MALWARE DOES NOT HARM MY COMPUTER, IT ANNOYS IT BY DELETING A FILE AND REPLACING IT WITH A FAKE SEARCH ENGINE.

IT IS ALSO NEW, AND UNDETECTED FOR NOW.

[Notepad]

You can use a HIPS program to prevent changes.

Defense Wall would stop it from modifying anything but I'm not sure if it includes removal.

[Hero]

Eset detects app changes and gives the option to deny it. Not sure if there is a program that can detect what exctly is altering. A lot of programs alter them selves without a virus too. If this is a firefox issue its self, you could try making a new profile.

[Chase Payne]

It's a malware inside my computer that is undetected, it doesn't change anything to firefox, so it bypasses my ESET.


It simply waits for firefox to close, deletes google.xml and replaces it with a modified one to sen you to another search engine.

Even if you reinstalled firefox, same issue.

if anyone is good at hijack logs... look at this

http://pastebin.com/8hd7nXSJ

[Domoo]

Use a different browser.


inb4browserwars

[Chase Payne]

This malware affects all known browsers, including Google Chrome.

[SF]

ProcessMonitor will tell you what process is doing what. You can set up filters and crap too to narrow the results.

[kls85]

Sysinternals has program which monitors every single files that's being used in real time.

It's called Process Monitor
old name: file mon

Also it might not be a malware, but a rootkit so you can do is either
run gmer, combofix, or use hijackthis to see if you can manually delete it.

edit
SF beat me to it.