Identify process that is creating a file

71 views Asked by At

I sometimes get a file called tmp#####.tmp.bat in my user/appdata/local/temp folder I am suspecting its created by some Cannon printter utilities I thought I would put a FileSystemWatcher on the folder and catch the creator in the act I can catch the creation of the file, but how do I identify the process creating it? Any ideas? I would like to log the creation and the process name creating it.

1

There are 1 answers

0
Bill On

Ive found the .tmp.bat is part of a package called ITSupport247 I dont know how it got onto my box, but I suspect it was silently installed along with other software updates.

I found it by running ProcessMonitor, filtering for path contains .tmp.bat, and just letting it run until I started getting some events.

Should have thought of ProcessMonitor right away.