Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of our companies server seems to have fallen victim to a php backdoor attack. I've managed to located and close several holes, but one seems to persist that is writing a php/webshell backdoor into our C:/windows/temp.

Microsoft Security Essentials seems to do a good job of detecting this threat and removing it before it can execute but the problem is I need to view the file security properties to see which app pool is creating these files (we have about 16 different sites on this server).

Does anyone know of a program/way that I can to monitor file writes to C:/windows/temp?

share|improve this question
up vote 2 down vote accepted


You should restore from a known good backup. At the very least, scan the server offline using a rescue CD of some kind. With that out of the way...


Use Process Explorer to see deeply into process and file activity. You can also use security policy to audit filesystem access. However, since the server is compromised, I wouldn't trust anything that it tells me.

Nuke it from orbit! (Click the picture! You'll like it!)

share|improve this answer
thanks, going to try the audit – NSjonas Apr 11 '12 at 22:43

For the one-off answer, Microsoft Sysinternals Process Monitor will watch any file activity that you desire and a bit more.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.