Wrote a little utility for myself. Put it on https://sourceforge.net/projects/filechangeswatcher/
Sourceforge says that he found virus signature.
Of the functions use a FileSystemWatcher, there is a function that prescribes a program in startup user (but is invoked as a separate item on the menu). What's the catch?
Colleagues, so stupid palitsya I wouldn't. A program grind is very long and it's a shame that after so much pain it is taken for the virus. Work Kaspersky anti-virus is silent.