Firewall security logging

Hi,

I have a problem that from time to time infected files are created in my PC. My antivirus immediately deletes it but later these files are created again and again. I noticed that when my PC is disconnected from Internet it doesn’t happen.

Usually these are files infected by “Brontok.CV worm”.

I suspect that there’s somewhere a “hole” in my firewall and/or some application “imports” these infected files.

I tried to compare the time when the infected file was caught and the Firewall security logging timestamps.

The problem is that the firewall security logging doesn’t show what application opened the connection. How can I get this information to find the hole in my firewall?