Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to detect which changes a program makes to your computer? Like new files created, registry changes, anything like that?

share|improve this question
up vote 4 down vote accepted

You can do this using Process Monitor.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

enter image description here

share|improve this answer
Awesome.. That more than fits the description of exactly what I was looking for :D Thanks – user1071461 Aug 10 '12 at 9:30
@Tom Wijsman - Can I assume this would be helpful for debugging if a malicious script had (for example) disabled all the system Services? – Dave Aug 10 '12 at 9:31
@DaveRook - You might want to look at Mark Russinovich's blog posts, where he shows examples of these: – Isxek Aug 10 '12 at 9:47
@DaveRook: Yes, it does, you'll see the process that runs the script change the start type of some services in the registry. – Tom Wijsman Aug 10 '12 at 10:10

Back in the day, winpooch used to do this, but this stopped working with XP SP2.

Trackwininstall would work for this in theory - the website's in german but they link to a google translated english version, I'm away from my test systems so I haven't tried it out yet

Some uninstallers may do this as part of the uninstall process - revo uninstaller's professional version may do this as part of its real time installation manager.

You could also use procmon, as Tom suggested to monitor filesystem changes and registry changes - this is the lowest level, generic way to do this, but may need you to set up filters as needed. I referenced this thread for this answer, and it might be useful for your own reference.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .