Is there a way to detect which changes a program makes to your computer? Like new files created, registry changes, anything like that?
2 Answers
You can do this using Process Monitor.
Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.
-
1Awesome.. That more than fits the description of exactly what I was looking for :D Thanks– user141542Aug 10, 2012 at 9:30
-
@Tom Wijsman - Can I assume this would be helpful for debugging if a malicious script had (for example) disabled all the system Services?– DaveAug 10, 2012 at 9:31
-
@DaveRook - You might want to look at Mark Russinovich's blog posts, where he shows examples of these: technet.microsoft.com/en-us/sysinternals/bb963890.aspx– IsxekAug 10, 2012 at 9:47
-
@DaveRook: Yes, it does, you'll see the process that runs the script change the start type of some services in the registry. Aug 10, 2012 at 10:10
Back in the day, winpooch used to do this, but this stopped working with XP SP2.
Trackwininstall would work for this in theory - the website's in german but they link to a google translated english version, I'm away from my test systems so I haven't tried it out yet
Some uninstallers may do this as part of the uninstall process - revo uninstaller's professional version may do this as part of its real time installation manager.
You could also use procmon, as Tom suggested to monitor filesystem changes and registry changes - this is the lowest level, generic way to do this, but may need you to set up filters as needed. I referenced this thread for this answer, and it might be useful for your own reference.