4

Is there a way to detect which changes a program makes to your computer? Like new files created, registry changes, anything like that?

2 Answers 2

3

You can do this using Process Monitor.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

enter image description here

4
  • 1
    Awesome.. That more than fits the description of exactly what I was looking for :D Thanks
    – user141542
    Aug 10, 2012 at 9:30
  • @Tom Wijsman - Can I assume this would be helpful for debugging if a malicious script had (for example) disabled all the system Services?
    – Dave
    Aug 10, 2012 at 9:31
  • @DaveRook - You might want to look at Mark Russinovich's blog posts, where he shows examples of these: technet.microsoft.com/en-us/sysinternals/bb963890.aspx
    – Isxek
    Aug 10, 2012 at 9:47
  • @DaveRook: Yes, it does, you'll see the process that runs the script change the start type of some services in the registry. Aug 10, 2012 at 10:10
0

Back in the day, winpooch used to do this, but this stopped working with XP SP2.

Trackwininstall would work for this in theory - the website's in german but they link to a google translated english version, I'm away from my test systems so I haven't tried it out yet

Some uninstallers may do this as part of the uninstall process - revo uninstaller's professional version may do this as part of its real time installation manager.

You could also use procmon, as Tom suggested to monitor filesystem changes and registry changes - this is the lowest level, generic way to do this, but may need you to set up filters as needed. I referenced this thread for this answer, and it might be useful for your own reference.

You must log in to answer this question.