Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to detect which changes a program makes to your computer? Like new files created, registry changes, anything like that?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You can do this using Process Monitor.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

enter image description here

share|improve this answer
1  
Awesome.. That more than fits the description of exactly what I was looking for :D Thanks –  user1071461 Aug 10 '12 at 9:30
    
@Tom Wijsman - Can I assume this would be helpful for debugging if a malicious script had (for example) disabled all the system Services? –  Dave Rook Aug 10 '12 at 9:31
    
@DaveRook - You might want to look at Mark Russinovich's blog posts, where he shows examples of these: technet.microsoft.com/en-us/sysinternals/bb963890.aspx –  Isxek Aug 10 '12 at 9:47
    
@DaveRook: Yes, it does, you'll see the process that runs the script change the start type of some services in the registry. –  Tom Wijsman Aug 10 '12 at 10:10

Back in the day, winpooch used to do this, but this stopped working with XP SP2.

Trackwininstall would work for this in theory - the website's in german but they link to a google translated english version, I'm away from my test systems so I haven't tried it out yet

Some uninstallers may do this as part of the uninstall process - revo uninstaller's professional version may do this as part of its real time installation manager.

You could also use procmon, as Tom suggested to monitor filesystem changes and registry changes - this is the lowest level, generic way to do this, but may need you to set up filters as needed. I referenced this thread for this answer, and it might be useful for your own reference.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.