Looking for software to monitor installations

Question

I am looking for software that would allow me to monitor (and preferably also undo) changes made to the OS (files added or modified, changes to the Windows registry, etc.).

So this is mainly for Windows 7, but if a version of the software exists for Linux then that would be a plus. If the software can be run as a service then that would be another plus.

This would be for a single user (not for a corporation) and I am OK with spending some money on the license (e.g. less than $100 USD). It does not need to be open source.

The reason for this is that I am interested in doing some malware research.

Any recommendations for this kind of software?

Answer 1

Regshot is really good for registry comparison. Run it before you install a program and then after you install and then compare them. It can take up a good amount space for each "shot" (100+ mb). It is very detailed and can be super useful.

http://sourceforge.net/projects/regshot/

Regshot is a small, free and open-source registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between the two snapshots. In addition, you can also specify folders (with subfolders) to be scanned for changes as well.

Answer 2

You should consider Process Monitor (Windows only). It provides:

...real-time file system, Registry and process/thread activity.

While it does not supply a way to “undo” changes, it does provide a myriad of monitoring capabilities including:

• More data captured for operation input and output parameters

• Non-destructive filters allow you to set filters without losing data

• Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation

• Reliable capture of process details, including image path, command line, user and session ID

• Configurable and moveable columns for any event property

• Filters can be set for any data field, including fields not configured as columns

• Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data

• Process tree tool shows relationship of all processes referenced in a trace

• Native log format preserves all data for loading in a different Process Monitor instance

• Process tooltip for easy viewing of process image information

• Detail tooltip allows convenient access to formatted data that doesn't fit in the column

• Cancellable search

• Boot time logging of all operations

It’s free and provides immediate monitoring versus a comparison after the fact.

Answer 3

I was a happy user of InstallWatch Pro by Epsilon Squared (former website: www.epsilonsquared.com), but it seems the company has disappeared and you can only get it from other sites such as Canadian Content.

It works on Windows 7 and due to the nature of the OSes, the same program does not run on Linux (it would need to be a different program of the same company maybe).

It is available free of charge:

InstallWatch 2.5 is provided to you free of charge

All we ask is that you register your e-mail address at the end of the installation if you wish to receive information on future updates.

Registration via email is optional, just uncheck the box at the end of the installation.

It can monitor the Registry and the files changed during an installation. It does so by generating a snapshot before and after the installation.

Disadvantages:

• it seems you won't get any updates or support since the company disappeared.
• the installation was not digitally signed, so there could be drive-by-download attacks with malware.
• due to the way it works (snapshot), any files that are changed by other programs will be reported as well, so be sure to close any other applications and even try icons for best results.

I am not allowed to suggest programs I have no personal experience with, but you could google for "alternatives to InstallWatch" in order to find up-to-date versions with similar capabilities.