Log application changes made to the system

Posted by Maxim Veksler on Super User See other posts from Super User or by Maxim Veksler
Published on 2010-04-21T08:39:01Z Indexed on 2010/04/21 8:44 UTC
Read the original article Hit count: 504

Filed under:

windows-7

|

malware

|

tracing

|

analysis

|

computer-behavior

Hello,

Windows 7, 64bit.

I have an application which I don't trust but still need to run.

I would like to run the installer of this application and later on the installed executable under some kind of "strace" for windows which will record what this application did to the system.

Mainly:

What files have been created / edited?
What registery changed have been made?
To what network hosts did the application tried to communicate?

Ideally I would also be able to generate a "UNDO" action to undo all the changes.

Please don't suggest full Virtualization solutions such as Virtualbox, VMWare and co. because the application should run in the host system (A "sandbox" approach will OTHO be accepted, IMHO).

Do you any such utility I can use?

Thank you, Maxim.

© Super User or respective owner

Related posts about windows-7

Server 2012 DFS New Member Issue

as seen on Server Fault - Search for 'Server Fault'
I am trying to add a new member to our DFS topology. We have 3 DCs (VMs - VMware) running Windows server 2012, two servers are located in or Primary site and the third at our DR site. Currently the two servers at our primary site are currently replicating DFS (full mesh) and are working fine. I have… >>> More
error in IIS7 but not on IIS6

as seen on Server Fault - Search for 'Server Fault'
I have a website that is we are now deploying to windows 2008 servers that has worked in the past on IIS6 without a problem. It is using .net 2 framework. Most of the website works. Just when we create a screen report over a certain size on the server we get this error. Event code: 3005 Event… >>> More
error in IIS7 but not on IIS6

as seen on Server Fault - Search for 'Server Fault'
I have a website that is we are now deploying to windows 2008 servers that has worked in the past on IIS6 without a problem. It is using .net 2 framework. Most of the website works. Just when we create a screen report over a certain size on the server we get this error. Event code: 3005 Event… >>> More
Microsoft Management Console stops working when I add snap-in to it

as seen on Super User - Search for 'Super User'
I have Windows 7 Ultimate OS. I'm opening mmc.exe as administrator and trying add Certificates or any other snap-in, then while loading that snap-in MMC breaks and displays following message and after that it closes automatically once I click on close button on that message. What could be the problem… >>> More
Handling keyboard and mouse input (Win API)

as seen on Game Development - Search for 'Game Development'
There is a number of ways to catch mouse or keyboard under Windows. So I tried some of them, but every of them has some advantages and drawbacks. I want to ask you: Which method do use? I've tried these: WM_KEYDOWN/WM_KEYUP - Main disadvantage is that, I can't distinguish between left and right-handed… >>> More

Related posts about malware

Open dns still detects malware activity after having scanned and removed malware

as seen on Super User - Search for 'Super User'
I'm using open dns to block unwanted sites. Everytime I go to the dashboard I always see this malware activity in all of the networks that I have in open dns. What do I do?I'm using avast free, spybot, and sas. And used them all to full scan the system. And they have removed the malware. But I still… >>> More
HTG Explains: Do Non-Windows Platforms Like Mac, Android, iOS, and Linux Get Viruses?

as seen on How to geek - Search for 'How to geek'
Viruses and other types of malware seem largely confined to Windows in the real world. Even on a Windows 8 PC, you can still get infected with malware. But how vulnerable are other operating systems to malware? When we say “viruses,” we’re actually talking about malware in general… >>> More
How to Use An Antivirus Boot Disc or USB Drive to Ensure Your Computer is Clean

as seen on How to geek - Search for 'How to geek'
If your computer is infected with malware, running an antivirus within Windows may not be enough to remove it. If your computer has a rootkit, the malware may be able to hide itself from your antivirus software. This is where bootable antivirus solutions come in. They can clean malware from outside… >>> More
Not All “Viruses” Are Viruses: 10 Malware Terms Explained

as seen on How to geek - Search for 'How to geek'
Most people seem to call every type of malware a “virus”, but that isn’t technically accurate. You’ve probably heard of many more terms beyond virus: malware, worm, Trojan, rootkit, keylogger, spyware, and more. But what do all these terms mean? These terms aren’t just… >>> More
Keep Malware Off Your PC With Sandboxie

as seen on Internet.com - Search for 'Internet.com'
Malware can infect your PC from anywhere on the Web. Sandboxie, a free application, blocks it. >>> More