Slashdot Mirror
Tracking Changes to a Windows System?
The Watcher asks: "I was at my parents house over the weekend trying to remove various adware/spyware/annoying software, things like Kazaa, Bonzi Buddy, etc.. During this I thought it would be helpful to know things like exactly what files/folders were created/modified and what registry entries were created/modified by an installer program so that I would not have to rely on the supplied uninstaller that only removes a selected subset of what was installed. So what are some preferred utilities out there that work well for this purpose?"
For adware/spyware, use Spybot and Ad-Aware for this.
For the average program, Windows XP comes with a very nice utility that allows you to restore your setup to a previous day. I've found it to be very useful. Don't know about more generic utilities for older Microsoft OSes.
Free sotftware, and does a nice job.
installwatch pro
It will even make an install program for you with the changes!
(stolen from DaBum) I am dyslexia of borg - your ass will be laminated.
Both these utilities from SysInternals allow you to log realtime entries to a file. turn them on when you install something and you have a log of everything the installation program touched.
RegMon
This monitoring tool lets you see all Registry activity in real-time. It works on all versions of WinNT/2K, Windows 9x/Me and Windows 64-bit.
FileMon:
This monitoring tool lets you see all file system activity in real-time. It works on all versions of WinNT/2K/XP, Windows 9x/Me, Windows XP 64-bit Edition, and Linux.
Adaware - http://www.lavasoftusa.com/software/adaware/
Both are freeware.
I hate to reply to myself, but i felt i should clarify my previous post. (WHEN will slashdot allow you to edit oyur own posts? PLEASE?)
What you do is this:
1) get the computer in the state you want it, then put InstallRite (not install watch) on the box, and tell InstallRite to take a snapshot.
2) configure InstallRite to start with windows so it will intercept all setup programs, and take before and after snapshots automatically.
3) leave the system knowing that you will have a good idea later of what has been installed since your last visit, and how to fix problems these installs may have made.
(stolen from DaBum) I am dyslexia of borg - your ass will be laminated.
Some of these programs create certain files and registry keys when they are installed; but many applications create MORE files and registry keys when they are first run or possibly even each time they are started... This is particularly true of spyware-containing applications that check to make sure the spyware is there and active each time they start up. Monitoring the installer is only half the battle.
http://www.spywareinfo.com/~merijn/index.html
It's a little like using a tactical nuke to take out a mosquito, but turning on Windows auditing, and using something like 'Snare for Windows' to set file auditing, would probably accomplish the task. (Disclaimer: Snare developer).
Slightly more realistically, there are a few tripwire derivitives that may be of some use to you - though these often require a fair bit of administrative overhead, so probably are not appropriate for a parental PC.
But perhaps the easiest way is to use the windows 'search' utility - it will tell you which files have been modified in the last (x) days. Alternatively, there's a port of the unix 'find' command available (both under cygwin, and native). Note though that if the trojan/virus modifies the mtime back to original state, these approaches are not too useful.
Red.
Give them an account named "install" that has admin, and explain that it's very dangerous to use that for anything but installing store-bought CD software.
I doubt that your parents were using kaza, so that means that someone installed it. Set them up with a separate user account that can not install that crap. If they are only web browser, than get a different OS.
I don't want to talk my dad through this stuff, so I told him to buy a Mac. User friendly and virus proof so far. It's all he needs for web browser and reading e-mail.
Winblows should not be used by 'average' users, it is too hard to maintain and too insecure.
Seriously, you need to determine it they NEED winblows.
no
I use WinInstall LE for this purpose. It is included on the Windows 2000 Server CD and can also be downloaded from here... It is used primarily to repackage an application install as a MSI file, but it produces a text file that shows all file system and registry changes between the before and after snapshots.
Looking out for new/modifed files isn't always going to help you unfortunately. Badly written application installers will stomp on common DLLs, overwriting them with their own particular version. Sometimes they'll just upgrade the common DLL with a later -- and mostly compatible -- version. If you go just looking to remove the files that have been "touched" after the install, you run the risk of removing a DLL that was previously in use by other applications. Welcome to what is affectionately known as "DLL Hell".
.NET subsystem (hand me my shotgun Jeeves: there's another flock of pigs overhead), all DLLs will be able to sit in side-by-side more whereby multiple versions can exist; however, this is a long ways away.
The real culprits here are the crappy installers. The sooner all Windows apps are installed using MSI (microsoft installer) services, the easier it will be to audit and rollback, and monitor what is going on. MSI's scope is enormous: it is fully transactional; it audits/logs everything, and it supports every option you could wish for. However, because of this, it is inherently complex and not everyone is using the API: it's gone through 3 versions already.
Once Windows is built entirely on a JIT'ed
- Oisin
PGP KeyId: 0x08D63965
Many years ago when Win95 first came out I bought a program called "Uninstaller Pro" or something like that. Basically, it inventoried every file on the system, and copied the registry before every program installation. Then after the install it would take another file/registry inventory and diff the results. Anything changed is what the installer did.
Then when you wanted to dump the program you use it to eradicate everything in the diff file.
IIRC, it was a Symantec product, but you know it's pushing 10 years here, and I honestly can't remember. Maybe you can look for something that works similar.
Set up a daily scheduled event (yes, Windows can do that) that runs a batch file that:
/s :
dir
for each drive and then export a copy of the registry (I believe the Windows registry tools will export from a command-line, if not Perl could do so easily).
Keep 2 days of files, the current day and the previous day. At the end of the batch run a diff (I think DOS had a diff utility under a different name, if not get one of the ported versions of the real diff) and just store the diffs of the 2 days long term.
Perhaps once per month keep 1 full copy of the dir and registry results, cleaning them up on a yearly basis perhaps, just as a referrence in case you need to shuffle through the diff'ed results.
It is more productive to voice thoughtful opinions (reply) than to judge (moderate) others.
This is dependent on what your folks are running, but you if you're concerned about removing what they've installed (purposefully or inadvertently) you may want to reinstall Windows, get everything setup properly and then run System Restore to save the system state at that moment. This way, when they call you telling you "XYZ is happening! Gator has taken over everything!" you can run system restore and roll back to where you were before, and scold your parents that if they install more crap, they'll get more of the same. I realize this might seem overkill, but it does get to the root of the problem rather quickly (having to get rid of all the crap inexperienced users installed)
Used to be from Roxio, but symantec bought it. It's like a logging filesystem that lets you revert data to a point in the past. Maybe not idea for this situation because it only stores the last 10% or so of disk activity, older events get forgotten, so depending on system activity this could be anything from days to months of history.
Doesn't 'track' anything per say, however, on each reboot, the machine goes back to the state it was before hand.
I use it at work, and give the employees limited access to specific folders, and have trained them to save their files in those few spots.
This way, only when they have approached me, and requested a particular application, i.e. winamp, excel, word, what have you they can have it installed and leave it permanently.
It's cut the spyware / adware / whatever to near zero. Webshots being the largest of the problem.
Anyways you can check out deep freeze at http://www.deepfreezeusa.com/index.htm
The question was what software can be used to track filesystem and registry changes, not what tools will remove the spyware.
While PCMag has made their old utilities available by online subscription only, theere are a few folks on the net who have copies up of some of them. One utility that's FANTASTIC for tracking file/registry/ini-file changes/creations/removals is called In Control 5, or InCtrl5. Super simple to use, with multiple report formats (TXT, HTML, CSV, etc.) and I love it. Works on all Windows versions because it's totally non-invasive. If you can't find it, email me and I'll make a copy available. They're all free, and were freely available, they just restrict the downloads now to squeeze more money from the now discontinues Utility section (one of the last really useful parts of the magazine).
jX [ Make everything as simple as possible, but no simpler. - Einstein ]
I believe Total Uninstall does exactly what you want. A warning though, for most programs, you do not really want to monitor all changes manually, that's just a lot of work. And that's why there are such things as installers in the first place.
If you have XP pro (don't know about home) you can turn on auditing. This will track every file written/read/modified/moved/deleted/created as well as failed attempts to do so.
Windows XP (and ME, I think) have a feature called "System Restore". Basically, what it does is track changes to the registry, driver database, and other parts of the system. It takes snapshots of the system periodically and sometimes during the installation of hardware or certain drivers.
:)
If you break something (as I have been known to do from time to time), you can "roll back" to a previous snapshot. In my experience, this works pretty well for solving certain problems.
I'm not sure if it tracks installed software or whether such software would automagically be removed by rolling back. But the snapshots must have some such information in them, if only we could extract it...
Install cygwin and generate sha1sum's of all files. Compare old sums to new sums later. Doesn't help with the registry though.
-73, de n1ywb
www.n1ywb.com
You can get a sort of 'tripwire for Windows,' as well as other security tools, from www.gfi.com.
Vintage computer games and RPG books available. Email me if you're interested.
Allow editing of posts as long as
a) They were not moderated, and
b) They were not replied to.
http://www.ashampoo.com/frontend/products/php/prod uct.php?idstring=0103&session_langid=2
It does the job of creating snapshots of the file-system & registry before & after installing a program, then uses these to create a log file that can be used to roll back the changes. Many options, quite flexible. It has saved my sanity many times.
MSI's scope is enormous: it is fully transactional; it audits/logs everything, and it supports every option you could wish for. However, because of this, it is inherently complex and not everyone is using the API: it's gone through 3 versions already.
Can the Microsoft Installer packager work on systems whose only native compiler is MinGW, or does it require a Microsoft Visual Studio license? If the latter, watch free software for Windows (such as GIMP, Gaim, Foobar2000, and the like) stick to Nullsoft's free packager.
I think I have just the thing for comparing old/new registry snapshots -- RegShot. .reg files), but otherwise it's a neat, simple, effective program.
It's free (as in beer).
You can make snapshots of certain points in time, and compare shots for differences. Unfortunately, the snapshots themselves are garbled (iow it's not standard
I use this (and RegTick) to manage and lock down a bunch of computers at a youth center, and it's working quite nicely.
"Good news, everyone!"
I used to use a tool called ConfigSafe. It did a pretty decent job of showing what changed relative to a snapshot run from the tool.
I haven't used it in a couple years though so I can't say how well it works with Windows XP. I found that the newer Windows OS and apps were too complex to easily decipher the results.
"No matter where you go, there you are." -- Buckaroo Banzai
Why not use a host-based intrusion detection system? They track changes made to the filesystem/registry.
Ionx's Data Sentinel (http://www.ionx.co.uk) is a great one for Windows. I use it at work, and it's the dogs'. Very simple to setup and use, if you can spare the 199.99, I highly recommend it.
There's probably some free (but more basic) ones out there too.
Take a butchers hook (look) at http://www.computerhope.com/fchlp.htm ... contains switch info etcetera
Obviously "end users" refers to accounts
I made a mistake in getting my point across. I asked because it could be taken either way: either end users should use separate accounts for daily use of the computer and for administration (which I called the "accounts" way), or end users should not have access to accounts with admin-group privileges at all and must hire a professional to admin the computer (which I called the "people" way). I have read reports of Microsoft eventually shooting for the latter to increase the strength of the digital restrictions management and user lock-in aspects of its operating system.
I still prefer filemon and regmon.
I am Bennett Haselton! I am Bennett Haselton!
- filestat.exe - prints out the file dates and checksum - very handy if you suspect virus infection.
- profile.exe (not the Windows XP command!) - This prints a recursive list of the files in a directory with checksums. It also counts the number of directories and files, so you can see what has changed at a glance.
- changectl.exe - can compare large text files
- incback - an incremental backup utility which can be used to selectively copy files. You can use this to filter out which files have changed most recently.
Granted, their still in beta form, but if you're interested, reply and I'll send you the source. I'm also working on a system installer...The society for a thought-free internet welcomes you.
I've been looking for something similar, though for different reasons. Basically I want to audit a computer's drive contents+registry before installing a program, then after, and track the changes (registry changes, files added, files removed, files changed).
With that being done, I would then like to compile all the changes into an archive/script which would allow me to duplicate them on a seperate machine. It would be really nice for network-based installs so that when I'm doing 30+ machines I don't have to insert/remove a CD a bazillion times just to upgrade office or whaetever.
IBM included this with my Thinkpad. Does what you describe, and prompts you to take a snapshot when something's about to change.
Ad-Aware is "questionable" I have had friends who use it and are still complaining about spyware, I come over remove it, install Spybot and clean the system, I never hear another complaint. Spybot is the shiznit. I have also read many discussions on whether or not Ad-aware in itself is spyware, do a google search you'll find some interesting points. Also I read a mention of using Windows System Restore, which is built into ME + XP don't do it, this feature should be turned off as it's a complete resource hog and only works half the time at best. If you like the sound of it buy goback from Roxio, It works like a charm.
I feel the basic file system model needs to be redesigned so that applications are installed in their own "sandboxs"/space period. No application should ever be implicitely given permission to modify other system/app files, no "common" registry entries can be tampered with, NO changing/adding/deletion of any Windows or Windows/System files etc. should ever be implicitely allowed. There are lots of ways to implement such a file system so that this basic sandbox paridigm can be upheld, but fundamentally the COMPLETE removal of an application should be as simple as just deleting the directory/sandbox in which it resides.
Any application which tries to modify another applications "sandbox" of files, registry settings, data etc needs to be given VERY explicit permission, from the user, to do so, i.e. file permissions controlling access should not be strictly limited to just human users, but to applications as well. Solving problems such as overriding or redirecting behaviours provided by default system files should be handled by having the OS provide adaquate interfaces and dynamic registration procedures, so that they can request, and be granted permission to override some default system behaviour.
I understand that such a radical redesign has a lot of issues/details that need to be worked out, but until Microjunk fixes their file system model, so that applications can be safely installed and COMPLETELY removed via a simple premise, and gaurentee that applications cannot interfer with each other, without permissions, then this mess is going to continue forever. This IS one of the primary responsibilities of an operating system and one that the Microsoft engineers have badly overlooked!
(PS. I get very annoyed by web based interfaces such as this which do not provide spell and grammer check options. Sorry for any misspellings, I am not good at it.)