🚀 go-pugleaf

"Vanguard" <vanguard@mail.invalid> wrote in 
news:x6idna3YA4hOSlnbnZ2dnUVZ_sejnZ2d@comcast.com:

> "Dustin Cook" wrote in message 
> news:Xns998EA87D63A2CHHI2948AJD832@69.28.186.121...
>> "Vanguard" wrote:
>>
>>> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in
>>>>>> Have you tried Sandboxie?
>>>>>>
>>>>>> I find it's an invaluable tool for analyzing software.
>>>>>
>>>>>
>>>>> Neither Sandboxie or VMWare will tell you what got changed by an
>>>>> installtion.
>>>>
>>>> Actually, Sandboxie will leave every single file created/modified 
>>>> by
>>>> the
>>>> installation as well as a copy of the modified registry hive. All 
>>>> of
>>>> this
>>>> information is available in the sandbox when you terminate the
>>>> processes.
>>>>
>>>> I'm confused as to why you don't think this would give you the
>>>> information on what was changed then?
>>>
>>> I don't see any tracking information.  I can explore the sandbox 
>>> but
>>> that shows me its current state, not what changes were made to get
>>
>> If you compare the files inside the sandbox with the real 
>> counterparts,
>> outside the sandbox, you have your changes list. :)
> 
> Yes, that can be done manually.  I don't relish having to do a manual 
> directory compare to find files that are missing (deleted), new 
> (created), or modified even when using something like windiff.
> 
> The sandbox does not provide a *log* of deletions, creations, and 
> modifications.  I would have to go hunting for them by doing all those 
> manual compares you speak of.  Then I would have to save my own log of 
> all these changes so that I could later refer to that saved log if I 
> needed to later investigate on what changes were made without having 
> to go through the entire process again.  I would have to repeat the 
> manual exercise of doing all those file and registry comparisons for 
> each "snapshot" at which I wanted to analyze what happened to get to 
> that state.  If I sandboxed or used a VM to monitor an install, I 
> snapshot before the install (because the VM is not in the same state 
> as the real host), after the install, after running the program, and 
> after uninstalling the program.  That's 4 snapshots minimum, and 4 
> times I would have to do all that manual comparing along with manual 
> logging of what I found.  While I could manually log all those 
> changes, having to then compare between, say, the pre-install state to 
> the after first-run state (to see what the program changed) or 
> pre-install state to the after-UNinstall state (to see what garbage 
> gets left behind) is still more manual effort to generate logs of 
> those differences.
> 
>> Those registry files are hardly unreadable. You can mount/open them 
>> using
>> regedit. It's a real copy of the registry with any/all
>> modifications/additions made since the execution of the sandboxed
>> program.
> 
> When I attempt to open the RegHive file (outside the sandbox), a 
> message pops up saying that contents of this file will get "added" to 
> my current registry.  The popup is unclear if this means a separate 
> hive load will occur or if it is like importing a .reg file that would 
> merge its contents into my registry.  Instead I open regedit and then 
> use the File -> Load Hive function.  So now I get to see those 
> registry entries.  The user has to be careful how to look at RegHive.
> 
> Thanks for that tip about using regedit.  I didn't know what the 
> RegHive file was for since the help for Sandboxie is not searchable 
> (its a web site rather than a local help file with search capability). 
> Of course, we're back to performing a manual comparison and with no 
> logging.
> 
>> Everything you ask and more is available to you via sandboxie. Your
>> failure to understand what your doing with the provided information
>> doesn't change that. :)

 
> Available is not the same as easy (or fast).  I've seen plenty of 
> programmers that think a workaround is a reasonable solution. 
> Workarounds are not substitutes for ease-of-use features. 

LOL! I guess I had that one coming. :)


> InstallWatch or several of the uninstall tools that take snapshots and 
> provide the comparisons between them along with logging is certainly 
> easier than manually digging around to generate the same info and also 
> log it.
> 
> If I didn't have a dishwasher, yes, then I would have to do the dishes 
> by hand.  So washing was "available".  But I do have a dishwasher so I 
> use it to facilitate accomplishing the same task.  I use InstallWatch 
> or other tools to tell me the differences between one, or more, 
> snapshots so that I don't have to manually perform the "available" 
> methods (plus I get logging rather than doing it through "available" 
> manual means).
> 
> However, thanks for the info regarding how Sandboxie retains info on 
> the *current* state of its sandbox.  I've only begun using Sandboxie a 

Your welcome. My apologies if I seemed short in my previous post.
I've been having fun with sandboxie for awhile now. It's handy, but 
agreed, you do have to do a bit of manual work for the information you 
want.



-- 
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml