🚀 go-pugleaf

"Vanguard" <vanguard@mail.invalid> wrote in 
news:0c2dnSMFFNW1oF7bnZ2dnUVZ_rWtnZ2d@comcast.com:

> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in 
> message news:Xns998D801488A3CHHI2948AJD832@69.28.186.121...
>> "Vanguard" <vanguard@mail.invalid> wrote in news:UaCdnRjy-
>> a1nAV_bnZ2dnUVZ_hudnZ2d@comcast.com:
>>
>>> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in
>>> message news:Xns998CE424F858CHHI2948AJD832@69.28.186.121...
>>>> "Vanguard" <vanguard@mail.invalid> wrote in
>>>> news:L_udnZNuH91GcVzbnZ2dnUVZ_sGvnZ2d@comcast.com:
>>>>
>>>>> "none" wrote in message
>>>>> news:0sidnb5gdramKlzbnZ2dnUVZ_j-dnZ2d@giganews.com...
>>>>>>
>>>>>> "Vanguard" wrote:
>>>>>>>
>>>>>>> "hmmm" wrote ...
>>>>>>>>
>>>>>>>> I'm looking to see what files comprise the compacted exe file
>>>>>>>> before
>>>>>>>> I install it.
>>>>>>>
>>>>>>> You won't tell what files created after running an .exe. 
>>>>>>> Seeing
>>>>>>> what
>>>>>>> files are in a .zip file, even one wrapped with the 
>>>>>>> self-extract
>>>>>>> .exe
>>>>>>> code, only shows you the files needed to do the INSTALL.  It
>>>>>>> shows
>>>>>>> you
>>>>>>> nothing about what files actually get CREATED by the install.
>>>>>>>
>>>>>>> Use VMWare Server, VPC, ShadowSurfer, or Windows SteadyState to
>>>>>>> see
>>>>>>> what gets installed (provided you have a tool to log the 
>>>>>>> current
>>>>>>> state
>>>>>>> and then show you the difference after the install).
>>>>>>
>>>>>> Thanks for the info.  You refreshed my memory and I recall that
>>>>>> even
>>>>>> the
>>>>>> filenames that are extracted are shortened versions of what is
>>>>>> actually
>>>>>> installed.
>>>>>>
>>>>>> What is the best tool that will create a snapshot (filename,
>>>>>> version
>>>>>> #,
>>>>>> date and time created) of all the OS files, and then do a 
>>>>>> compare
>>>>>> for
>>>>>> changes afterward.  I know Nirsoft.net has something similar, 
>>>>>> but
>>>>>> that's
>>>>>> just for dll files.
>>>>>
>>>>> The install program can create files, it can use the included 
>>>>> files
>>>>> along with other data to construct the *new* files created during
>>>>> the
>>>>> install, or it can modify a file after extraction, even an .exe.
>>>>> Some
>>>>> but not all files in the .zip file may end up in the 
>>>>> installation.
>>>>> Some files are not in the .zip file and are created or modified.
>>>>>
>>>>> I use an old program called InstallWatch from epsilonSquared.com 
>>>>> to
>>>>> track changes to my system from an install.  You take a snapshot
>>>>> before, do the install, and then analyze the current state (after
>>>>> install) against the snapshot.  I don't bother loading it to use
>>>>> its
>>>>> auto-detect mechanism to track installs.  I just manually do a
>>>>> snapshot, install, and do the analyze afterward.  There might be
>>>>> better programs around but this usually fits my need.  This one
>>>>> hasn't
>>>>> been updated in several years.  ZSoft's Uninstaller is newer 
>>>>> (more
>>>>> recently updated) but its recorded log of system changes for
>>>>> analyzing
>>>>> an install is much harder to read than the tree hierarchy shown 
>>>>> in
>>>>> InstallWatch.  I just tried ZSoft Uninstaller in a VM using 
>>>>> VMWare
>>>>> Server and didn't care for it, plus I don't want an alternative
>>>>> uninstaller.
>>>>>
>>>>>
>>>>
>>>> Have you tried Sandboxie?
>>>>
>>>> I find it's an invaluable tool for analyzing software.
>>>
>>>
>>> Yep, got Sandboxie.  However, I find virtual machines more reliable
>>> and secure for testing installations of unknown software.  Neither
>>> Sandboxies or VMWare will tell you what got changed by an 
>>> installtion.
>>
>> Actually, Sandboxie will leave every single file created/modified by 
>> the
>> installation as well as a copy of the modified registry hive. All of 
>> this
>> information is available in the sandbox when you terminate the 
>> processes.
>>
>> I'm confused as to why you don't think this would give you the
>> information on what was changed then?
> 
> I don't see any tracking information.  I can explore the sandbox but 
> that shows me its current state, not what changes were made to get 

If you compare the files inside the sandbox with the real counterparts, 
outside the sandbox, you have your changes list. :)

> there.  As a test, I reconfigured Sandboxie to *not* automatically 
> perform cleanup on exit of the VM.  I then opened IE in a sandbox, 
> deleted the TIF files, and changed the home page URL for the browser. 
> When I try to look at the contents of the sandbox, I'm told it is 
> empty but I explore anyway to find subfolders for the apps (for IE and 


Of course it has, temporary internet files n such.


> OE, I run them in their own sandbox by using the "/box:<name>" 
> command-line parameter).  I go under those subfolders but there is no 
> logs showing changes (and the registry files are unreadable).  What I 
> get to see is the state of the sandbox, not what changes were made to 
> get there.

Those registry files are hardly unreadable. You can mount/open them using 
regedit. It's a real copy of the registry with any/all 
modifications/additions made since the execution of the sandboxed 
program. 

> So just where to I find a log of changes from the initial state of the 
> sandbox to record all changes made thus far to get to its current 
> state?

The registry provides the keys/information on what's been changed since 
execution of the program. You can view it, using regedit as it's a 
registry hive file. You will find all files it's either created or 
modified since installation, and you can compare them with the originals 
located in the real folders.

Everything you ask and more is available to you via sandboxie. Your 
failure to understand what your doing with the provided information 
doesn't change that. :)
 
> Exactly.  As I said, you exit the VM and whatever changes were made 
> (in the VM) are lost. 

Not lost, no. preserved if you like, in the sandbox. Ready for your 
analysis. Provided your competent enough to perform one.


-- 
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml