🚀 go-pugleaf

"Vanguard" <vanguard@mail.invalid> wrote in news:UaCdnRjy-
a1nAV_bnZ2dnUVZ_hudnZ2d@comcast.com:

> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in 
> message news:Xns998CE424F858CHHI2948AJD832@69.28.186.121...
>> "Vanguard" <vanguard@mail.invalid> wrote in
>> news:L_udnZNuH91GcVzbnZ2dnUVZ_sGvnZ2d@comcast.com:
>>
>>> "none" wrote in message
>>> news:0sidnb5gdramKlzbnZ2dnUVZ_j-dnZ2d@giganews.com...
>>>>
>>>> "Vanguard" wrote:
>>>>>
>>>>> "hmmm" wrote ...
>>>>>>
>>>>>> I'm looking to see what files comprise the compacted exe file
>>>>>> before
>>>>>> I install it.
>>>>>
>>>>> You won't tell what files created after running an .exe.  Seeing
>>>>> what
>>>>> files are in a .zip file, even one wrapped with the self-extract
>>>>> .exe
>>>>> code, only shows you the files needed to do the INSTALL.  It 
>>>>> shows
>>>>> you
>>>>> nothing about what files actually get CREATED by the install.
>>>>>
>>>>> Use VMWare Server, VPC, ShadowSurfer, or Windows SteadyState to 
>>>>> see
>>>>> what gets installed (provided you have a tool to log the current
>>>>> state
>>>>> and then show you the difference after the install).
>>>>
>>>> Thanks for the info.  You refreshed my memory and I recall that 
>>>> even
>>>> the
>>>> filenames that are extracted are shortened versions of what is
>>>> actually
>>>> installed.
>>>>
>>>> What is the best tool that will create a snapshot (filename, 
>>>> version
>>>> #,
>>>> date and time created) of all the OS files, and then do a compare
>>>> for
>>>> changes afterward.  I know Nirsoft.net has something similar, but
>>>> that's
>>>> just for dll files.
>>>
>>> The install program can create files, it can use the included files
>>> along with other data to construct the *new* files created during 
>>> the
>>> install, or it can modify a file after extraction, even an .exe. 
>>> Some
>>> but not all files in the .zip file may end up in the installation.
>>> Some files are not in the .zip file and are created or modified.
>>>
>>> I use an old program called InstallWatch from epsilonSquared.com to
>>> track changes to my system from an install.  You take a snapshot
>>> before, do the install, and then analyze the current state (after
>>> install) against the snapshot.  I don't bother loading it to use 
>>> its
>>> auto-detect mechanism to track installs.  I just manually do a
>>> snapshot, install, and do the analyze afterward.  There might be
>>> better programs around but this usually fits my need.  This one 
>>> hasn't
>>> been updated in several years.  ZSoft's Uninstaller is newer (more
>>> recently updated) but its recorded log of system changes for 
>>> analyzing
>>> an install is much harder to read than the tree hierarchy shown in
>>> InstallWatch.  I just tried ZSoft Uninstaller in a VM using VMWare
>>> Server and didn't care for it, plus I don't want an alternative
>>> uninstaller.
>>>
>>>
>>
>> Have you tried Sandboxie?
>>
>> I find it's an invaluable tool for analyzing software.
> 
> 
> Yep, got Sandboxie.  However, I find virtual machines more reliable 
> and secure for testing installations of unknown software.  Neither 
> Sandboxies or VMWare will tell you what got changed by an installtion. 

Actually, Sandboxie will leave every single file created/modified by the 
installation as well as a copy of the modified registry hive. All of this 
information is available in the sandbox when you terminate the processes.

I'm confused as to why you don't think this would give you the 
information on what was changed then?

> You only get the option to undo whatever changes were made (by getting 
> rid of the VM).

Are we talking about the same thing here? Sandboxie doesn't allow changes 
to remain, so there is no undoing them.


-- 
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml