🚀 go-pugleaf

"Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in 
message news:Xns998D801488A3CHHI2948AJD832@69.28.186.121...
> "Vanguard" <vanguard@mail.invalid> wrote in news:UaCdnRjy-
> a1nAV_bnZ2dnUVZ_hudnZ2d@comcast.com:
>
>> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in
>> message news:Xns998CE424F858CHHI2948AJD832@69.28.186.121...
>>> "Vanguard" <vanguard@mail.invalid> wrote in
>>> news:L_udnZNuH91GcVzbnZ2dnUVZ_sGvnZ2d@comcast.com:
>>>
>>>> "none" wrote in message
>>>> news:0sidnb5gdramKlzbnZ2dnUVZ_j-dnZ2d@giganews.com...
>>>>>
>>>>> "Vanguard" wrote:
>>>>>>
>>>>>> "hmmm" wrote ...
>>>>>>>
>>>>>>> I'm looking to see what files comprise the compacted exe file
>>>>>>> before
>>>>>>> I install it.
>>>>>>
>>>>>> You won't tell what files created after running an .exe. 
>>>>>> Seeing
>>>>>> what
>>>>>> files are in a .zip file, even one wrapped with the 
>>>>>> self-extract
>>>>>> .exe
>>>>>> code, only shows you the files needed to do the INSTALL.  It
>>>>>> shows
>>>>>> you
>>>>>> nothing about what files actually get CREATED by the install.
>>>>>>
>>>>>> Use VMWare Server, VPC, ShadowSurfer, or Windows SteadyState to
>>>>>> see
>>>>>> what gets installed (provided you have a tool to log the 
>>>>>> current
>>>>>> state
>>>>>> and then show you the difference after the install).
>>>>>
>>>>> Thanks for the info.  You refreshed my memory and I recall that
>>>>> even
>>>>> the
>>>>> filenames that are extracted are shortened versions of what is
>>>>> actually
>>>>> installed.
>>>>>
>>>>> What is the best tool that will create a snapshot (filename,
>>>>> version
>>>>> #,
>>>>> date and time created) of all the OS files, and then do a 
>>>>> compare
>>>>> for
>>>>> changes afterward.  I know Nirsoft.net has something similar, 
>>>>> but
>>>>> that's
>>>>> just for dll files.
>>>>
>>>> The install program can create files, it can use the included 
>>>> files
>>>> along with other data to construct the *new* files created during
>>>> the
>>>> install, or it can modify a file after extraction, even an .exe.
>>>> Some
>>>> but not all files in the .zip file may end up in the 
>>>> installation.
>>>> Some files are not in the .zip file and are created or modified.
>>>>
>>>> I use an old program called InstallWatch from epsilonSquared.com 
>>>> to
>>>> track changes to my system from an install.  You take a snapshot
>>>> before, do the install, and then analyze the current state (after
>>>> install) against the snapshot.  I don't bother loading it to use
>>>> its
>>>> auto-detect mechanism to track installs.  I just manually do a
>>>> snapshot, install, and do the analyze afterward.  There might be
>>>> better programs around but this usually fits my need.  This one
>>>> hasn't
>>>> been updated in several years.  ZSoft's Uninstaller is newer 
>>>> (more
>>>> recently updated) but its recorded log of system changes for
>>>> analyzing
>>>> an install is much harder to read than the tree hierarchy shown 
>>>> in
>>>> InstallWatch.  I just tried ZSoft Uninstaller in a VM using 
>>>> VMWare
>>>> Server and didn't care for it, plus I don't want an alternative
>>>> uninstaller.
>>>>
>>>>
>>>
>>> Have you tried Sandboxie?
>>>
>>> I find it's an invaluable tool for analyzing software.
>>
>>
>> Yep, got Sandboxie.  However, I find virtual machines more reliable
>> and secure for testing installations of unknown software.  Neither
>> Sandboxies or VMWare will tell you what got changed by an 
>> installtion.
>
> Actually, Sandboxie will leave every single file created/modified by 
> the
> installation as well as a copy of the modified registry hive. All of 
> this
> information is available in the sandbox when you terminate the 
> processes.
>
> I'm confused as to why you don't think this would give you the
> information on what was changed then?

I don't see any tracking information.  I can explore the sandbox but 
that shows me its current state, not what changes were made to get 
there.  As a test, I reconfigured Sandboxie to *not* automatically 
perform cleanup on exit of the VM.  I then opened IE in a sandbox, 
deleted the TIF files, and changed the home page URL for the browser. 
When I try to look at the contents of the sandbox, I'm told it is 
empty but I explore anyway to find subfolders for the apps (for IE and 
OE, I run them in their own sandbox by using the "/box:<name>" 
command-line parameter).  I go under those subfolders but there is no 
logs showing changes (and the registry files are unreadable).  What I 
get to see is the state of the sandbox, not what changes were made to 
get there.

So just where to I find a log of changes from the initial state of the 
sandbox to record all changes made thus far to get to its current 
state?

>> You only get the option to undo whatever changes were made (by 
>> getting
>> rid of the VM).
>
> Are we talking about the same thing here? Sandboxie doesn't allow 
> changes
> to remain, so there is no undoing them.

Exactly.  As I said, you exit the VM and whatever changes were made 
(in the VM) are lost.