What detection tools are available?

Hi,

I wasn't sure at the beginning where to post, and in the matter of fact I am still not sure!! Anyhow if I am posting in wrong section I apologise.

Now, my question is about what kind of tools are available that would help me identify before and after changes in my machine?! For example I want to identify what kind of files and values are being made to my computer when I try to install new software.



Thanks
aak19

We'll need some more information here..

Most importantly what operating system are you running..

If you are using Windows so here you can find some progs that can help you to monitor changes
http://www.sysinternals.com/
and also SpyBot has lot of tools (in advanced mode) that can be used for checking you system

Hi

Assuming some Windows derivatives, I suggest
the classic pair:

-> Sysinternals File monitor[1]
-> Sysinternals Registry monitor[2]

or the all-in-one solution by epsilonsquared[3].
Have a look at this new tutorial[4] for some
additional aspects.

Linux: dnotify[5] / inotify[6] (?)

Cheers.


[1] http://www.sysinternals.com/Utilities/Filemon.html
[2] http://www.sysinternals.com/Utilities/Regmon.html
[3] http://www.epsilonsquared.com/
[4] http://www.antionline.com/showthread...hreadid=272469
[5] http://freshmeat.net/projects/dnotify/ (not performant)
[6] http://www.edoceo.com/creo/inotify/
[6a] http://www-128.ibm.com/developerwork...l-inotify.html

..BTW... what monitoring tools mac has?

Quote:

---

Originally posted here by sec_ware
Hi

Assuming some Windows derivatives, I suggest
the classic pair:

-> Sysinternals File monitor[1]
-> Sysinternals Registry monitor[2]

or the all-in-one solution by epsilonsquared[3].
Have a look at this new tutorial[4] for some
additional aspects.

Linux: dnotify[5] / inotify[6] (?)

Cheers.


[1] http://www.sysinternals.com/Utilities/Filemon.html
[2] http://www.sysinternals.com/Utilities/Regmon.html
[3] http://www.epsilonsquared.com/
[4] http://www.antionline.com/showthread...hreadid=272469
[5] http://freshmeat.net/projects/dnotify/ (not performant)
[6] http://www.edoceo.com/creo/inotify/
[6a] http://www-128.ibm.com/developerwork...l-inotify.html

---

Thank you all for helping! My question was regarding Windows operating system, and to be precise XP.

The sysinternal tools (i.e. file and registry monitoring tools) are excellent! However, what I am concerned about now is that those utilities are in real-time which means dozens if not hundreds of data are being revolved up and down the screen rapidly! Which is somewhat confusing to know what is what? But this is going to do fine as I was just introduced to such tools, I have to research around these utilities to try and reverse installations, to learn installation paths, files added, and new or altered records etc once a specific program were employed!

Any adivce or comments are most welcomed!!



Thanks
aak19

Try Inctrl5. It's better than regmon and filemon for windows. Much more comprehensive, although I think you have to pay for it now..

http://www.tripwire.com/kb/view.cfm?aid=62

Tripwire looks for changes these by monitoring key attributes of files that should not change, including binary signatures, size, expected changes in size, etc. - and reporting its findings.

AND TO PREVENT

http://www.faronics.com/html/deepfreeze.asp

Absolute Protection

* Guarantees 100% workstation recovery on restart
* Provides password protection and complete security
* Protects multiple hard drives and partitions
* Protects CMOS
* Protects master boot record

Integration and Compatibility

* Supports multiple hard drives and partitions
* Supports multi-boot environments
* Compatible with Fast User Switching
* Supports SCSI, ATA, SATA, and IDE hard drives
* Offers single install for Windows 95,98ME, 2000, XP

you can also use filters in settings to chose what you want to monitor.

;)

LOL. How interesting that people are asking for this just after I posted a tut...

Go download install watch pro. It's free and acts like a tape recorder on your system. Once you install software, you get a nice report back that shows alll changes and activities the installation performed.

http://www.epsilonsquared.com/installwatch.htm



Mr. Babis, visit the BSD forums. There are numerous toolz available for MACs.

There were some excellent replies in this topic! Even better when I was refered to thehorse13 post!! If I have seen your post about forensic analysis of malecode earlier, I doubt writing this topic.


Anyways, thank you all, now I know where to start from.




Thanks
aak19