Collaborative RCE Tool Library - Registry Diff Tools (including sub-categories)

Tool Updated: SandboxDiff

Thu, 13 May 2010 11:49:54 GMT

Listed in categories: File Monitoring Tools, File System Diff Tools, Install Monitoring Tools, Monitoring Tools, Registry Diff Tools, Registry Monitoring Tools

Most recent version:
2.0

Most recent release date:
May 13, 2010

Description:
'SandboxDiff' allows tracking changes in Registry and Files when using 'Sandboxie' (an amazing application created by Ronen Tzur).

All Registry entries and File system created/modified by a program sandboxed (or any action sandboxed) are monitored and listed with SandboxDiff.

Very useful when users want (before to install an application) to know all changes made by the installer in Registry and File system.

Tool Added: Total Uninstall

Sun, 13 Dec 2009 02:20:27 GMT

Listed in categories: File System Diff Tools, Registry Diff Tools, System Diff Tools

Most recent version:
5.4.2

Most recent release date:
June 15, 2009

Description:
Total Uninstall is a complete uninstaller which includes two working modes.

Installed Programs module analyze existing installations and create a log with installation changes. It can uninstall programs even without the help of the supplied Add Remove program.
Just select from the list the program that you want to uninstall and in a few seconds Total Uninstall will analyze it and will show in a tree view detected files, folders, registry keys and values of that program. You can review the details and remove some of the detected items. Total Uninstall is ready to uninstall the analyzed program. It will use first the supplied Add Remove program and will continue removing remaining items using the log.

Monitored Programs module helps to monitor any changes made to your system during the installation of a new program. It allows you to perform a complete uninstall without having to rely on the supplied Add Remove program, which can leave files or changes behind.
Total Uninstall creates a snapshot of your system prior to installing a new program. It then takes an additional snapshot after the installation has completed. It then compares the two snapshots and displays all changes in a graphical tree view, marking all registry values and/or files that have been added, changed or deleted. Total Uninstall saves these changes and, if you decide to uninstall the program, it will reverse the changes to the previous state.
Features

* Accurate analyze existing installations and create a log with installation changes.
* Monitor changes from registry and file system for new installations.
* Uninstall completely and thoroughly analyzed or monitored programs.
* List without delay installed or monitored programs and with appropriate icons.
* Organize in groups installed or monitored programs.
* Find the program to uninstall by keyword quickly and easily.
* Summary and detailed information for each installed or monitored program.
* User configurable views of the detected changes.
* It shows a detailed uninstall log.
* Powerful search in detected changes.
* Standalone and low resource usage agent for notification of running installation programs
* Export registry changes for install or uninstall
* Export installed or monitored programs list to file
* Export to file or print detected changes
* View and apply pending file rename operations without restart.

Tool Added: Buster Sandbox Analyzer

Mon, 07 Dec 2009 01:55:12 GMT

Listed in categories: File Monitoring Tools, File System Diff Tools, Network Monitoring Tools, Registry Diff Tools, Registry Monitoring Tools, X86 Sandboxes

Most recent version:
1.03

Most recent release date:
December 07, 2009

Description:
Buster Sandbox Analyzer is a tool that has been designed to analyze the behaviour of sandboxed processes and the changes made to system and then evaluate if they are malware suspicious.

The changes made to system can be of several types: file system changes, registry changes and port changes.

A file system change happens when a file is created, deleted or modified. Depending of what type of file has been created (executable, library, javascript, batch, etc) and where was created (what folder) we will be able to get valuable information.

Registry changes are those changes made to Windows registry. In this case we will be able to get valuable information from the modified value keys and the new created or deleted registry keys.

Port changes are produced when a connection is done outside, to other computers, or a port is opened locally and this port starts listening for incoming connections.

From all these changes we will obtain necessary information to evaluate the "risk" of some of the actions taken by sandboxed applications.

Watching all these operations in an easy and safe manner is possible thanks to Sandboxie (http://sandboxie.com), an excellent tool created by Ronen Tzur.

Even if Buster Sandbox Analyzer´s main goal is to consider if sandboxed processes have a malware behaviour, the tool can be used also to simply obtain a list of changes made to system, so if you install a software you will know exactly what installs and where.

Additionally apart of system changes we can consider other actions as malware suspicious: keyboard logging, end the Windows session, load a driver, start a service, connect to Internet, etc.

All the above operations can be considered as not malicious but if they are performed when it´s not expected, that´s something we must take in consideration. Therefore it´s not only important to consider what actions are performed. It´s also important to consider if it´s reasonable certain actions are performed.

Tool Updated: Sandboxie

Mon, 07 Dec 2009 01:54:02 GMT

Listed in categories: File Monitoring Tools, File System Diff Tools, Network Monitoring Tools, Registry Diff Tools, Registry Monitoring Tools, X86 Sandboxes

Most recent version:
3.42

Most recent release date:
December 1, 2009

Description:
Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

You can also access all the changes that were made during the program execution.

Tool Updated: Regshot Unicode

Tue, 10 Nov 2009 06:46:09 GMT

Listed in categories: Registry Diff Tools, Registry Monitoring Tools

Most recent version:
2.0.1.68 Unicode

Most recent release date:
November 9, 2009

Description:
Regshot is a small, free and open source (GPL) registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between snapshot1 and snapshot2. In addition, you can also specify folders (with sub filders) to be scanned for changes as well.

Tool Updated: RegShot

Sat, 18 Jul 2009 23:26:11 GMT

Listed in categories: Registry Diff Tools, Registry Monitoring Tools

Most recent version:
1.82

Most recent release date:
November 3, 2007

Description:
Regshot is a small,free and open-source(GPL) registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between snapshot1 and snapshot2. In addition, you can also specify folders (with sub filders) to be scanned for changes as well.