2

I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.

VMware ThinApp is the closest thing I can find to this as it shows what was modified between the 2 images as it is trying to create a Virtualized Application. I am not interested in making an virtualized application, I have been using the power of the application to determine other items but would like to know if there are better programs and tools for this type of work.

I do know that some virus can detect being ran inside a VM and will not execute.

Improve this question
1
  • 1
    You could try a malware sandbox like cuckoo.
    – Zzz
    Jul 23, 2012 at 13:15

3 Answers 3

Reset to default
1

Try using the applications listed on this page

http://www.raymond.cc/blog/tracking-registry-and-files-changes-when-installing-software-in-windows/

Install the software and take snapshots before infecting the machine.

After the machine is infected, take another snapshot for comparison with the original.

I have found InstallWatchPro to be useful in my investigations.

Improve this answer
1

Just a quick hint, you can always use a hardware machine and make a binary copy of the hard drive. Both copies will need to be compared. You can do this by running a checksum. Just be sure nothing is run from the hard drive.

I think backtrack has a nice toolset to do such analysis. You can find them under digital forensics.

Improve this answer
0

If you are using Unix you could use http://en.wikipedia.org/wiki/Open_Source_Tripwire

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .