I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.
VMware ThinApp is the closest thing I can find to this as it shows what was modified between the 2 images as it is trying to create a Virtualized Application. I am not interested in making an virtualized application, I have been using the power of the application to determine other items but would like to know if there are better programs and tools for this type of work.
I do know that some virus can detect being ran inside a VM and will not execute.