Analyzing tools

[jim lin]

RegShot

monitor for registry changes RegShot is a small utility that allows you to quickly take a snapshot
of your registry and then compare it with a later one - done after doing system changes or installing
a new software product. The changes report can be produced in text or HTML format and contains a list
of all modifications that have taken place between Snapshot1 and Snapshot2. In addition to registry changes,
RegShot can also scan a folder on your hard drive and check for file changes.

http://www.snapfiles.com/get/regshot.html



James

 

[adyblueboy]

http://virusscan.jotti.org/en

 

[looda]

thx so much

 

[Oxygen]

Thanks for this post!

 

[Neno]

The best tool for analyzing malware... http://technet.microsoft.com/en-us/SysInternals
This is one of may favorite videos (tutorials)... http://malwaretips.com/media/malware-hunting-with-the-sysinternals-tools.29/

 

[donetao]

A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer.
https://www.malwarebytes.org/antirootkit/

 

[Billcomputerman123]

http://virusscan.jotti.org/en

 

[frogboy]

Depends if the MBR has been altered. Run this tool to check. http://www.majorgeeks.com/files/details/mbrcheck.html

 

[NekoJonez]

Maybe already said: Fiddlr, for sure. Also Depency Walker.

 

[GinGin]

thanx! Well done!

 

[Quassar]

DiskPulse Free/Payment - Analize folders/files changes in real time
SysTracer "payment" Files/Registry change snapshot analize
MultiMon "payment" Analize File Registry and other such things in real time
VMware Wokrstation + ThinApp = Virtualization + modify Repository, but you can use it to analize malware changes sometinhg like Sandboxie with BSA Antivirus Scanning in a VMware View Virtual Desktop Environment That Includes ThinApp Virtualized Applications - VMware ThinApp Blog

Phrozen Windows File Monitor - "free" monitor changes in real time
NtRegEdit - Native Registry Editor - Free and probably most advanced register editor which i could use

ArtMoney - i know its software to hacking games like CE but this tool have extended HEX editor and complex lua injector when i have to bypass wirus and such others tools like SpyWare Proces detector.. VIP Edition can change name of process program to any wish you, help hide proces for other programs/viruses.

other tool i prefer is IDA and Hiew but for sure you know it