0

Say for example I'm searching for a malware that writes data, or sends data about my OS to external sources, or writes hidden files or registry entries.

Is there a particular tool that tells me EVERYTHING an installer/executable does? This is regarding the Windows platform.

closed as too broad by perror, peter ferrie, w s, jvoisin, Dominik Antal Jan 18 '16 at 10:04

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

3

It sounds like the best tool for you might be Process Monitor. It can log all file-system writes, network events, and registry activity:

Process Monitor

If you need to examine the details of the network traffic, Wireshark will let you capture and see all network communications:

Wireshark

These two tools should satisfy your ask for "a particular tool that tells me EVERYTHING an installer/executable does?". If, on the other hand, you need to see everything that an installer/executable could do, then you'd need to use a disassembler like IDA Pro to examine all possible code paths, but note that this is much more time-consuming and challenging than using the other two tools described above.

  • 1
    You should probably add API Monitor to the list. – tmr232 Jan 15 '16 at 13:54
  • 1
    @tmr232: API Monitor is a fantastic tool, but the signal-to-noise ratio can be rather low relative to the output of Process Monitor. As such, I'd suggest that BlueStarry try Process Monitor first as it sounds like that will meet his or her needs. – Jason Geffner Jan 15 '16 at 14:16
0

You may wish to use a tool called RegShot for monitoring changes in the registry. You would take a snapshot of the registry, and then run the suspicious program, any changes will be highlighted by RegShot in the next snapshot you take - RegShot - Sourceforge

Not the answer you're looking for? Browse other questions tagged or ask your own question.