What's a good way to know about changes to the system & software? HIPS, BBs, etc.

What are lightweight, reliable ways to know what has been changed in the software that shouldn't be? If it gave an alert to suspicious activity, even better.

 

for sure a pure hips will alert you just about of any kind of system activity

 

I guess I should also say non-intrusive. In other words, not too many pop-ups.

 

in that case not hips

 

I've tried Mamutu and WinPatrol, and I can deal with that level of alerts. Mamutu might be a little heavy, and some have said WinPatrol isn't as thorough a guard as it could be. So I wonder if there is something in between, or a method completely different that I don't know about.

 

D+ is very good and also the hips component that comes with private firewall is good too

 

PE Guard is what you want

 

I tried loading PEGuard recently but it didn't start up. Something about being unsigned. I'll give it another try.

 

for 64 bits

 

Can I use PEGuard on 64bit anyway?

Also trying HiJackFree. Lots of information to figure out, not seeing any alerts. I'll have to read up on this program.

 

not sure

 

PEGuard wouldn't work on my computer.

 

Thanks for the suggestion, Kernelwars.

I know Bellgamin likes TinyWatcher. I'm about to try loading that one.

 

Be aware when using x64 of file redirection issues. You might run into that with TinyWatcher.

I use the snapshot feature of Autoruns and What's Running to check for system changes.

 

Thank you for warning me before I did any damage, MrBrian. Uninstalled TinyWatcher. Looking into What'sRunning.

 

You're welcome . The danger isn't that TinyWatcher would damage your x64, but rather that it could perhaps miss some changes in \windows\system32.

 

Oh.

Autoruns and WhatsRunning look like they require an understanding of computers that I just don't have yet. I probably need a program that already knows what to look for, and pops up an alert that I can research. Sounds like Mamutu and WinPatrol, doesn't it. I was hoping there was something else I'd overlooked. Maybe I'll keep HiJackFree on and just study the information there and eventually move up to your two programs.

 

It seems like you're looking for something like Mamutu, ThreatFire, Prevx or other behavioral analysis software.

 

Have you tried any Comodo products? From what I remember, they were extremely chatty. Things might have changed in the past few years, but I somehow doubt it. If you need that kind of granularity it might be worth a shot.

If you want to see what happened after you did something, I always use InstallRite. I don't know if it works on x64 or not, but it works nicely with win7 x32.

If you were using x32 you would have many more options. One of the reasons why I refuse to go with a x64 system quite yet. Still too many softwares I like that work best on x32. OT but threads like this are good for reminding me when I am tempted to use x64

Sul.

 

Maybe I am having trouble with this category of security because it's not really what I need with Sandboxie. Something I'll have to think about. Thanks for the suggestions.

 

this is something i've always been interested and still haven't got a satisfactory answer to.

i'd like to be able to see 2 different snapshot of my system side by side and be able to tell what has changed; registry, files, etc...

is there any app that can let me do this?

 

@moontan

A differential disk image is one way to do that.

There are some other options listed here:

http://www.raymond.cc/blog/archives...-changes-when-installing-software-in-windows/

 

tnx andyman.

this is exactly what i was looking for!

 

after looking at the link provided by andyman35 i can see there are only 2 apps that are still developped: WhatChanged and SysTracer.

WhatChanged costs a fortune and is geared for ITs. SysTracer might be just what you're looking for and it's decently priced.
they have a price for home user vs business user.

there are freebies in andyman's link but those haven't been developed in years so i don't know if they would support Vista and 7.
i tried a couple and they seem to work but still...

 

IMO, I think WinPatrol Plus would be the best answer for you at this point. It gives access to the Plus database for questionable things Scotty barks about. It's nice to have some extra, legitimate help when things are a bit confusing.

I run AV, Sandboxie, UAC on the highest setting and WinPatrol Plus on my Win 7 PCs (along with full image backups.) I doubt much would get through without me knowing about it.