Comparing files from old and new XP installs

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I am trying to track a virus that has been appearing in my network and I
want to build a clean XP machine, let it get infected - and then somehow
look at what files got changed, added or deleted as well as any registry
changes.

There used to be a way to do this on NT and I was wondering if XP had a way
to do this?

Thanks,

Tom.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

tshad wrote:

> I am trying to track a virus that has been appearing in my network and I
> want to build a clean XP machine, let it get infected - and then somehow
> look at what files got changed, added or deleted as well as any registry
> changes.
>
> There used to be a way to do this on NT and I was wondering if XP
> had a way to do this?
Hi

Some free programs that does a snapshot of before/after situations
and reports the difference:


Search for InCtrl5 here (does not report changes in binary
registry values):
http://www.xpefiles.com/searchresults.cfm


Total Uninstall - track and undo system changes
http://www.snapfiles.com/get/totaluninstall.html
http://www.geocities.com/ggmartau/tu.html


InstallWatch
http://www.epsilonsquared.com/


Installation Monitor
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/instaler-o.asp


InstallSpy
http://www.2brightsparks.com/freeware/freeware-hub.html



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx