SysTracerComments on:

By: Fubar

Fubar — Sun, 04 Nov 2007 15:29:35 +0000

After determining that you can’t manage the snapshots, I would change my thumbs-up to a thumbs-down, if I could. The snapshots are huge, so I was going to look into placing them under external version control. The first problem is that the snapshots are numbered, their filenames don’t include the names that you give them, which in itself makes them difficult to manage. Next, I wanted to see how it would handle missing snapshots, and how it would number new snapshots when some snapshots were missing. I renamed a couple of the snapshots, and when I opened SysTracer, it simply acted as if those snapshots had never been taken, which was good. I started to take a new snapshot, and the default name indicated that it wasn’t trying to re-use the missing numbers, so that was also good. Then I named the snapshots back. Unacceptable problem–it won’t use them. Apparently, when it thought they were deleted, it removed them from its unreadable configuration file, and it won’t add them back. Blue Project apparently went out of their way to force you to buy the Pro version, which has snapshot import/export, and to make snapshot management as difficult and convoluted as possible, rather than as simple as possible.

By: Fubar

Fubar — Sat, 03 Nov 2007 13:06:37 +0000

A bit more automation would be nice. When taking a snapshot, an option to compare it to the previous snapshot and export the differences (preferably as a single HTML file) for data of the same type (registry, files, applications) present in both snapshots would be handy.

Performance on my system is highly variable depending upon the state of the disk caches, etc. A scan can take half a minute or several minutes.

#42, Hempman, the problems you’re experiencing appear specific to your system. While it could be anything, you might check for a conflict with your security software–perhaps it doesn’t like the registry scan.

By: Coldmile

Coldmile — Sat, 03 Nov 2007 07:42:58 +0000

Milleniums away from usefull,more introspective computering with no goal.

By: Steven Avery

Steven Avery — Sat, 03 Nov 2007 07:42:10 +0000

Hi Folks,

Of programs not yet mentioned, or lightly mentioned,
one should definitely be mentioned, from the very excellent
Donation Coder folks.

Tiny Watcher (donationware)
http://www.donationcoders.com/kubicle/watcher/misc.html

It has a more limited purpose, however it can do some excellent snapshot work.

Also File Checker from Javacool (freeware)
http://www.javacoolsoftware.com/filechecker.html

And worthy of some interest:

Filemap (freeware)
http://www.dogkennels.net/filemap/
Testrun (Freeware)
http://dogkennels.net/testrun/testrun.htm

SilentNight Inspector (freeware)
http://www.silentnight2004.com/

InstallSpy and Fingerprint- 2BrightSparks (authors of Syncback)
http://www.2brightsparks.com/downloads.html

RegProt – DiamondCS (freeeware) http://www.diamondcs.com.au/freeutilities/regprot.php

RegDefend – Ghost Security
http://www.ghostsecurity.com/regdefend/

Other than Filemap and SilentNight all are from companies known positively to me from other products — and some are more immediate HIPS-ish protection, especially the last two for the registry.

Shalom,
Steven

By: Steven Avery

Steven Avery — Sat, 03 Nov 2007 07:00:21 +0000

Hi Folks,

Nice GAOTD.

There are a fair number file monitor programs, and this one seems to stand up well,
a bit more comprehensive and possibly more usable. At normal cost it might be
hard to justify, but as a medium-term freebie (GAOTD) it can be tried at leisure.

Also the registration was pleasantly easy.

In general there is more activity now in active intrusion (HIPS) defenses, however these
more static post-facto monitors have a place in augmenting the defense. Possibly
Regshot and/or Erunt are good to use for the registry issues, thanks for the Regshot
heads up. WinPatrol is an ok freebie that has some monitoring functions, and on the
freeware level I have used spy-the-spy, that tells me right away of some changes.
http://www.mediachance.com/free/spythespy.htm

Here was a Wilders thread about a few products 2 years ago (this is only a 1-year-old
software) yet nothing stood out.
http://www.wilderssecurity.com/showthread.php?t=99318

And a couple of years ago kareldjag discussed them here.
http://kareldjag.over-blog.com/categorie-69557.html

Amyway, thanks, I loaded it on my two machines and will give this SysTracer a good run.

Shalom,
Steven

By: StanP.

StanP. — Sat, 03 Nov 2007 06:04:56 +0000

This program looks and in theory is very useful, sure its lacking full on abilities, but hey aren’t they all…. It works well to troubleshoot and narrow complications on the pc down a whole lot, but as for follow through and “INTELLI-GENTICALLY SOUND”; of course it lacks, hey even the all might Acronis True Image Home Edition V11+ has its short comings and little bugs as well as not being full on intelligent abuot its doings, anyway I have a freeware that blows all the rest of the installers i have ever used and i do mean “ALL OF THEM” it’s called “Revo-Uninstaller” and it has yet to dis-satify me, its swift, very thorough and totally abolishes an application and all of its registry, file(s), and any remaining pc tracks it would have left with other half-crocked installers, I rate REVO-INSTALLER a 9.9 of 10 STARS its hands down the best piece of software i have ever used on any pc since 1982 thanks enjoy all, peace out!

By: mimrah

mimrah — Sat, 03 Nov 2007 05:49:51 +0000

ProcessMonitor shows only realtime activity. Systracer keeps entire history. Also with systracer you can see how it looks the previous data.

By: Hempman

Hempman — Sat, 03 Nov 2007 03:08:55 +0000

Continual crashing while simply scanning during snapshot makes this program unusable.

By: Hempman

Hempman — Sat, 03 Nov 2007 03:02:00 +0000

A nice techy program. I did find some mild instability, but I can not consistently reproduce the problems. I tried several times today to intentionally reproduce instabilities (it suddenly crashed while performing varied duties), but could never get it to reproduce the exact same crash close in time so I could trace the action and/or cause.

Other than that minor problem, it worked ok.

Some of the functions can be reproduced using Process Monitor (that is what the save, load and filter are for). However, for beginning techies, this is far simpler.

Not to change the topic, but there is a new version of Process Explorer, along with a video by Mark Rasmussen explaining how to use it to trace malware. The new ProcEx can also replace the more primitive Task Manager.

I can never get the link embeding to work right, so here is the direct link to the DL page:
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

Here is a link to the video (you will have to install a new MS streaming video codec to play it).
http://www.microsoft.com/emea/spotlight/Mark_Russinovich_Advanced_Malware_Cleaning.aspx

Nice new techy stuff. Enjoy!

By: Dobromilka

Dobromilka — Sat, 03 Nov 2007 02:31:25 +0000

Thanks for all the great games and programs without any strings attached. However this one seems to have a big string since it wants your e-mail. I get enough junk mail so do not need any more. I was looking forward to it for it would have given me as much control as in days of yore (win3.1)