DiffView

The ability to quickly move data around has meant applications are installed (and uninstalled) on a far more frequent basis. When this is performed in a Windows environment, this can lead to cluttered registries and, in due time, even malicious content finding its way into system entries. Multiple programs have been devised to target this specific issue and DiffView is just one such application.

The lightweight utility provides a practical method of comparing registry entries and disk file changes at a certain moment in time. If employed on a regular basis, it can quickly highlight any changes made by recently installed programs over a user-defined time interval.

When launched, the program – which requires no installation, features a tree view of all the local partitions. Simple checkboxes allow users to choose which folders to target and a separate “Registry” tab (albeit with the same layout), can be used to scan the OS system entries for any changes.

As one can clearly see, although the program provides a very practical approach to identifying malware activity, it is still up to the user to determine if the changes are malicious in nature or not; therefore, employing the application requires a significant amount of know-how on the users' part.

Generally speaking, scans are fairly quick and users who feel that results are lacking in the standard analyses can opt for the “Thorough reg scan” feature. This can take considerably longer to complete, but will provide significantly improved results. Once finished, all the entries found can be dumped to a basic TXT document for easy dissemination to other users.

To conclude, DiffView is a practical tool for anyone who wishes to track potential disk threats manually. The application allows its users to compare file and registry changes in a certain time interval. Text output documents can be created from the analysis results and a 'thorough scan mode' is also available for improved results.