Malware Watcher

This program takes snapshots before and after the execution of "malware." It displays newly added programs to the autorun list and any alterations to Windows Defender registry keys. It is not meant to replace an antivirus but rather to serve as an additional research tool.

Installation

Clone the repository

git clone https://github.com/rektile/Malware-Watcher.git

Go into the folder

cd ./Malware-Watcher

Install python requirements

pip install -r requirements.txt

Usage

Take snapshots

1. Run Main.py or MalwareWatcher.exe with admin privileges.
2. Wait till the first snapshot has been taken.
3. Run the "malware" and wait till it finishes
4. Press enter to take the second snapshot
5. You can find the logs in ./output and the changes file in ./change

Revert changes to registry

You can revert the changes made to the registry by using the .changes file that has been created.

MalwareWatcher.exe -c myChangesFile.changes