Freeware Catalog

Freeware Analysis tools []

Selection of Security Analysis tools snapshots:
(Click to enlarge)

AutoRuns for Windows

AutoStart Explorer

a-squared HiJackFree

DiamondCs Autostart Viewer



TrendMicro™ HijackThis™ (includes StartupList)

This is more of a general catch all category for security tools. Most of them are used as diagnostic tools by knowledgeable users to check the overall health of the system.

Autostart and other listers []

This class of software enumerates registry entries, startup folders,system files and other sensitive system areas that are often modified by malware -also sometimes called hijack points. Technically while autostart entries are by definition common hijack points for malware (malware needs to find some way to start), tools used for inspecting the machine for malware might look at other areas that do not really count as autostart entries (e.g. Host files).

You can see some of this distinction in some of the earlier and simpler autostart control utilities (see "basic") which monitor only well known and common registry areas and nothing else. They are more commonly used to remove safe but irritating entries added by legitimate programs that want to autostart with your computer rather than for malware inspection.

Basic []

  1. Application Paths 2000 -
  2. Autostart and Process Viewer (APV) -
  3. CodeStuff Starter - uk/codestuff/ (down July 07?) - alternative download align=center
  4. Cyberlion Startup Optimizer -
  5. Deskanker -
  6. DoWinStartup - (down July 07)
  7. FreeFixer -
  8. MiTeC Startup Explorer 2.0 - (down July 07), alternative downlosad
  9. Msconfig - align=center
  10. Quick Startup -
  11. SilentNight Startup Manager -
  12. StartDreck -
  13. Startup Control Panel -
  14. Startup Manager -
  15. StartupRun -
  16. Startup Application Manager -
  17. Startup Inspector -
  18. SIW System Information Windows -
    • with this tools you can track three important thread within your PC which are basicly like Software, Hardware and Network within attache onto your PC- System Information Windows

Advanced []

  1. Vista.png AutoRuns - align=center
  2. Autostart Explorer -
  3. Autostart Viewer - (down?), alternative download
  4. Vista.png a-squared HiJackFree - align=center New.gif
  5. Vista.png HijackThis! ,Trend Micro version align=center New.gif
  6. Vista.png RunAlyzer (betaware) -
  7. RegRun Light -
  8. Vista.png RunScanner - align=center Recommended.pngNew.gif
  9. Vista.png Silent Runners - align=center
  10. SpyHolesList -
  11. StartupList v2 - align=center
  12. StartupList v1 -
  13. SystemScan - New.gif
  14. Download keylogger -
  15. WinPFind -
  16. See also Process listers below and various Lists of freeware behavior blockers, Lists of freeware antirootkit and Lists of freeware antispyware that list registry entries.

Among the more advanced utilties, HijackThis! is by far the most popular and used throughout the net on forums as a diagnosis aid to remove malware. There are however 2 major versions in use, the original 1.99.1 version and versions after 2.0 after it was sold to Trend Micro. Both are freeware.

Another tool is Silent Runners which is just a simple script to check various hijack points. Other utilities that are still in development includes a-squared HiJackFree, RunAlyzer by Spybot, RunScanner and Sysinternals autoruns .

These tools have many advanced features and typically check not just common autostart entries but also obscure seldom used areas which are exploited almost solely by malware only. Decision making analysis is made easier by filtering out signed entries (microsoft or not), automated checks with online/offline database of safe/dangerous entries, as well as allowing unusual entries to be easily googled. Some like RunScanner go beyond merely listing autostart entries but also provide process enumeration, and multiple process termination methods even though strictly speaking this is not really the province of such tools. However such features are usually handy to have.

Note :There are however a very large number of "hijack points" , see for example Tony Klein's autostart list and Grime's Where malware hides

Lists of autostart locations []

  1. Roger Grimes's Where Malware hides -
  2. Silent Runner's Launch point -
  3. Tony Klein's list at Gladiator forum -
  4. Greatis's Startup order list -
  5. Comparison of autostart locations of registry monitors - - outdated
  6. R2 comparison -,6721512~days=9999~start=80 plus origin discussion,6686853~root=security,1~mode=flat

Process Listers []

  1. Vista.png Process Revealer - align=center
  2. Another Task Manager -
  3. Advanced Process Manipulation - (down July 07), Alternative download
  4. CurrProcess -
  5. Prcview -
  6. Vista.png Process Explorer - align=center
  7. Process Patrol -
  8. Process Scanner -
  9. myProcMan -
  10. ProcX - align=center
  11. Security Process Explorer - New.gif
  12. Vista.png Sysinternals Process Monitor -
  13. TaskMan+ - (down July 07), alternative download
  14. What's Running -
  15. Window Watcher -
  16. See also Lists of freeware antirootkit like Icesword and GMER

The built-in task manager in Windows is largely acknowledged to be inadequate for everyday use, much less for power users using it for analysis purposes. Fortunately, there are many capable replacements that can take the place of task manager. They typically provide more information, particularly a column including full paths of the processes. Some like ProcX are light weight enough to replace task manager. Perhaps the big brother of them all is formerly sysinternal's Process Explorer which provides pretty much every information and feature you might desire. However it might not be suitable for everyday use because of information overload. The ultimate real time analysis tool would probably be provided by combining it with Process Monitor by the same company, it combines Filemon and Regmon that shows real-time file system, Registry and process/thread activity.

Unfortunately, many rootkits are able to evade from even such advanced tools (though a keen eyed analyst might spot discrepancies that give the game away). This is where many anti-rootkits such as IceSword , DarkSpy, GMER, Rootkit Unhooker (see Lists of freeware antirootkit) come in. They also provide a task manager like function, but have a better chance of getting past rootkit shielded defenses to display even hidden processes. Some will even indicate which processes are being hidden by rootkits. Similarly many provide autostart listings, port mapping functions etc.

File analyzer/ API Monitors []

  1. Vista.png FileAlyzer -
  2. MANDIANT Red Curtain -
  3. Spy Studio -

Allows advanced users to study files. MANDIANT Red Curtain looks at six categories of information to calculate a threat score including entropy , digital signatures , existence of specific packers. In addition, the tool identifies executable files that appear to have been modified, files with an excessive amount of imports and those with various combinations of permissions that indicate whether they can be read, written or contain executable code.

File/registry logging []

  1. FileMon (legacy support for Win98) -
  2. RegMon (legacy support for Win98) -
  3. Vista.png Sysinternals Process Monitor -

Use these tools to monitor in real time file and registry changes made by processes.

Port Mappers []

  1. Active Ports -
  2. Vista.png CurrPorts -
  3. OpenPorts (DiamondCS) - align=center (down July 07) alternative download
  4. Open Ports -
  5. Vista.png TCPView - align=center
  6. See also Lists of freeware antirootkit like Icesword.

There are tools that improve on the build-in Net-Stat function by providing real time monitoring of ports on your system. They also map processes to ports so you can see what processes are sending packets on what ports. Many but not all firewalls also provide similar functions for information purposes.

Port scanners []

  1. Blue's Port Scanner -
  2. Fport -
  3. Nessus -
  4. Nmap - align=center
  5. SuperScan v4.0 - (down July 07)
  6. YAPS -
  7. Windows UDP Port Scanner -

It is a mistake to assume that automated port scans like ShieldsUp! is all you need to do to test your defenses. Ideally a manual port scan using a tool like Nmap provides better security.

ARP watch []

  1. AdapterWatch -
  2. Winarpwatch -
  3. XArp -

Defenses against ARPspoofing.

Packet Sniffer []

  1. PacketMon -
  2. Vista.png Wireshark - align=center
  3. Vista.png WinDump -

NTFS Ads scanner []

  1. Ads Spy -
  2. Crucial ADS - (only available via email request)
  3. Vista.png LADS -
  4. NTFS Streams Eraser -
  5. Streams v1.53 -

Search your computer for Alternative Data Streams (ADS). Some antivirus and antispyware already do this, but not all.

Processkiller & file unlocker []

  1. Advanced Process Termination - (down July 07) alternative download
  2. Vista.png FileASSASSIN -
  3. KillBox -
  4. Simple process termination -
  5. Vista.png Unlocker - align=center

Many malware process are extremely difficult to kill , the tools in this category, use various different methods to terminate processes, and/or delete locked files. Many anti-rootkits such as IceSword (see Lists of freeware antirootkit), are also capable of killing normally unkillable processes due to access to kernel.

ActiveX/BHO/Toolbar/LSP listers (obsolete with XP SP 2) []

  1. ActiveXHelper -
  2. Active XCavator v2.0 -
  3. BHOCaptor -
  4. BHODemon -
  5. BHOlist -
  6. ToolbarCop -

These group of tools are used to manage toolbars, BHOS, ActiveX controls in internet explorer. Somewhat obsolete today, since Internet Explorer provides built in methods to do the same. Moreover, many startup listers, antispyware tools list or monitor these entries as well.

URL discomboulator []

  1. Vista.png URL Discombobulator v1.9 -

Driver and dll related []

  1. ListDrivers -
  2. Loadorder -
  3. ServiWin Services/Drivers Manager -
  4. See also Lists of freeware antirootkit like Icesword and GMER

Listing of files shares []

  1. ShareEnum v1.6 -

End user license agreements (EULAs)Analyzer []

  1. EULAlyzer -
  2. EULA Analyzer (browser based service/beta) -

Cut and paste EULAs into the program and it will highlight suspicious phrases.

Listing of dangerous sites []

  1. - (no plugin just listing)
  2. Vista.pngFinjan SecureBrowsing -
  3. Vista.png Haute Secure (betaware)- (Includes elements of HIPS with sandboxing and behavior analysis).
  4. Vista.pngLinkscanner (free software available also for Internet explorer and firefox) -
  5. Robot Genius RGguard - New.gif
  6. Vista.pngScandoo -
  7. Vista.pngSiteadvisor (available via firefox extension) -
  8. Vista.pngSitehound -
  9. TrendProtect™ Beta Overview - TrendProtect™ Beta Overview -
  10. Vista.png Web Security Guard -
  11. See also Lists_of_freeware_antiphishing

Tools in these categories are typically browser addons (for both Internet explorer and Firefox).Somewhat related to anti-phishing tools, they typically overlay searches results from common search engines (e.g google, yahoo)with information about how trustworthy or dangerous the site is, allowing the user to be forewarned before clicking the link. In addition, most will also prompt a warning if you enter a url that the tool considers dangerous (not available for the freeware versions for some).

Note, each tool has slightly different definitions of what counts as dangerous or untrustworthy and targets slightly different class of threats. They include

(1) Websites that offer spyware and other malware exeutables for download - most common (Siteadvisor, RGguard) (2) Websites that use exploits (Linkscanner) (3) Websites that are phishing (Most in this list don't, see anti-phishing tools) (4) Websites that provide fraudulent services (Sitehound claims to warn about "Misleading or False Advertising")

There are several ways used to determine whether a site is bad, some scan the code on the page dynamically -real time analysis (Finjan SecureBrowsing) , others rely on prescanned results (Siteadvisor), others rely on other measures of trustworthiness -so called reputation systems (TrendProtect), yet others supplement all this with community analysis, where human users provide feedback and comments on the ratings provided.

Listing of file hashes/names/processes/startups/CSLIDS []

  1. Castlecops list - Note: Castlecops has other CastleCops#Research_Databases align=center
  2. FileAdvisor - - FileAdvisor client utility available
  3. -
  4. Prevx1 -
  5. ProcessLibrary -
  6. Runscanner list -
  7. Spyandseek -
  8. NSRL list -
  9. -

Installation monitors []

  1. FileMap by BB (file only) -
  2. InCtrl5 -
  3. Installspy -
  4. Installwatch -
  5. Look@win -
  6. Total uninstaller -
  7. ZSoft Uninstaller - alternative download align=center
  8. See also Lists of freeware virtualization

Tools that monitor software installs, by comparing the differences between a pre-install and post install states of the folders and registry. The idea here is that many uninstallers don't do a good job of removing every trace, hence the use of these installation monitors.

Scriptdecoder []

  1. VBScript Decoder -

Patch checker []

  1. Secunia Software Inspector - align=center
  2. Secunia Personal Software Inspector (betaware) - align=center
  3. Microsoft Baseline Security Analyzer (MBSA) -

Microsoft Baseline Security Analyzer (MBSA) only checks for Microsoft related patches. Secunia Software Inspector is an online service that checks not just Microsoft related software for security patches but also many other common applications like Firefox, Opera, Java, Flash and media players, IM clients, see list. etc. Secunia Personal Software Inspector runs locally on your computer like MBSA, but checks a much larger list of applications than the other two.

Other mass software updater checker []

  1. Appsnap -
  2. Vista.png File Hippo Update Checker - align=center

Scans your hard-disk for applications and checks them with an online database. Informs you which ones has newer updates available. These updates don't always contain security updates but might add features , fix other bugs etc.

This article is part of the Lists of Freeware Security Software: Malware Control series.

Freeware Anti-Viruses | Freeware Anti-Spyware | Freeware Anti-Trojans | Freeware Anti-Keyloggers | Freeware Anti-Rootkits | Freeware Firewalls | Freeware Behavior blockers | Freeware Sandboxes | Freeware Virtualization | Freeware Security analysis tools | Freeware Hardening tools | Freeware Blocklists | Freeware security services (excluding virus scanners) | Freeware Anti-Phishing | List of portable tools | List of unclassified tools

Related : Lists of online scanners