Say a user is surfing the web and suddenly the system informs him that an executable file has been replaced in his Windows folder. Should he be suspicious ? Yes absolutely. This could help fight spyware and malicious software right from the start.

Spy the Spy is a software for Windows that monitors folders and subfolders (and even network folders) for file changes and additions. Only selected file extensions are being reported though. I was not able to find a list of all file extensions but a quick test revealed that .exe, .dll and .bat file extensions where included in the warnings. There are probably a few more that will initiate a warning.

By default only the Windows folder and its subfolders are monitored by the application. Other folders can be added with ease though, it’s probably a good idea to add the Program Files folder and the Documents and Settings folder as well.

Once a file gets added or changed in the monitored folders a warning will popup giving the user a handful of possibilities. The file can be moved to quarantine, the procedure can be logged and a System File Check can be initiated.

Spy The Spy is limited to reporting file changes and has a few limitations that make it a great addition to spyware tools. It cannot remove changes to the Windows Registry nor can it scan files to determine if they are indeed spyware or legit applications. Most importantly though it cannot deny read or write access to files and a file that produces a warning is already running on the system.

Related posts

• What is connecting to the Internet (4)
• Use Multiple Screens over Network (11)
• True Crypt 6 released (3)
• System Safety Monitor 2 (1)
• Softperfect Network Scanner (3)

Logistep uses a software called File Sharing Monitor that targets E-Donkey and Gnutella users. Here is how it works:

• The software connects to a p2p server and requests a filename recording all IP addresses that offer that name
• They request to download the file and if the download is permitted record the following information into a database
• Filename, file size, IP of the distributor, P2P protocol, P2P application, the time and the username
• When this is inserted the application does a automatic whois and is able to send an infringement letter to the ISP

I think it is interesting to note that this is almost an automatic process which leads to some questions. How do they know which archive has the correct size and is actually their product and not a broken archive ? Is not it only possible to know the exact file size if they downloaded it at least once to verify that is is indeed their product ?

Let us assume that they are not stupid and that they filter out every file below a certain size to prevent that users who do share mods or patches get sued. Let us further assume that a file that is labeled a certain way (with group tags) and shared among many users is the right program. Does this mean that the user that they are suing is responsible ? They will always sue the account holder which could or could not be the person who shared the files.

What possible solutions can I think of that make the Logistep file monitor useless ? Please note that this is hypothetic, I’m not advising anyone to actually use the methods listed below.

• don’t share files
• share only files with no plausible filename (3dpd)
• use encryption to share the files
• use vpns like Relakks
  to share them
• switch to Usenet
• buy the game ;)

Can you think of anything else left to say ?

Related posts

• The Media Defender Story continues (0)
• FrostWire, free and fast Gnutella (5)
• Youtorrent (2)
• Why some ISPs turn against their own customers (5)
• Why I wont be using Qtrax (7)

Can be used, for example, to detect incoming information over a network or to detect tampering of files

[tags]freeware, notify, windows, monitor, application, tool, utility[/tags]

Related posts

• Zip Repair (3)
• Zen Key An All Purpose Application Manager (3)
• Youtube Batch Downloader (13)
• Yahoo Widget Position Restorer (1)
• Workrave (6)