Looking for an integrity-check portable

[cmmehl]

Hello all,

I was recently in a 4th-class internet-cafe of the 3rd world, where my stick with all the portable goodies got infested with a worm. Don't remember exactly which one, in any case, it overwrote most of the executables on my stick with itself (keeping the original name, but of course the size was then always some 80kb or so). And this without me having launched anything of doubt like e-mail attachments or so ...

Luckily, I became aware of it because the icons didn't show up anymore in P-start, but I shudder by the thought what could have happened had I launched one of my favourite portables on my own computer afterwards ... Well, since I had a recent backup of my stick I simply played it back.

Now my idea to prevent havoc caused by such nuisances: to have a little prog that has registered all "approved" executables on the stick and checks them before being launched. This could be nicely inetgrated into P-start or other launchers. But so far I haven't found such an integrity checker.

Suggestions, anybody?

Cheers
Chris

[Andrew Lee]

The only integrity checker I can think of is ICE ECC. The nice thing about it is that you can even recover corrupted files.

[cmmehl]

Thanks for the suggestion, it looks like a neat program with many features. For my purposes, however, I was rather looking for something that can work off a list and not file by file, because P-start doesn't have the option of pre-running an application before launching a menu-item. Also, I don't need restoration, just a warning that the file has been changed (to a worm, for example …), and I wanted it to be fast.

I was lucky to find this little gem: Integrity Checker by Sarah Dean.

It does exactly what I need – it creates a list with the files to check (I included here the main executables I'd likely use in an internet-café – browser, mail-client and Gaim) and can load and cross-check this list automatically with a command-line parameter. Even better, another parameter allows for a check completely in the background, and only if a problem is found a window will pop up, otherwise one doesn't even notice that the files are being checked. Works like a charm – I have renamed a file to test if I actually get an alert … and I did.

So with these parameters, I put it on autostart within P-Start, and since the program is lightning fast, it doesn't noticebly delay P-Start at all. The only slight disadvantage is that the list must probably be edited when new versions of the controlled programs are installed. Would be great if P-Start had this program integrated as an option …


I sincerely suggest to add the program to the DB, here are the infos:

Category: Folders/Files / Integrity Checkers

Synopsis: Integrity Checker is a straightforward application that checks the integrity of your files to ensure they have not been tampered with.
The files you select for protection will have their "known good" size stored together with either a hash or HMAC (user selectable) generated from the contents of each file. By comparing this information with what is actually stored on your drives later, any changes will be flagged up for your attention.

Writes settings to: none. Lists to check can be placed at conveniance. Registry integration is an option, disabled by default. In order to be fully portable and to adapt to changes of the drive-letter, the .ic-file must be edited manually (delete the drive-letter, the program appears to assume to start from the root).

How to extract: Download the ZIP package and extract to any folder of your choice. Launch the program by double-clicking on IntegrityChecker.exe.

License: Freeware

Size on disk: 668 kb

Cheers
Chris

[Andrew Lee]

Thanks! Posted to the database.