Tiny Watcher: detect and reverse unwanted changes to your system


Tiny Watcher is a program that can create “snapshots” of your system that it uses to identify changes to your system including changes/additions to the registry, drivers, as well as programs or processes running for the first time on your machine.

I started looking for a program like this one after a recent posting of a program that downloads streaming media and which was billed as “portable edition” on it’s home page (“installation: none”).

As such I assumed that it was precisely that – portable – and that therefore like any truly portable program it did not write to the registry – which didn’t turn out to be the case.

What did turn out to be the case was that (a) it did indeed write to the registry, but, more problematic, (b) it installed two drives on my machine without notification and (c) it did not provide an uninstaller that removed these.

Hence I started looking for a tool that I could use to detect and/or reverse this sort of thing in the future, and Tiny Watcher is what I found. Here are more notes on this program:

  • How it works: Tiny Watcher will create a “snapshot” of your system the first time it is run and from that point it can perform comparisons with that snapshot every time that you restart your computer or whenever it is run. It does not run in the background at all times consuming resources. Although it will not intervene or block anything being modified or taking place on your system it can tell you about these changes after the fact and give you the option to remove them. Note, however, that you as the user will need to recognize/identify problematic changes and remove them; Tiny Watcher will not provide information on changes or a magical “Fix It” option.
  • What it monitors: to quote the their website “running process (including at logon time), startup registry keys, services registry keys, other sensitive registry keys, sensitive directories (c:’, Windows directory, “system32″ directory, etc), other sensitive files, scheduled tasks”. It will tell you which application performed the change or created the file, which is very useful.
  • Deep vs. Quick scan: once you are ready to look for any changes from your snapshot, Tiny Watcher offers two modes for scanning your system. I would probably go for doing a deep scan every time as the difference in terms of the time needed for both scans is not a lot and both are relatively fast anyway. Note that if Tiny Watcher does not detect any new items the program will not display a dialog or console at the end of the scanning process (a message of “no entries found” or something like that would have been a good idea).
  • User interventions/decisions: when run Tiny Watcher will compare the current state of your system with the stored snapshot and present a list of differences. For each item on the list the user can perform one of the following actions: (a) confirm (i.e. the action is OK, remove it from the list), (b) remove (self-explanatory), (c) disable (this option will be available if appropriate, as in the case of enabled drivers or running processes), and (d) volatile, which is to tell Tiny Watcher to consider the item in question to be something akin to a working or temp file or registry entry and to allow and ignore it the next time around. Note: you may get a combination of these or all of them depending on their relevancy to the items found.
  • Other actions: the program provides a 1-click button to search Google for any item found, as well as the option to open the folder for the selected item in explorer, open the selected registry entry in regedit, and open the MS services management console.
  • Configurable: you can edit the list of directories and registry keys to be monitored and decide on filetypes to be scanned and which filetypes to ignore. You can also specify which directories you would like the program to look into if you so desire.
  • Undoing changes done with Tiny Watcher: this is possible to some extent, as Tiny Watcher will rename the registry items that it removes rather than delete them altogether. You will need to manually go to the registry and rename them back, though, so you need to know what you’re doing (more info on this available on the Tiny Watcher site).

Wish list (or how this program can be even better):

  • Exporting interventions to BAT files: for later use. This would be a way to create uninstallers for apps that do not have them that can be used at a later time or shared with other users.
  • Undo function: it would be really cool if Tiny Watcher kept a list of all user interventions (and the date that they took place) and allowed you to undo (re-instate) these from a dialog or interface without needing to manually do this in the registry as previously noted.

The verdict: Tiny Watcher can be best utilized obviously when you would like to conduct a reversible test of what a program or installer does to your system. The best situation is when you are suspicious in advance, whereby you can run Tiny Watcher, view and/or resolve any entries that are there, run the suspicious program and then go back to Tiny Watcher to see what the new program did to your system, if anything. If on the other hand you have cause for suspicion in hindsight that something is not right with your system (and if Tiny Watcher is already installed) you can still run this program and get a listing of all changes to your system; however in this case you will have to do a lot more investigative work figuring out what these changes are and who is responsible for them and whether or not they are malicious or unwanted. More work, but at least you have recourse.

I like this program quite a bit. I think the model that it uses (of taking a snapshot and comparing it to subsequent states) is a very good one not just in that it preludes the need to be monitoring in the background at all times, but also because it precludes the need to tell the monitoring app which apps/processes to monitor (as is the case for example with NirSoft’s RegFromApp). Tiny Watcher also has the edge in that it not just monitors changes to the registry but also any driver installations or creation of files in the system folder. Overall I highly recommend it.

Version Tested: 1.5

Compatibility: WinAll: 95/98/ME, 2000, NT, XP, Vista.

Go to the program page to download the latest version (approx 541K).

  • Wow, pretty cool, looks a lot simpler and probably runs a lot better then XP System Restore.

  • pitzler

    how does it compare to winpatrol?
    I like winpatrol a lot!

  • aka Muttley

    Unless I’m mistaken, seems similar to an old programme called Cleansweep. Could be worth a look, but if I’m suspicious in advance I just load Returnil: complete rollback every time.

  • David

    I just wanted to let you know that I read your website on a daily basis, and every time I want to download one of your suggestions I have the DAMNDEST time finding the download link. You need a big green button at least 100pixels wide!

  • Cody

    So what did you end up doing with the changes made by the streaming media downloader? How did you remove the drives it created…I think I might need to know. 🙂

  • “I have the DAMNDEST time finding the download link”

    Agreed. Not only is the link smaller than the rest of the text, the link color is also low contrast. I like this site, but with links that hard to see, it’s almost like we’re not *supposed* to download the software. 😉

  • John

    I think there’s something wrong with this sentence:
    The documentation states that you can tell specify which directories you would like the program to look into but I was.

  • John

    And yes, you can specify the directories as follows:
    File > Options… > More Options > Directories and files…

    (The “More Options” menu is in the upper left corner of the Options window.

  • Dave

    I’ve been using this for years. Great little program. Over time, I’ve made my own list of registry entries and directories.
    If you’ve got any questions about it, you might want to check out Wilders Security Forums. I’m sure you can get answers to any questions you have there.

    pitzler: Winpatrol is running program that checks your computer in real-time (paid) or polls every few minutes (free) for changes to your system (autoruns, BHO’s, services etc.).
    Tiny Watcher just runs at logon, checking whatever registry entries and directories that are in its watchlist, then closes. It doesn’t stay running in your system tray the way W.P does.

    aka Muttley: If you mean the old Norton Clean Sweep, that program was like CCleaner, removing unnecessary files. Tiny Watcher is a system monitor, checking for changes on start up.

  • Dimension-X

    Great. Thank you.

  • Dimension-X

    I’d like to add that this is not a ‘novice tool’ as stated on the developer’s site. If you need a progam to control an installation, i.e. check what has been installed to which folders, and maybe safely remove an unwanted application it’s better to use an uninstaller (Revo Uninstaller, Total Uninstaller).

  • Samer

    @aka Muttley:
    I agree Returnil (which I reviewed a while back) is a better option if you are suspicious in advance and if the program you are installing does not require a reboot. But Tiny Watcher can provide a lifeline when you have already installed something. Also, with Tiny Watcher I can peer in and see what a program does, which can be extremely helpful.

    I will re-write the TubeMaster review this weekend (hopefully) to include uninstall instructions. Note that the Tiny Watcher screenshot above shows the changes made by TubeMaster. Also, TubeMaster has been updated since my review and after a preliminary investigation it *may* be the case that its no longer installing those drivers and making those regsitry changes. Will provide more info later on.

    Thanks for walking me through that. Changed the text of the review accordingly.

    Thanks for outlining differences between this software and WinPatrol.

    Thanks for your comments. I agree an uninstaller is better for novices, or even simply using the aforementioned Returnil.

  • steve

    A lot simpler and runs better than System Restore? Reviewer, please tell me you’re joking.

  • Loves

    ““I have the DAMNDEST time finding the download link””

    “Agreed. Not only is the link smaller than the rest of the text, the link color is also low contrast. I like this site, but with links that hard to see, it’s almost like we’re not *supposed* to download the software.”

    Well, you know where it is now…

  • suja

    Wonderful program- Thank you for the efforts.
    I have started enjoying that “invisible” download links–unique for this site.( though I was also irritated initially)

  • Ricardo Burruel

    Wonderful program- Thank you for the efforts.

  • zytron

    Its a “carbon friendly” download link – small footprint 🙂

    This site captures the spirit of the internet. Rational conversation with mature people, young and old…