Registry Monitoring

For anyone who does not necessary wants a cute GUI tool to show you what changes on an box at any given time. there are multiple tools of different quality. Many batch tools can do a decent job of monitoring if they are run in startup and shutdown scripts. As for on-the fly tools you need to be very careful: usually such tools have side effects.  As the main reason to use them is to defend yourself from spyware Microsoft Antispyware tool (now Windows Defender) is probably one of more safe options.  Also upgrade to IE7 increases the chances to foil attempt to install spyware or direct you to the phishing sites.

Free Tools

1. RegMon by Mark Russinovich and Bryce Cogswell is probably the most popular free tool for this class. Very useful in analyzing the behavior of Spyware and dubious programs like Adobe.  Newer version is called Process Monitor:

   Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

   Process Monitor runs on Windows 2000 SP4 with Update Rollup 1, Windows XP SP2, Windows Server 2003 SP1, and Windows Vista as well as x64 versions of Windows XP, Windows Server 2003 SP1 and Windows Vista.  

    
2. InstallWatch. version 2.5 is provided as a free download. 
3. Microsoft antispyware tool (now Windows Defender) does a decent job of registry monitoring too.
    
4. I've found "tracker" to be helpful. See http://www.evans-programming.com/trackerf.htm
    
5. RegistryProt is a free, standalone, compact, low-level realtime registry monitor and protector, that adds another dimension to Windows security and intrusion detection. By monitoring important locations and keys in the Windows system registry,
   • RegistryProt will alert whenever a key is added or changed, and then give the option of accepting the key change, reverting back to the original key setting, or deleting the key.
   • RegistryProt's most useful attribute is that it will detect the vast majority of Trojans at the exact moment that they infect/install themselves into your system, and as such provides a new dimension in Trojan and intrusion detection. The problem here is that many programs write to registry on a regular basis using it as a notepad...

Commercial tools

Make a Windows Registry Snapshot- Completely uninstall any software

Registry Watch monitors changes in the Windows Registry and the file system. Registry Watch can undo the changes for you in a flash. Compare one Registry and file system snapshot before the installation of a program to a new Registry and file system snapshot after the installation is complete. It can completely uninstall any program. 

Registry Watch also can automatically backup your Windows Registry and restore it when you need to, an any Windows platform; from Win 95 to Win XP, NT to Win 2003. Making it the perfect Registry backup tool for Windows NT, XP,2000, and 2003, even if you have NTFS.

You can do either a system file snapshot or a registry snapshot, or both; giving you more control. This not only allows you use Registry Watch as an uninstaller, but also for finding changes on your system when you are not tracking a software installation. Registry Watch is a 100% complete software uninstaller.

Registry Watch has two functions, the first function it can perform is to make backups of the Registry, yes even on Windows NT, 2000, and XP. With this backup you can restore your corrupt Registry using Registry Watch to undo all the changes since your last backup. The second function it can do is to tell you what changes were made to your Registry and file system; and if you wish you can undo all or some of the changes. You have the ability to select what files to uninstall and/or what Registry Keys to uninstall.

Registry Watch takes a snapshot of the Windows Registry and then you can review any changes made in the Registry at a later time by creating a second snapshot to compare. The user has the option of comparing the entire Registry or just a single hive. The snapshot choices are HKEY_USERS, HKEY_LOCAL_MACHINE or the complete Registry which consists of both hives.

Registry Watch has the ability to undo changes using a second snapshot. Once the user creates a snapshot and compares the changes, the user may undo the changes by creating a report for viewing or undoing the changes. The user may also choose to remove some of the changes from the report before saving it, so that these removed items will not be undone later. You can even take several comparison snapshots using the original snapshot. This will allow you to see what is changed in the Registry when installing a program, then see what other changes were made when running the program. Allowing you to see all the changes from the original snapshot. You can save both reports if you like.

If you wish, Registry Watch will take you to the Registry Key you have selected in the report for viewing. Just click on "Go To Key". You can also send any line of the report to the Clipboard if you wish to copy and paste it.

The whole process, making the first snapshot - making the second snapshot to compare with - creating a report and saving the changes should take less than 60 seconds.

Recommended Links

Softpanorama Recommended

Monitoring and Troubleshooting the Registry  by Darren  Mar-Elia

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: June 05, 2008