Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Registry Monitoring

For anyone who does not necessary wants a cute GUI tool to show you what changes on an box at any given time. there are multiple tools of different quality. Many batch tools can do a decent job of monitoring if they are run in startup and shutdown scripts. As for on-the fly tools you need to be very careful: usually such tools have side effects.  As the main reason to use them is to defend yourself from spyware Microsoft Antispyware tool (now Windows Defender) is probably one of more safe options.  Also upgrade to IE7 increases the chances to foil attempt to install spyware or direct you to the phishing sites.

Free Tools

1. RegMon by Mark Russinovich and Bryce Cogswell is probably the most popular free tool for this class. Very useful in analyzing the behavior of Spyware and dubious programs like Adobe.  Newer version is called Process Monitor:

   Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

   Process Monitor runs on Windows 2000 SP4 with Update Rollup 1, Windows XP SP2, Windows Server 2003 SP1, and Windows Vista as well as x64 versions of Windows XP, Windows Server 2003 SP1 and Windows Vista.  

    
2. InstallWatch. version 2.5 is provided as a free download. 
3. Microsoft antispyware tool (now Windows Defender) does a decent job of registry monitoring too.
    
4. I've found "tracker" to be helpful. See http://www.evans-programming.com/trackerf.htm
    
5. RegistryProt is a free, standalone, compact, low-level realtime registry monitor and protector, that adds another dimension to Windows security and intrusion detection. By monitoring important locations and keys in the Windows system registry,
   • RegistryProt will alert whenever a key is added or changed, and then give the option of accepting the key change, reverting back to the original key setting, or deleting the key.
   • RegistryProt's most useful attribute is that it will detect the vast majority of Trojans at the exact moment that they infect/install themselves into your system, and as such provides a new dimension in Trojan and intrusion detection. The problem here is that many programs write to registry on a regular basis using it as a notepad...

Commercial tools

Make a Windows Registry Snapshot- Completely uninstall any software

Registry Watch monitors changes in the Windows Registry and the file system. Registry Watch can undo the changes for you in a flash. Compare one Registry and file system snapshot before the installation of a program to a new Registry and file system snapshot after the installation is complete. It can completely uninstall any program. 

Registry Watch also can automatically backup your Windows Registry and restore it when you need to, an any Windows platform; from Win 95 to Win XP, NT to Win 2003. Making it the perfect Registry backup tool for Windows NT, XP,2000, and 2003, even if you have NTFS.

You can do either a system file snapshot or a registry snapshot, or both; giving you more control. This not only allows you use Registry Watch as an uninstaller, but also for finding changes on your system when you are not tracking a software installation. Registry Watch is a 100% complete software uninstaller.

Registry Watch has two functions, the first function it can perform is to make backups of the Registry, yes even on Windows NT, 2000, and XP. With this backup you can restore your corrupt Registry using Registry Watch to undo all the changes since your last backup. The second function it can do is to tell you what changes were made to your Registry and file system; and if you wish you can undo all or some of the changes. You have the ability to select what files to uninstall and/or what Registry Keys to uninstall.

Registry Watch takes a snapshot of the Windows Registry and then you can review any changes made in the Registry at a later time by creating a second snapshot to compare. The user has the option of comparing the entire Registry or just a single hive. The snapshot choices are HKEY_USERS, HKEY_LOCAL_MACHINE or the complete Registry which consists of both hives.

Registry Watch has the ability to undo changes using a second snapshot. Once the user creates a snapshot and compares the changes, the user may undo the changes by creating a report for viewing or undoing the changes. The user may also choose to remove some of the changes from the report before saving it, so that these removed items will not be undone later. You can even take several comparison snapshots using the original snapshot. This will allow you to see what is changed in the Registry when installing a program, then see what other changes were made when running the program. Allowing you to see all the changes from the original snapshot. You can save both reports if you like.

If you wish, Registry Watch will take you to the Registry Key you have selected in the report for viewing. Just click on "Go To Key". You can also send any line of the report to the Clipboard if you wish to copy and paste it.

The whole process, making the first snapshot - making the second snapshot to compare with - creating a report and saving the changes should take less than 60 seconds.

Recommended Links

---

In case of broken links please try to use Google search. If you find the page please notify us about new location

Monitoring and Troubleshooting the Registry  by Darren  Mar-Elia