MJ Registry Watcher
MJ Registry Watcher is a simple registry, file and directory hooker/poller, that safeguards the most important startup files, registry keys and values, and other more exotic registry locations commonly attacked by trojans. It has very low resource usage, and is set to poll every 30 seconds by default, although you can adjust this to anywhere between 0 and 9999. A configuration file stores all your settings for future use. MJRW not only polls the system, but it also hooks it, so that most changes to keys, files and directories are reported instantaneously. Key deletions are still caught by the polling loop though, since they cannot be hooked. Exactly which keys and files are protected can be completely configured by the user, although the sets I supply with MJRW will cover most standard PCs.
MJ Registry Watcher is a simple registry, file and directory hooker/poller, that safeguards the most important startup files, registry keys and values, and other more exotic registry locations commonly attacked by trojans.
There is an additional automatic registry backup system that takes a snapshot of the entire registry about every 28 days and stores it in the directory MJRegBackup. The filename is of the form MJRegBackup_yyyymmdd.reg where yyyy is the year, mm is the month and dd is the day. The last 15 snapshots are kept. They can be restored from a menu option : this can be used in Safe Mode as administrator to rescue a non-booting PC. It should only be used as a last resort : it saved my PC when I accidentally knocked out the video drivers during an over-zealous session in the registry, cleaning out "LogMeIn"!
To install it, extract the files with pathnames, and you'll have a self-contained .exe file with a small help text file, the keys and files lists, and a couple of exclusion files in the MJRegWatcher directory. Launch RegWatcher.exe and then, use the Options, Settings, Automatic Startup Options screen to install it either just for the current user, or for all users. This will cause an alert which you should accept, and which shows that MJRW is already protecting your system. From this screen, you can also choose which key set to start it up with, or you can uninstall it.