MJ Registry Watcher is a simple registry, file and directory hooker/poller, that safeguards the most important startup files, registry keys and values, and other more exotic registry locations commonly attacked by trojans. It has very low resource usage, and is set to poll every 30 seconds by default, although you can adjust this to anywhere between 0 and 9999. A configuration file stores all your settings for future use. MJRW not only polls the system, but it also hooks it, so that most changes to keys, files and directories are reported instantaneously. Key deletions are still caught by the polling loop though, since they cannot be hooked. Exactly which keys and files are protected can be completely configured by the user, although the sets I supply with MJRW will cover most standard PCs.

There is an additional automatic registry backup system that takes a snapshot of the entire registry about every 28 days and stores it in the directory MJRegBackup. The filename is of the form MJRegBackup_yyyymmdd.reg where yyyy is the year, mm is the month and dd is the day. The last 15 snapshots are kept. They can be restored from a menu option : this can be used in Safe Mode as administrator to rescue a non-booting PC. It should only be used as a last resort : it saved my PC when I accidentally knocked out the video drivers during an over-zealous session in the registry, cleaning out "LogMeIn"!

To install it, extract the files with pathnames, and you'll have a self-contained .exe file with a small help text file, the keys and files lists, and a couple of exclusion files in the MJRegWatcher directory. Launch RegWatcher.exe and then, use the Options, Settings, Automatic Startup Options screen to install it either just for the current user, or for all users. From this screen, you can also choose which key set to start it up with, or you can uninstall it. Softoxi have also done a brief video tutorial in installing and exploring MJRW.

Please note that under Vista and later, MJRW may need to be configured with administrator privilege to write to the registry. To do this, go to the RegWatcher.exe file in Explorer, right-click to Properties, and go to the Compatibility tab. Check the admin box. Whenever the PC is restarted, you may have to OK MJRW to start with admin rights. Unless you disable UAC, the only way round this is to use the task scheduler to launch MJRW with administrator rights and set it to run at log on.

There is also a service mode which is documented in the help file as follows:

RUNNING MJ REGISTRY WATCHER AS A SERVICE
You will need administrator access rights to set up the MJ RegWatcher Service. You can use the item under the Options menu to "Install MJ RegWatcher Service". REMEMBER TO UNINSTALL THE INTERACTIVE MJ REGISTRY WATCHER (using Options, Settings, Automatic Startup Options or disabling the scheduled task or Startup menu item) before you start using the service since they cannot be run simultaneously. Once interactive MJRW is uninstalled, and the service has been installed, you can start the service by running services.msc (or Administrative Tools, Services from Windows) and going to the entry "MJ RegWatcher Service Stub" and starting it. Once running, it will continue to run until the PC is shutdown, surviving logins and logouts, and automatically starting up when the PC is started (and before anyone logs in). If someone tries to terminate it without stopping the service stub, it will be re-launched automatically.

To remove the service, you have to stop the service running using services.msc (or Windows service manager with Administrative Tools, Services). Navigate to "MJ RegWatcher Service Stub" and stop it. Then launch interactive MJ Registry Watcher (by running RegWatcher.exe from the installation directory) and choose "Uninstall MJ RegWatcher Service" from the Options menu. REMEMBER TO INSTALL THE INTERACTIVE MJ REGISTRY WATCHER (using Options, Settings, Automatic Startup Options or enabling/creating the scheduled task or Startup menu item) if you want MJ Registry Watcher interactive mode to start up automatically when someone logs in.

The service has some important differences from the interactive mode :-
Only Accept and Reject modes are supported. Prompt mode defaults to and sets Accept mode.
There is no tray icon or visible application interface. It runs invisibly.
Keys and filespecs prefixed with $ to always prompt, will instead Accept or Reject depending on which mode is set.
The configuration of the service is taken from that used by the normal interactive configuration.
Only one instance of the service can be run at a time, and it cannot be run at the same time as an interactive session.
To be informed about alerts while the service is running, you can :-
a) Run the application mjrwmon.exe from the installation directory to watch the service
b) Use the alert sound set in interactive mode
c) Use the email settings set in interactive mode
d) Keep a view open and refreshed on the log file mjregwatchkeys.log

If a trojan attempts to change your startup settings, you will be alerted, and you can prevent any changes being made. You can also configure MJRW to email the alert details to, for example, an administrator. It is fully configurable as to what keys and files are monitored, so, if you have a vested interest in protecting your file association for the mailto protocol (your default emailer), so that your preferred app loads them, and something else is trying very hard to undermine this association (Outlook for example), this will popup, offering to stop a new association attempt, after Outlook had loaded, say. The key that stores this association is hkey_lmus\software\classes\mailto\shell\open\command, and you will find that all such keys are covered by the wildcard key hkey_lmus\software\classes\???\shell\???\command. This means that all your file associations are protected. All the system files are also monitored, including system dlls, executables and driver files. If there is a change to any of these files, an alert is recorded as to what files have changed and you may be optionally informed with an on-screen alert. However, changes to the files cannot be undone.

It assumes write access and directory create rights for the path the .exe file sits in (ie. wherever you installed it). The default set of keys and files should ensure that nothing gets run at startup without you knowing about it, and important boot up files don't get changed behind your back. When monitoring, keys are opened in Read-Only mode, and the application only needs Write Registry access when it has detected a change. It keeps a log of any suspect activity, and displays any such information for the current session in the bottom panel. A log file has this appended to it and can be viewed by pressing the Log button. The file keeps a complete history of alerts.

The default set of keys was chosen to balance security against intrusiveness. However, you can experiment by selecting different security levels on the Options menu, and see the impact on PC performance. The higher you set it, the better the coverage, and also, the more warnings you'll get (especially with the openwithlist keys monitored). This list is based on some invaluable work done by Hojtsy documented in Hojtsy's compiled list of the security hotspots in the registry. It also has stuff from the Gladiator AV Forum and Silent Runners' Launch Points List.