MJ Registry Watcher

[Alan Baxter]

I always liked the way Ad-Watch would inform me if a program tried to configure itself to automatically start with Windows.  Ad-Watch was included with Ad-Aware SE Plus when I had that installed.  But Ad-Watch started using almost 100MB of memory, so I started looking for a free replacement.

I found a nice comparison of various registry monitoring programs and tried out MJ Registry Watcher (MJRW).  It's been actively supported by the developer for almost five years at http://www.wilderssecurity.com/showthread.php?t=54666.  The most recent version was released a couple of days ago.  From the MJRW home page:

MJ Registry Watcher is a simple registry, file and directory hooker/poller, that safeguards the most important startup files, registry keys and values, and other more exotic registry locations commonly attacked by trojans. It has very low resource usage, and is set to poll every 30 seconds by default, although you can adjust this to anywhere between 0 and 9999. A configuration file stores all your settings for future use. MJRW not only polls the system, but it also hooks it, so that most changes to keys, files and directories are reported instantaneously. Key deletions are still caught by the polling loop though, since they cannot be hooked. Exactly which keys and files are protected can be completely configured by the user, although the sets I supply with MJRW will cover most standard PCs.

I like it even better than Ad-Watch.  It doesn't automatically install itself to start up with Windows, but that can be done easily through the program's options.  Although it works well out of the box, it's very configurable.  By default, its Prompt Mode prompts the user with a deny/allow dialog for any changes to the keys listed in its default list.  Personally, I use Allow Mode to automatically allow all changes and just alert me to them instead.  The program makes it easy to change between Prompt Mode and Accept Mode from the system tray icon.  Since a Windows update can change many protected files and settings, it's recommended that the user switch to Accept Mode while doing one.

Does anyone else use this program or have any recent experience with it?  Are there alternatives I should evaluate?

[drhayden1]

Whats wrong with using winpatrol-think it almost does the same thing

WinPatrol is a tiny, but truly powerful security tool designed to detect and neutralize spyware, adware, viral infections and avoid the installation of various parasites and unsolicited malicious software. This program is not like a regular spyware remover, because it does not scan the entire file system or Windows registry. In place of this technique, WinPatrol uses another approach to secure the system and eliminate pests.
The application continuously monitors all the running processes and system services, installed browser plugins and currently scheduled tasks. It shows simple lists of mentioned objects and allows to remove or disable any of them. The user is provided with detailed information on each item including its full name, purpose, origin, exact location and current status. WinPatrol presents other similar lists containing startup programs, particular file types and applications associated with them. Another useful WinPatrol feature is the Cookies tool that allows to find tracking and potentially harmful cookies, filter them and remove those which pass the specified criteria.
The most useful and powerful WinPatrol feature is a real-time implemented in the application's PLUS version. Unfortunately, this version is paid, but is definitely worth to be purchased. The program detects practically all widely spread spyware and adware threats, browser hijackers and malicious Internet Explorer plugins and prevents their installation. It also is able to eliminate parasites by removing their essential components used to run the threat or implement its main functionality.
WinPatrol includes additional monitoring tools available in both paid and free versions. These tools detect changes to Internet Explorer home and search pages and warns if changes are made to critical system files. Such functionality makes WinPatrol the effective solution in fighting against browser hijackers and viruses.
The program's interface is simple, easy-to-use and attractive
http://www.filehippo.com/download_winpatrol/

[Eddy]

Personally, I just check manually in the register. No need to have a appliciction/util running when not needed. Just learn about your OS and use the options it already provides you. And trust me, there a lot more then you think.

All those "tweaking" utils? Noone needs them. You can't tweak anything that is already possible within your OS. They may make it a bit easier, but that is all.

[polonus]

Hi Eddy,

There are some that know MS Windows better than MS does, and you could qualify as one of them. Consider that a compliment. Yes there is Windows File Protection scheme that can be circumvented, there are the different levels of trust, there is settings for files in strange places as part of protection (not to have everything like everyone has it as a form of protection), there are the registry settings of autorun or autoplay, also rather complicated, we had a discussion here about that issue, there is running as different users with different privileges, there is sharing options, enabling and disabling this and that. I guess the poster for instance on XP could study the settings of SafeXP, but again you do not need a specific tweaking tool to do so, as you said,

polonus

[bob3160]

All those "tweaking" utils?

Eddy,
Winpatrol isn't a tweaking tool it's a watching tool and an excellent choice for most users even some of the experts.

[CharleyO]

***

There is a handy little program that can help you find all those options that Eddy mentions above.

I know for sure that I can not remember how to get to all of them and this program helps me find them.

It is called "Windows In A Box" and works perfectly with XP but only partially with Vista ......

http://bigdaddydesign.150m.com/windowsinabox.htm

Read a nice review of WiaB at the link below ......

http://www.winplanet.com/article/4047-.htm


***

[bob3160]

***

There is a handy little program that can help you find all those options that Eddy mentions above.

I know for sure that I can not remember how to get to all of them and this program helps me find them.

It is called "Windows In A Box" and works perfectly with XP but only partially with Vista ......

http://bigdaddydesign.150m.com/windowsinabox.htm

Read a nice review of WiaB at the link below ......

http://www.winplanet.com/article/4047-.htm


***

We've discussed that little gem a few times. Here's just one of the links:
http://forum.avast.com/index.php?topic=16922.msg240392#msg240392

[Alan Baxter]

Wow!  Thank you for all the replies.

I tried out WinPatrol Free.  It will complement my other system analysis tools.  Looks like WinPatrol Plus would provide more protection, but I'm not prepared to shell out $29.95 for it right now.

I evaluated Windows In A Box too, but it doesn't provide the real-time registry monitoring I want.

So far it looks like MJ Registry Watcher provides all the features I'm looking for at this time: highly customizable real-time registry and file monitoring and protection.  And it's free!  (Well almost, I donated.)

[DavidR]

Well I too have just downloaded it and started it, got an alert when first running it as my Firewall outpost pro 2009 harped in for the new process running and wanting to change stuff (sorry didn't pay too much attention) as part of its host protection function.

Had a quick look and it seems OK, still getting used to it.

Saw it in action, alerting when I ran an MBAM scan as MBAM creates and deletes a registry entry in currentcontrol set and

Low-level Drivers and Services
Registry Key hkey_local_machine\system\CurrentControlSet\services
Subkey MBAMSwissArmy has been added

and

Low-level Drivers and Services
Registry Key hkey_local_machine\system\CurrentControlSet\services
Subkey MBAMSwissArmy has been deleted

I wanted to allow this and add it to an exception but the only option was OK. I later found that MJRW only gives that when there is nothing it can do to stop the action (MJRW Help button). So yes it alerts but it appears there are some things that it can't stop.

[Alan Baxter]

I wanted to allow this and add it to an exception but the only option was OK. I later found that MJRW only gives that when there is nothing it can do to stop the action (MJRW Help button). So yes it alerts but it appears there are some things that it can't stop.

I just asked the developer about this. http://www.wilderssecurity.com/showpost.php?p=1424835&postcount=620

[drhayden1]

I tried out WinPatrol Free

Alan-New version of Winpatrol just released
Check the Update Thread I just posted
http://forum.avast.com/index.php?topic=9671.3675
I have the Plus version-well worth the $$

[Alan Baxter]

Got it.  Thanks, Doc.

[Alan Baxter]

I wanted to allow this and add it to an exception but the only option was OK.

Thanks again for the report, David.  The developer has addressed this problem in MJ Registry Watcher version 1.2.6.6, just released.
http://www.wilderssecurity.com/showpost.php?p=1425133&postcount=622

[DavidR]

Thanks for following this up, nice to see when suggestions are made they are acted upon.

Downloading it now.

[YoKenny]

Wow!  Thank you for all the replies.

I tried out WinPatrol Free.  It will complement my other system analysis tools.  Looks like WinPatrol Plus would provide more protection, but I'm not prepared to shell out $29.95 for it right now.

The Free version works just as well as the Fee version.

The PLUS version add information that can be found with Google but it makes it much easier.