Registry Alert monitors the Windows Registry for unwanted modifications
Registry Alert is a free program for the Windows operating system that you can utilize to monitor the Registry for changes.
Some programs that you install on your version of Windows add entries to sensitive locations of the Windows Registry. Places like the various startup locations found in the local Registry that programs use to autostart with the Windows operating system are high value targets not only for legitimate software programs but also adware and malware.
While that is sometimes wanted, for instance for security software, it is often unwanted as the gain from doing so is minimal, and that's only if the program is trustworthy. Malware and spyware is often added to an autostart location so that it starts with the system.
Sometimes, legit software such as Google Update, adds itself to the Registry regularly and seems to come back a day or so later even if you remove it from it regularly.
Registry Alert review
Note: The program homepage is no longer available. We have uploaded the latest working version of Registry Alert to our own server. Please note that we don't support the program in any way. You can download it with a click on the following link: Registry-Alerts-220.127.116.11.zip
Registry Alert is a free program for the Windows operating system that monitors the system's Registry for changes so that you can react to those changes manually or configure the program to handle them automatically. It monitors startup locations by default but can be configured to monitor other locations as well that you add manually to it.
It displays alerts to you on first run if it finds programs listed in one of the startup locations of the Windows Registry that it monitors.
The prompt displays information about the entry including its name, file location, Registry location, and options on how to deal with it.
You may click on yes to delete the entry or no to keep it. In addition to that, you may check one or multiple of the following options: always remove it, always stop, or stop this running process.
Some of the options are useful in preventing repeat offenders from being added to the monitored locations. You can prevent the aforementioned Google Update process for instance from adding itself to the system startup by checking "always remove it" and "always stop" when it comes up so that it is handled automatically from that moment on.
You can open the list of events that you have added this way at any time with a right-click on the program icon and selecting the "all Registry keys" option from the context menu.
The window provides you with information about rules that you have added to the application and options to remove those rules again which can be helpful if you have made an error.
They are divided into "allowed Registry keys", "removed Keys" and "always remove Registry keys", each listing the name of keys added to the them as well as their data value and Registry location.
Custom Registry Alerts
More interesting than this is the ability to monitor additional Registry keys. Right-click on the program's system tray icon again and select "add new alerts" from the context menu.
This displays a new window which you use to add or remove new Registry alerts.
Core program features:
- Monitor Registry keys for changes.
- Create automatic rules for specific programs to allow or deny access.
- Stop running processes, and configure the program to always stop select processes.
- Restore keys that you have removed at any point in time.
The monitoring feature is excellent but the option to stop related processes as well is what makes this program very helpful when it comes to removing and blocking spyware on Windows systems.Â It can also aid you in dealing with processes such as Google Update and other programs that are re-added regularly to the system startup,
Seems like a terrific program with one question, Martin. Is it light enough on system resources?
It is using about 9 MB of RAM and virtually no cpu when it is running. Memory creeps up a bit but stops eventually at about 15 MB.
this program needs to run all time??
Yes that is correct.
I use Regshot 2 sometimes. It needs to be run manually, e.g. before the installation of a program and then again afterwards.
What worries me is that a project that reached version 4.2 was not able to properly setup a website, even though it seems to be a “one man project”… Also, in the “Support” section on SF.net you can read: “Unfortunately, this project hasn’t indicated the best way to get help”. Not very encouraging…
Does the program support Win8?
I still use the venerable StartupMonitor and Startup Control Panel from Mike Lin (http://www.mlin.net/).
I am a long life member at Wilder’s Security Forums and i been screaming for some developer to build a program just like this to no avail.
Comodo. and similar HIPS fail miserably at such a simple guard/monitor to custom alert to any writes/modifications in the Registry.
This app has got all that and more but DOES NOT WORK correctly on my Windows 8. WHY?
It only alerted to HKCR/ run key but adding HKLM run yielded nothing.
Please keep developing this app. It gets working well enough and it will be in high demand. Take it from someone who knows.
Also adding a custom ALERT sound wave would make it even more appealing.
Can we have cpp code to get an register alert ?