New Version of MJ Registry Watcher 1.2.7.7

MJ Registry Watcher version 1.2.7.7 has been released at http://www.jacobsm.com/mjsoft.htm#rgwtchr and has the following changes :-

Changes 1.2.7.6 to 1.2.7.7
1) Added DLL injection detection.
2) Improved email alert delivery reliability.

DLL injection detection is not 100% reliable, but it does alert if it finds one, and sometimes it can include the launching application (as in the screen snapshot). Enjoy!

 

Maybe is interesting to use it together with Exewatch... https://www.wilderssecurity.com/showthread.php?t=322697&highlight=exewatch

 

GE: I updated to 1.2.7.7 manually and then tried the "Check for Updates" link inside the program (just to see if it was connecting ok.) It came back with the attached message. Thoughts?

 

Yeah, sorry. My ISP's server is case-sensitive about filenames, so I had 2 update files with the same name (one was the old one you showed above). It's all fixed now, but you may need to exit and relaunch MJRW for it to shed the cached version. :shame:

 

Thanks for the quick answer! And the quick solution!

 

Thank you

 

Keep up the good work Graphic

This is one of those registry monitors that fits many users setups nicely as a well rounded compliment which, AFAIK is completely compatible with the majority of other security applications commonly applied.

Regards EASTER

 

i really like MJ Registry Watcher but at this very moment i am currently trialing Startup eye Registry Monitor,which one is more complete

 

MJRegistry Watcher monitors far more then just StartUp entry attempts and also monitors file drops in directories too!

 

yeap i have it on the highest level of security

 

I may be a little biased here, but I'd say MJRW is more complete. The one feature I saw that Startup Eye has is "Scan File", but I am not sure what that does exactly. If it just submits the file to, say, Virustotal.com, then it's not such a biggie. It looks like it's part of a suite of programs - I noticed TCPEye too. Anyway, MJRW spots everything StartupEye does and a whole lot more (startup directories, system files, services, drivers, injected DLLs, exotic registry locations, TCP/IP stacks ...)

 

yeap

 

a 64 Bit version please ?

 

Why? When is 32-bit due to be shelved?

 

+1 ......

 

To update my compiler to 64-bit,

1) I have to wait till 2012 Q4.
2) It's going to cost me in excess of £1,000.
3) It's going to take a lot of work to port MJRW to 64-bit and Unicode (all strings are in Unicode with the new 64-bit compiler).
4) The new compiler is probably going to be of Alpha quality, because Embarcadero have a track record of buggy releases with their first stabs at things.

This is why I am asking you for good reasons to go to 64-bit. As I asked before, is 32-bit going to be shelved soon? What benefits would befall MJRW if it was 64-bit instead of its current 32-bit incarnation?

 

Sorry, I know I can't ask anything as you provide this software as Freeware but it was merely a simple request. Sorry if it offended you.

 

I think most of the new computers now being sold in the US are 64 bit using Windows 7 . Certain low priced computers and small laptops with less than 2 GB memory are still around and most of these2-3 GB. The version actually being sold is W7 home premium. If you are in the market for a replacement computer today you will probably buy a 64 bit computer with 4-8 GB memory. There are an awful lot of 32 bit computers around but they will be probably replaced by 64 B in the next few years. It sure would be nice to have MJ RW as 64B but I myself would find it difficult to justify that type of expense in order to issue a 64B version.

 

Let me explain from the programmer's point of view.

64-bit allows you to address more than 4GBytes of memory. MJRW does not require this kind of access. A 64-bit OS like Windows 7 or 8 runs 32-bit programs in exactly the same way Windows XP does.

So, the question remains, what do you expect to gain by using a 64-bit version of MJRW?

Sorry if I sounded "shirty" before, but it's a common misconception that you need to have 64-bit versions of software for 64-bit OSes! MJRW does not need to be 64-bit.

 

Hey Graphic,

I hope you dont mind but I have some small user experiance suggestions for you. I am messing around with the program now so I am still kind of new and have made some mistakes along the way (such as having DefenseWall isolate MJRegistry and having RegEdit spike high)

1. In the Main UI instead of having the X just close the program why not have the ability to either ask the user quit to taskbar or quit app. It make make it a little bit clearer.

2. Add a menu button on the tray icon

From this menu it would be nice if we had the ability to pause protection for X amount of mins. Close the app, check for updates and so forth without having to go into the main UI.

Those are just my suggestions but I may be wrong about some of them. Other then that really nice app it I like how light it is.

 

Both are great suggestions, so I'll do those in the next version (if there are no objections) which will be 1.2.7.9

I will also add a couple of keys and values I have exempted during Windows 8 usage. I'll keep you posted in a new MJRW announcement thread coming soon.

Regards,

 

Graphic Equaliser

I was holding out hope that MJ Reg Watcher would be improved to monitor also Windows 8 O/S. I was trying everything to get an older version to work but with no real luck.

This is a very well thought out and useful program that is in a very elite group of very few long-term apps that are still proven vital today and given attention to the latest MS O/S system compatibility.

Thanks and keep up the good work. You have established a place in tech/net history in my book for keeping this app continually active and useful as ever.

Regards EASTER

 

Easter, I have Windows 8 64-bit pro on a PC next to me, and MJRW 1.2.7.8 works fine on it. OK, you need to configure it to "Run as Administrator" using the properties for the executable file RegWatcher.exe and OK a UAC prompt every time the PC starts up, but it works. Go to RegWatcher.exe and get its properties up. Select the Compatibility tab. Tick the "Run this program as an administrator" checkbox under the "Privilege level" heading. You could also do this for all users by clicking the "Change settings for all users" button at the bottom of this tab.

You can also bypass the UAC prompt by using the Task Scheduler to run MJRW at startup with administrator privilege rather than using a Run key.

P.S. Thankyou for your very kind comments. Warmest regards.

 

@Graphic Equaliser

Just getting started with RegWatcher. Can you offer a quick explanation of "Accept Mode." Is this to be used as a short-term auto learning mode - or is it something altogether different?

 

Accept mode never bothers you about changes going on, but logs them all and makes an alert sound. It also sends an alert email if you have MJRW configured to send these whenever an alert occurs. It is useful for learning what changes normally occur on your PC, but its main use is for unattended recording of system changes on a PC. I use it on a web server our company runs, so that if someone makes any system changes to that PC, I get sent alert emails detailing what changes have occurred. That way, I can keep an eye on the web server on a daily basis, wherever I am in the world. I also used Accept mode to record changes happening to a new Windows 8 PC in the office, so that I can see which keys and values to exempt. A regular change Windows 8 makes to the registry involves the key hkey_lmus\software\microsoft\windows\currentversion\explorer\plmvolatile and so this will be in the exempt keys file with the next release of MJRW (1.2.7.9). HTH,