Comparison to Startup Monitor???

Discussion in 'Ghost Security Suite (GSS)' started by HAN, Feb 24, 2005.

Thread Status:
Not open for further replies.
  1. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,098
    Location:
    USA
    I've been looking at RegDefend for the last couple of days. Looks really good, especially when comparing to the polling type protectors (which I agree do not provide the level of protection they purport...)

    One other product out there that I have been familiar with is Mike Lin's Startup Monitor. From my personal observations, resource-wise, it runs very tiny. And from what I can tell, I don't believe it's a polling type monitor.

    Any thoughts comparing these two apps? (Obviously one key difference, Startup Monitor cannot add any additional registry protections beyond it's designed startup locations.)

    (BTW, 1st post. Longtime lurker... :D )
     
  2. Jason_R0

    Jason_R0 Developer

    Joined:
    Feb 16, 2005
    Posts:
    1,038
    Location:
    Australia
    Hi Han, thanks for pointing out this program.

    It is a polling program, you can test yourself by using regedit, going to a run key, and creating a new value. The value is CREATED fine, when i enter in a path like "C:\", startup monitor then pops up and tells me the change occured. I know the item is in the registry and that this program is "polling" for changes by seeing the actual value in regedit after I refresh. If it wasn't polling, RegEdit would be "paused" as it is in RegDefend because it is trying to make the change but something is stopping it.

    The other issue with Startup Monitor is I could find no ways to add custom rules to it. I also don't appreciate how it didn't install properly (just dropped an EXE in the windows folder), but isn't that big of a deal. :)

    For what it's worth I know of no other program which is like RegDefend, currently that is.
     
  3. Startup Monitor ignores a few registry startup locations (I can't remember them all, but I think RunOnceEx is one of them). But it does monitor the Startup shortcut folders, wheras RegDefend doesn't.
     
  4. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    Then you can say that with RegDefend you can protect the whole IE registry keys, file extensions, and many more, that your other software does not :)

    I think RegDefend is just that, a registry protector.
    That's a fact that there is startup entries into the registry, but if you want to cover all startup ways, then you need to also cover over ".ini" files, there is many way to start at bootup.

    Regards,
    gkweb.
     
  5. The OP wanted to compare RegDefend with Startup Monitor, so that's what I did. It's too bad that no one takes RegDefend's approach, and makes it cover file system changes, too. I know a lot of you people like to run 7,000 "security" applications at a time, but I don't. And I won't.
     
  6. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    If you are running XP Pro, you can block execution via startup folders by using Software Restriction Policies. Create a path rule specifying the path to the startup folder and set the security level to "Disallowed". Rule violations will show up in the Application event log. No third-party security app required.

    Nick
     

    Attached Files:

Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.