RegistryProt

Sorry, didn't know where to post it, but I think I might have a problem, what happened: I downloaded this app and unzipped it and clicked on regprot.exe, immediately I got a notification "an reg key has been added" etc, but I didn't want to deal with it so I clicked "no" a couple of times. Later when I recognized the keys I clicked yes.

But now I think I might have deleted crucial reg keys, is that what happens when you click no? I'm a bit afraid to start up my computer now. But if these keys have been deleted, do you'll agree that this app is really stupid, in the way it works?

Can I get some help, I checked my entries in Codestuff Starter and compared it when my running processes in Process Explorer, and it seems like I deleted a synaptics and ATI entry. How can I put these back? There also isn't a history.log file, where I can see what might have been deleted.

 

From the help file:

"When you first run RegProt, if any autostart keys exist then RegistryProt will ask you if you want to allow their existance. You would probably click Yes to most if not all of these keys. After clicking Yes to confirm the presence of a key, you will never be alerted again on that particular key unless the actual data in it changes."

The Synaptics and ATI functions can be reset if you re-run your mouse and video configuration apps.

Nick

 

Ok but I clicked no 4 times, so I know I deleted 4 keys, is explore.exe one of them, I'm a bit confused, I don't know if this is a startup file or not, but if I deleted it will I be able to start my computer?

 

I would reboot your computer and see what happens. If autostarting programs fail to run as they did before, then you will have to configure them to do so again.

Nick

 

Thanks for the feedback, I seem to have gotten away with it quite well, I only need to fix the autostart entry for my touchpad software, and no problems with my ATI stuff, but I still wonder what the other 2 things are, isn't there a way to get to know this?

And btw, Explore.exe isn't a startup entry, it's related to the system system ini file I think. But I was getting a little scared you know, you never know what stupid things I might have done.

But I think the way this app works needs to change, it doesn't need to notify you about the existing entries, or at least make a cancel button. And does this app work exactly like startup monitor, or is it more advanced?

 

Take a look here:

https://www.wilderssecurity.com/showthread.php?t=32823

Using RegdatXP, you can view the various registry backups stored on your system (assuming your running XP) to find out what you deleted.


Nick

 

Oh so RegProt is more advanced, am I correct? I will autoload in that case, I also downloaded SSM, but the gui sucks, you can't maximize the window and it uses 10% of my cpu, so I don't like it.

 

I use RegRun Gold and Process Guard. RegRun is a more advanced utility than RegProt.

Nick

 

Thanks for the tip, I'm going ro download regdat now, might come in handy. Oh damn, I see it's shareware.
I use Win98 SE btw, and I'm sure regrun and process guard are great apps, but they would make my pc too slow, I have a pentium 2 with only 128 of RAM. And Win98 SE also is a problem of course, with its awful user/system resources management .

 

Hi Rasheed, Regarding Process Guard, it does not run on the older Windows versions such as ME W98 etc. It only works on XP, W2K and W2003

 

Thanks for the tip Pilli. It seems like a lot of advanced apps don't run on Win9x, I'm thinking about putting Win2000 Pro on my PC, but I also will have to buy more RAM.

But about RegProt, do you agree with my suggestion that it doesn't need to notify you about existing entries? OK, I should have read the help file, but I almost never do that.

And it would also be nice if RegProt had a log file where you can see what have been deleted, in the helpfile I read that it makes a history.log file, but I can't find it.

 

Hi Rasheed, Regprot is freeware and requires the user to learn what it does.
I believe a new more advanced version is in development but have no details as yet. I am sure DCS will take all user input into account


Have fun - Pilli

 

It may seem inconvenient by asking you if you want to allow the existing entries when you first run it, but if for example you have a trojan that has set itself to automatically start in one of those locations you'll probably be grateful when RegistryProt informs you about it and be glad that it does ask you about the existing entries.

One common characteristic that most trojans and also a lot of worms share is that they automatically start when Windows loads, and to do this they must make an "autostart reference", which more often than not occurs in the registry locations that RegistryProt guards.

For a more detailed analysis of your autostart references, try Autostart Explorer (a tiny freeware application) available from http://www.diamondcs.com.au/index.php?page=asviewer

Best regards,
Wayne

 

Hi Wayne,

Thanks for the tip, I already downloaded this app and it seems like it shows all of the startup items, but it is quite hard to spot a trojan between all these entries. Still it is quite handy. Oh and I have a idea about this app, it would be nice if it could remember the chosen column and screensize.

About RegProt, I have disabled it because I kept getting notifications about an app, even though I already gave approval. The app was SC Keylog2 (keylogger), do you have an explanation for this?

 

^^^^

Well anyone with an answer? I do not now why I keep getting notified about this app. I'm not getting any feedback via email from DiamondCS, but I can imagine they are quite busy.

 

Rasheed, DCS usually have the weekend off, I'm sure you will get an answer on Monday

 

Thanks for the info, I'm going to send a logfile to DiamondCS now.