RegistryProt

Discussion in 'ProcessGuard' started by Rasheed187, Jul 12, 2004.

Thread Status:
Not open for further replies.
  1. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Sorry, didn't know where to post it, but I think I might have a problem, what happened: I downloaded this app and unzipped it and clicked on regprot.exe, immediately I got a notification "an reg key has been added" etc, but I didn't want to deal with it so I clicked "no" a couple of times. Later when I recognized the keys I clicked yes.

    But now I think I might have deleted crucial reg keys, is that what happens when you click no? I'm a bit afraid to start up my computer now. :( But if these keys have been deleted, do you'll agree that this app is really stupid, in the way it works?

    Can I get some help, I checked my entries in Codestuff Starter and compared it when my running processes in Process Explorer, and it seems like I deleted a synaptics and ATI entry. How can I put these back? There also isn't a history.log file, where I can see what might have been deleted.
     
  2. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    From the help file:

    "When you first run RegProt, if any autostart keys exist then RegistryProt will ask you if you want to allow their existance. You would probably click Yes to most if not all of these keys. After clicking Yes to confirm the presence of a key, you will never be alerted again on that particular key unless the actual data in it changes."

    The Synaptics and ATI functions can be reset if you re-run your mouse and video configuration apps.

    Nick
     
  3. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Ok but I clicked no 4 times, so I know I deleted 4 keys, is explore.exe one of them, I'm a bit confused, I don't know if this is a startup file or not, but if I deleted it will I be able to start my computer?
     
  4. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    I would reboot your computer and see what happens. If autostarting programs fail to run as they did before, then you will have to configure them to do so again.

    Nick
     
  5. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Thanks for the feedback, I seem to have gotten away with it quite well, I only need to fix the autostart entry for my touchpad software, and no problems with my ATI stuff, but I still wonder what the other 2 things are, isn't there a way to get to know this?

    And btw, Explore.exe isn't a startup entry, it's related to the system system ini file I think. But I was getting a little scared you know, you never know what stupid things I might have done.

    But I think the way this app works needs to change, it doesn't need to notify you about the existing entries, or at least make a cancel button. And does this app work exactly like startup monitor, or is it more advanced?
     
  6. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Last edited: Jul 12, 2004
  7. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Oh so RegProt is more advanced, am I correct? I will autoload in that case, I also downloaded SSM, but the gui sucks, you can't maximize the window and it uses 10% of my cpu, so I don't like it.
     
  8. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    I use RegRun Gold and Process Guard. RegRun is a more advanced utility than RegProt.

    Nick
     
  9. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Thanks for the tip, I'm going ro download regdat now, might come in handy. Oh damn, I see it's shareware.
    I use Win98 SE btw, and I'm sure regrun and process guard are great apps, but they would make my pc too slow, I have a pentium 2 with only 128 of RAM. And Win98 SE also is a problem of course, with its awful user/system resources management .
     
  10. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Rasheed, Regarding Process Guard, it does not run on the older Windows versions such as ME W98 etc. It only works on XP, W2K and W2003 :)
     
  11. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Thanks for the tip Pilli. :) It seems like a lot of advanced apps don't run on Win9x, I'm thinking about putting Win2000 Pro on my PC, but I also will have to buy more RAM.

    But about RegProt, do you agree with my suggestion that it doesn't need to notify you about existing entries? OK, I should have read the help file, but I almost never do that.

    And it would also be nice if RegProt had a log file where you can see what have been deleted, in the helpfile I read that it makes a history.log file, but I can't find it.
     
  12. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Rasheed, Regprot is freeware and requires the user to learn what it does.
    I believe a new more advanced version is in development but have no details as yet. I am sure DCS will take all user input into account ;)


    Have fun - Pilli
     
  13. Wayne - DiamondCS

    Wayne - DiamondCS Security Expert

    Joined:
    Jul 19, 2002
    Posts:
    1,533
    Location:
    Perth, Oz
    It may seem inconvenient by asking you if you want to allow the existing entries when you first run it, but if for example you have a trojan that has set itself to automatically start in one of those locations you'll probably be grateful when RegistryProt informs you about it and be glad that it does ask you about the existing entries. :)

    One common characteristic that most trojans and also a lot of worms share is that they automatically start when Windows loads, and to do this they must make an "autostart reference", which more often than not occurs in the registry locations that RegistryProt guards.

    For a more detailed analysis of your autostart references, try Autostart Explorer (a tiny freeware application) available from http://www.diamondcs.com.au/index.php?page=asviewer

    Best regards,
    Wayne
     
  14. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Hi Wayne,

    Thanks for the tip, I already downloaded this app and it seems like it shows all of the startup items, but it is quite hard to spot a trojan between all these entries. Still it is quite handy. Oh and I have a idea about this app, it would be nice if it could remember the chosen column and screensize. :)

    About RegProt, I have disabled it because I kept getting notifications about an app, even though I already gave approval. The app was SC Keylog2 (keylogger), do you have an explanation for this?
     
  15. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    ^^^^

    Well anyone with an answer? I do not now why I keep getting notified about this app. I'm not getting any feedback via email from DiamondCS, but I can imagine they are quite busy.
     
  16. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Rasheed, DCS usually have the weekend off, I'm sure you will get an answer on Monday :)
     
  17. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,049
    Hi Rasheed

    Everything may be working normally depending on what SC Keylog2 does.
    I use Webroot's Windows Washer, and I have it set to clean the IE index file on reboot. Therefore everytime I run it regprot alerts me that the autorun key for Windows Washer is being set. You would never know with Regprot, but it is normal.

    Pete
     
  18. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,046
    Location:
    The Netherlands
    Thanks for the info, I'm going to send a logfile to DiamondCS now. ;)
     
Thread Status:
Not open for further replies.