Luketan/windows

My pick


This used to be freeware, went payware and now it's freeware (March 2008) again. A niche product, it is however very well established dating back to 2004 and was heavily discussed at Wilder's Security .

As described below it is a very customizable registry and file protector.The build in lists (there are several) are extremely comprehensive but you can easily customize and add/remove new registry keys ,value and files you want.

Earlier versions of this program was a 100% poller (it "polls"/checks the registry every x seconds) , so it didn't detected changes instantly which was a weakness.

The current version is part hooker/part poller. It is able to instantly detect most additions, but it still requires polling to detect file changes and key deletions.


From the page: "MJ Registry Watcher is a simple registry, file and directory hooker/poller, that safeguards the most important startup files, registry keys and values, and other more exotic registry locations commonly attacked by trojans. It has very low resource usage, and is set to poll every 30 seconds by default, although you can adjust this to anywhere between 0 and 600. A configuration file stores all your settings for future use. MJRW not only polls the system, but it also hooks it, so that most changes to keys, files and directories are reported instantaneously. Key deletions are still caught by the polling loop though, since they cannot be hooked. Exactly which keys and files are protected can be completely configured by the user, although the sets I supply with MJRW will cover most standard PCs."

Yet another autostart lister. My pick with reservationsWhile autoruns, runscanner, Silentrunners might be more comprehensive in terms of startup/hijack/launch points monitored, they can not detect entries hidden by rootkits.

Of course, you could use a antirootkit that provides a registry scanner , but those will usually scan and reveal ALL "hidden" entries and some of them might actually be rubbish/harmless (many entries are not really hidden but they appear hidden only because of the scanning technique).

OSAM claims to be able to detect rootkits using comparative scans while doing so only for selected autostart entries. It is kind of like autoruns with the added plus with the possibility of detecting entries hidden by rootkits.

Site lists different ways of protecting oneself when installing suspect software. 4 different ways are mentioned from using sandboxes to using virtual partition/shadow software. Freeware alternatives are mentioned.

From the page: "Windows SteadyState
Brief Description
Whether you manage computers in a school computer lab or an Internet cafe, a library, or even in your home, Windows SteadyState helps make it easy for you to keep your computers running the way you want them to, no matter who uses them."

Much improved from the old Microsoft Shared Computer Toolkit, for example you don't need repartitioning for the Windows Disk Protection.

It can be used to restrict user accounts in various ways.
















But the main interest for me is still the Windows Disk protection function that can rollback changes quickly. It takes up half your free disk space (up to 40 GB), but this is adjustable. Usually you can set it up to discard all changes on restart (not log off) which is typically for software of this type (like PowerShadow , or Shadow Surfer ). But what is nice is that you can keep these changes for longer periods of time before discarding. This is useful if you want to test software that require reboots to work (those that require drivers).

The first time you set up the cache file takes some time (about 30 minutes). I find on my system it slows startup time by about 30 seconds, and shutdown time by about half that (probably depends on size of cache file, amount of changes etc). But there is no appreciable slow down on a 512 Mb, 3.06 GHZ machine running one antivirus and firewall once it is past the startup.





You can even set it so it will automatically download Windows Updates correctly. A nice touch.



There is a lot of other tricks and tips in the help file, that I have yet to explore.