WinPatrol: Registry Monitoring

One of the most advanced features of WinPatrol is that it allows you to monitor and protect any registry location. You can specify a value and WinPatrol will either alert you to a change or automatically lock the registry value that might change without your approval.

An Introduction to the Registry

File Types
A "file type" helps define the purpose or use of a file. In the DOS and Windows file systems file names have traditionally ended with a period followed by a one to three character file extension. The file extension represents the "file type" but in name only. Some well known file types include .EXE (executable files), .TXT (plain text files), .GIF (image files), .MP3 (MP3 sound files), .ZIP (ZIP archive files). 

The newer versions of Windows still support this type of file extension and even allow extensions larger than 3 characters. Unfortunately, Microsoft has chosen by default to hide the file type extensions because someone did a user interface study and concluded they confused users. 

Our recommendation is to turn on the display of file extensions. To do so, run Windows Explorer (Win Key + E) and select the menu option Tools >> Folder Options..., then click on the "View" tab. A little ways down you'll see a check box that says "Hide extensions for known file types." Uncheck the box so that Windows Explorer (as well as "Open/Save File" boxes) will display the file extensions.

Monitoring Registry Locations

WinPatrol will monitor registry locations and alert you if a change has occurred.

  1. A malicious program may modified standard types causing you to run dangerous program when you perform normally safe operations. Many virus programs, for example, have been known to change the action taken when a user clicks on an .EXE file.

  2. A new legitimate program may reassign file association of file types without your permission. The result: instead of your preferred media program opening, another media program opens instead to view media files. For example, if you quickly install a new photo program it may re-assign the program association for your JPG and GIF files without your permission. WinPatrol will alert you and allow you to change back to your original program association.

WinPatrol allows you to view information about file types and if required restore them to their previous association.

If there is a file type that you would like Scotty to monitor that is not on the list of registered file types, click the Add button to add that file type to the list of file types to be monitored. 

The Info... button provides more information about the selected file type, including the company responsible for the associated program used to open that file type (if any) and version.

As it is often difficult to tell just from a file name or company name whether an associated program is legitimate, you can click the Free Info... button to review a list of common, well-known malicious programs on the WinPatrol web site. PLUS members can click the PLUS Info... button to search the online WinPatrol database for more information on the specific service program itself.

This button will not delete any programs from your hard drive. Instead it will remove only the selected file type from the list of file types monitored by WinPatrol.

To close or Exit the WinPatrol tab interface click the X in the upper right hand corner or the Close button. WinPatrol will continue monitor changes but the main interface will be removed from memory.

WinPatrol Features