NoVirusThanks Registry Guard

NoVirusThanks Registry Guard to bezpłatny i ciekawy program do ochrony rejestru, zapobiega edycji kluczy rejestru jak i również odczytywaniu kluczy oraz ich kasowaniu.Program bardzo przydatny, bardziej dla kumatych userów.

Kliknij aby rozwinąć...

NoVirusThanks Registry Guard to rozwiązanie zabezpieczające rejestr systemowy przed modyfikacjami wprowadzanymi przez procesy i oprogramowanie. Program zalecany jest tylko i wyłącznie dla zaawansowanych użytkowników, bowiem istnieje duże ryzyko, że nieprawidłowe użycie spowoduje wystąpienie błędów.

Pomimo braku funkcji tworzenia kopii zapasowych, narzędzie posiada możliwość eksportowania zmian i zapisu logów. NoVirusThanks Registry Guard zabezpiecza wybrane przez użytkownika klucze, lokacje autostartu.

Kliknij aby rozwinąć...

NoVirusThanks Registry Guard is a powerful utility which uses a kernel-mode driver to prevent any process or only specific processes from writing\reading\deleting custom registry keys\values. You can prevent, for example, any process from writing to registry autostart locations, or prevent processes from hijacking your Internet Explorer registry settings, and much more. With NoVirusThanks Registry Guard you can easily protect custom Windows registry keys and values from unauthorized modifications or deletions, a swiss army knife against nasty malware and trojans.

By default, NoVirusThanks Registry Guard prevents any process from writing to common registry startup locations. To edit the default rules or to create your custom rules, open the “Rules” tab and then click the button “Edit Rules” (it may ask you Admin credentials) to edit the Rules.DB file. The rules are updated in real-time. Writing rules is very easy, you can use wildcards characters and aliases, example:

[%OPR%: DELETE_KEY] [%EXE%: *regedit.exe] [%KEY%: *DeleteKey*]
[%OPR%: DELETE_VALUE] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *DeleteValue*]
[%OPR%: READ_VALUE] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *ReadValue*]
[%OPR%: WRITE_VALUE] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *WriteValue*]
[%OPR%: CREATE_KEY] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *New Key #1*]

Key features and characteristics:

- Prevent the modification of specific registry keys and values
- Useful to protect all registry autostart locations
- Write your own rules to block custom registry keys and values
- Specify to monitor any process or only specific processes
- Easy-to-write rules thanks to wildcarding and aliases
- Monitor the creation of registry keys
- Monitor the writing\modification of registry values
- Monitor the deletion of registry keys and values
- Monitor the reading of registry values
- Show useful information when an action is blocked
- Powerful protection thanks to the kernel-mode driver
- Supports all Microsoft Windows Vista+ OSs
- Very lightweight in memory and CPU usage

Kliknij aby rozwinąć...

[19-02-2016] v1.3.0.0

+ Added DEP and ASLR to main exe
+ Added option to disable protection from tray icon menu
+ Now it is possible to write exclusion rules same as block-rules
+ Improved default rules to protect registry startup locations
+ Added more rules to protect commonly hijacked registry locations
+ Fixed handling of fully qualified file path for %EXE% alias
+ Fixed handling of fully qualified file path for exclusions
+ A bug was fixed involving the Windows API
+ Improved kernel-mode driver protection
+ Minor fixes and optimizations

Kliknij aby rozwinąć...

• Fixed multi-line comments in certain situations when they were executed instead of stripped
• Log the new value to Logs (when performing a write operation on a value's contents)
• Added [%OPR%: RENAME_KEY] option to prevent processes from renaming a registry key
• Updated the Rules.db to include rules to block the "Double Agent" PoC

Kliknij aby rozwinąć...

[11-02-2018] v1.5.0.0
+ Both 32-bit and 64-bit drivers are now co-signed by Microsoft
+ Executable files are digitally signed with both SHA1 and SHA256 code sign
+ Now the program works fine when Secure Boot is enabled
+ Updated Rules.db with new rules to prevent UAC\DeviceGuard\AppLocker bypasses
+ Updated Rules.db with a new rule to protect LowRiskFileTypes value
+ Bring the application to front if the Desktop icon is clicked and the program is running
+ Fixed display of main window on multi-monitors
+ Ask a confirmation when the program is closed via Tray Icon -> Exit
+ For wildcard rules you can use the asterisk * and the ? character
+ Updated Exclusions.db with new exclusion rules
+ Show "New Value Data" in logged events
+ Fixed parsing of exclusion rules
+ Minor fixes and improvements

Kliknij aby rozwinąć...