Registry Monitor Comparison

Aug 28

Registry Monitor Comparison

Software | | Trackback | FavLinks | 10,791 次阅读

我们曾经介绍过关于Windows的自启动项，但是用户如何去监视这些内容不被恶意程序修改？当然我们不能天天打开注册表去看。

以下译自 Wilders Security Forums 的文章，详细的对比了当前几个流行的注册表监视软件，希望对你抗击恶意程序有所帮助。（注：通常来说注册表监视软件与杀毒软件以及防火墙可以配合使用）

以下可以监视注册表启动键值的程序，大多都是免费软件。每个软件侧重的监视键值都有所不同，我们来做一个比较：

图示：

'+' 表示: 键值 (包括启动组) 被软件监视
'L' 表示: 软件只监视 HKLM 子键
'U' 表示: 软件只监视 HKCU 子键
'HK**' 表示: 软件监视 HKLM 和 HKCU 子键
*** 表示: 按照 L 的深度实时监测子键

列表条目类型:

(K) 表示键值, 包括数据和子键都被监测
(v) 表示只监测某个键值数据的改变
(M) 表示监测多个键的不同数据
(?) 表示目前未知

软件名缩写：

1 SM: Mike Lin's Startup Monitor (free)
2 RP: DiamondCS Registry Prot 2.0 (free)
3 RD: RegDefend 1.0 (shareware) [Wilders forum]
4 RR: Regrun 4 Gold Pro (shareware) [see also]
5 TT: Spybot Search and Destroy Teatimer (free)
6 SS: System Safety Monitor (free)
7 GA: Microsoft Antispyware = Giant Antispyware (free)
8 WP: Winpatrol
9 MJ: MJ Registry Watcher 1.2.3.8 (free) [Wilders thread]

后面的链接s 表示曾经在这个键发现过木马或者其它恶意程序，以供参考。

自启动：
1 2 3 4 5 6 7 8 9
S R R R T S G W M
M P D R T S A P J
+ + + + + + + + + (K) HK**\SW\MS\Windows\CV\Run(Once) 链接
- + - + - - - - + (K) HKLM\SW\MS\Windows\CV\RunEx
- + - - - - - - + (K) HKLM\SW\MS\Windows\CV\RunOnce\Setup 链接
- + + + - + + + + (K) HKLM\SW\MS\Windows\CV\RunOnceEx 链接
- - - + + + L + + (K) HK**\SW\MS\Windows\CV\RunServices(Once) 链接
- - + + - - + - + (v) HKCU\SW\MS\Windows\CV\Explorer\Shell Folders\Startup 链接
- - - + - - + - + (K) HKCU\SW\MS\Windows\CV\Explorer\User Shell Folders
- - - - - - + - + (K) HKLM\SW\MS\Windows\CV\Explorer\ShellExecuteHooks 链接
- - - + - - - - + (K) HKLM\SW\MS\Windows\CV\Explorer\SharedTaskScheduler 链接
- - - + - - - - + (K) HKLM\SW\MS\Windows\CV\ShellServiceObjectDelayLoad 链接
- - - - - - - - + (?) HKLM\SW\MS\Windows\CV\app management\arpcache\ 链接
- - - + - - - - + (K) HKLM\SW\MS\Active Setup\Installed Components 链接
- - - ? - - - - + (M) HKLM\SW\MS\Active Setup\Installed Components\***\StubPath 链接
- + - + + + + - + (K) HKLM\Software\CLASSES\#file\shell\open\command (#=exe,com,pif,bat) 链接
- - - + - + + - + (K) HK**\SW\MS\Windows\CV\policies\Explorer\Run 链接
- - + + - - - - + (v) HKLM\System\CCS\Control\Session Manager\BootExecute 链接
- - - + - - - - + (K) HKLM\System\CCS\Control\Session Manager\FileRenameOperations 链接
- - - - - - - - + (K) HKLM\System\CCS\Control\Session Manager\KnownDLLs 链接
- - + - - - - - + (v) HKLM\System\CCS\Control\Session Manager\PendingFileRenameOperations 链接
- - + - - - - - + (v) HKLM\System\CCS\Control\Session Manager\environment\path
- - - - - - + - + (K) HKLM\System\CCS\Control\lsa 链接
- - + + - + - - + (K) HKLM\System\CCS\Services 链接
- - - + - + - - + (M) HKLM\System\CCS\Services\***\Image Path
- - - - - - - - + (K) HKLM\System\CCS\Services\vxd 链接
- - - + - - + - + (K) HKLM\System\CCS\Services\WinSock2 链接
- - - - + - + - + (K) HKLM\SW\MS\Code Store Database\Distribution Units\ 链接
- - - + - + - - + (?) HKLM\SW\Policies\Microsoft\Windows\System\Scripts\Shutdown
- - - + - + - - + (?) HKLM\SW\Policies\Microsoft\Windows\System\Scripts\Startup 链接
- - - + - U - - + (?) HK**\SW\Policies\Microsoft\Windows\System\Scripts\Logon
- - - + - U - - + (?) HK**\SW\Policies\Microsoft\Windows\System\Scripts\Logoff
- - - + - - - - + (v) HKCU\Control Panel\Desktop\scrnsave.exe 链接
- - - - - - - - - (K) HK**\SW\MS\Windows NT\CV\Extensions
- - - L - - ? - ? (?) HK**\SW\MS\Windows NT\CV\IniFileMapping\win.ini\load
- - - L - - ? - ? (?) HK**\SW\MS\Windows NT\CV\IniFileMapping\win.ini\run
- - - L - - L - + (v) HK**\SW\MS\Windows NT\CV\IniFileMapping\win.ini\Winlogon
- - - L - - L - + (v) HK**\SW\MS\Windows NT\CV\IniFileMapping\system.ini\boot\shell
- - + + - - - + + (v) HKCU\SW\MS\Windows NT\CV\Windows\Run 链接
- - + + - - - + + (v) HKCU\SW\MS\Windows NT\CV\Windows\Load 链接
- - L + - - - - + (K) HK**\SW\MS\Windows NT\CV\Winlogon 链接
- - L + - - L - + (v) HK**\SW\MS\Windows NT\CV\Winlogon\UserInit 链接
- - + + - + + - + (v) HKLM\SW\MS\Windows NT\CV\Winlogon\Shell 链接
- - + - - - - - + (v) HKLM\SW\MS\Windows NT\CV\Winlogon\Taskman
- - - + - - - - + (K) HKLM\SW\MS\Windows NT\CV\Winlogon\Notify 链接
- - - + - - - - + (K) HKLM\SW\MS\Windows NT\CV\Svchost ASP&NoWebContent=1" rel="external"">链接
- - + + - + - - + (v) HKLM\SW\MS\Windows NT\CV\Windows\APPINIT_DLLs 链接
- - - - - - - - + (M) HKLM\SW\MS\Windows NT\CV\Accessibility\Utility manager\***\Application path
- - - - - - - - + (K) HKLM\SW\MS\Windows NT\CV\WOW\boot 链接
- - - - - - - - + (K) HKLM\SW\MS\Windows NT\CV\Shell Extensions\Approved 链接
- - - - - - - - + (K) HKEY_CLASSES_ROOT\Protocols\Filter 链接
- - - - - - - - + (K) HKLM\SW\Classes\Protocols\Filter 链接
- - - - - - - - + (K) HK**\SW\classes\mailto\shell\open\command 链接
- - - - - - - - + (v) HKCU\SW\MS\Command Processor\AutoRun 链接
- - - - - - - - + (K) HK**\SW\MS\ole 链接
- - - - - - + - - (v) HKCR\ftp\shell\open\command\(Default)
- - - - - - + - - (v) HKCU\ftp\shell\open\command\(Default)
- - - - - - - - + (K) HKLM\System\CCS\Control\MPRServices 链接
1 2 3 4 5 6 7 8 9
S R R R T S G W M
M P D R T S A P J

安全设定：
1 2 3 4 5 6 7 8 9
S R R R T S G W M
M P D R T S A P J
- - - - - - - - + (K) HKLM\SW\MS\Windows\CV\Explorer\Advanced 链接
- - - - - - - - - (K) HKLM\SW\MS\Windows\CV\WindowsUpdate 链接
- - - - - - - - + (K) HK**\SW\MS\Windows\CV\policies\Explorer 链接
- - - - - - + - - (K) HKLM\SW\MS\Windows\CV\policies\Explorer\RestrictRun 链接
- - - - - - - - + (K) HK**\SW\MS\Windows\CV\policies\System 链接
- - - - - - - - + (K) HK**\SW\MS\Windows\CV\policies\Network 链接
- - - - - - - - - (K) HKLM\SW\MS\Security Center 链接
- - - - - - - - - (K) HKLM\SW\Policies\Microsoft\Windows\WindowsUpdate 链接
- - - - - - + - + (v) HKLM\SW\MS\Windows NT\CV\Winlogon\DefaultPassword

微软浏览器恶意劫持程序：
1 2 3 4 5 6 7 8 9
S R R R T S G W M
M P D R T S A P J
- - + + + - + - + (K) HKCU\SW\MS\Windows\CV\Explorer\Browser Helper Objects 链接
- - - - - - L - + (K) HK**\SW\MS\Internet Explorer\Toolbar 链接
- - - - U - U - + (K) HK**\SW\MS\Internet Explorer\Toolbar\WebBrowser 链接
- - - - - - U - + (K) HK**\SW\MS\Internet Explorer\Toolbar\ShellBrowser
- - - - U - + - + (K) HK**\SW\MS\Internet Explorer\Explorer Bars\ 链接
- - - - U - - - + (K) HK**\SW\MS\Internet Explorer\MenuExt\ 链接
- - - - U - + - + (v) HK**\SW\MS\Internet Explorer\Main\Local Page 链接
- - - - U - + - + (v) HK**\SW\MS\Internet Explorer\Main\Search Page 链接
- - - - U - + - + (v) HK**\SW\MS\Internet Explorer\Main\Search Bar 链接
- - - - U - + - + (v) HK**\SW\MS\Internet Explorer\Main\Start Page 链接
- - - - U - L - + (K) HK**\SW\MS\Internet Explorer\Search\ 链接
- - - - U - - - + (K) HK**\SW\MS\Internet Explorer\SearchUrl\ 链接
- - - - - - - - + (K) HK**\SW\MS\Internet Explorer\Styles 链接
- - - - - - L - + (K) HKLM\SW\MS\Internet Explorer\AboutURLs 链接
- - - - - - + - + (K) HK**\SW\MS\Internet Explorer\extensions
- - - - - - - - + (K) HKCU\SW\MS\Internet Explorer\extensions\cmdmapping 链接
- - - - - - + - - (K) HKCU\SW\MS\Internet Explorer\URLSearchHooks 链接
- - - - - - - - - (K) HK**\SW\MS\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN 链接
- - - - - - + - + (K) HKLM\SW\MS\Windows\CV\Internet Settings\SafeSites 链接
- - - - - - + - - (M) HKCU\SW\MS\Windows\CV\Internet Settings\Zones\***\CurrentLevel
- - - - - - + - - (K) HKCU\SW\MS\Windows\CV\Internet Settings\ZoneMap\Domains
- - - - - - - - + (K) HKU\.default\SW\MS\Internet Explorer\extensions\cmdmapping
- - - - - - + - + (K) HKLM\SW\MS\Windows\CV\URL\DefaultPrefix 链接
- - - - - - + - + (K) HKLM\SW\MS\Windows\CV\URL\Prefixes 链接

可能发生恶意事件的键值：
1 2 3 4 5 6 7 8 9
S R R R T S G W M
M P D R T S A P J
- + - - - - + + + (K) HKCU\SW\MS\Windows\CV\RunOnceEx
- - - - - - - - + (K) HKCU\SW\Policies\Microsoft\Windows\safer\codeidentifiers
- - - - - - - - + (K) HK**\SW\MS\Windows NT\CV\IniFileMapping
- - - - ? - - - + (K) HK**\SW\MS\Internet Explorer\
- - - - ? - - - + (K) HK**\SW\MS\Internet Explorer\Main\
- - - - - - - - + (K) HKLM\System\CCS\Services\WinSock2\Parameters
- - - - - - - - + (K) HKCU\SW\MS\Windows\CV\Explorer\fileexts
- - - - - - - - + (K) HKU\***\SW\MS\Windows\CV\Explorer\fileexts\***\OpenWithList
- - - - - - - - + (M) HKU\***\SW\MS\Windows\CV\Explorer\fileexts\***\Application
- - - - - - - - + (K) HKU\***\SW\MS\Windows\CV\Run(Once)
- - - - - - - - + (K) HKU\***\SW\MS\Windows\CV\RunServices(Once)
- - - - - - - - + (K) HKCR\Protocols\Filter\Class Install Handler

特色内容:
1 2 3 4 5 6 7 8 9
S R R R T S G W M
M P D R T S A P J
- - + + - + - - + ¦ *** Monitors any user configured reg. keys ***
- - - - - - - - + ¦ Monitors user configured keys based on wildcards
- - + + - + - + + ¦ Monitors any user configured file associations
+ + - - + + - - + ¦ Is free
- - + - - + - - + ¦ Displays complete list of monitored keys
- - - + - - - + + ¦ Displays the content of autostart entries
+ + - + + + + + + ¦ Works by polling the registry content every x seconds
- - + - - - - - - ¦ Works by intercepting registry change attempts
- - ? + + + - - + ¦ Also monitors deletions from registry
- - - - - + + - + ¦ Auto-undos the change before displaying popup dialog
- - + - - + ? - - ¦ Is also a kind of sandbox
+ + ? + + - + + + ¦ Monitors some files for changes
- - ? ? - + - - - ¦ Survives certain termination attempts

以上大多数都是可以实现自启动的键值，还有一些也是你不想被恶意程序修改的地方。.

如果你发现其中有错误，或者们某些软件（像是 Ad-Watch）增加了监视的内容，请告知。

你还可以使用 Sysinternals Autoruns 这个免费软件来查看自启动程序列表. 注意: 它不是一个注册表监视器.

访问一下地址获取更多关于注册表键值的知识和解释:

http://forums.subratam.org/index.php?showtopic=1063
http://www.diamondcs.com.au/index.php?page=autostarts
http://www.giantcompany.com/antispyw...manifests.aspx
http://research.pestpatrol.com/White...rtingPests.asp
http://www.cpcug.org/user/clemenzi/t...Hijackers.html
The NT booting process

Registry,Monitor,Comparison,Freeware

引用本文，复制粘贴...