NoVirusThanks Registry Guard

NoVirusThanks Registry Guard can be used as a weapon against unauthorized registry changes, blocking running processes that want to write, access or erase keys. Not only that it offers you a way to keep a close eye on your computer and be aware of what is going on at all times, but it can prevent malicious applications from performing registry changes without your consent.

The mission NoVirusThanks Registry Guard undertakes is rather complex. Thus, it's no wonder it is mainly recommended to expert users, despite the intuitive looks. It takes a bit of experience with aliases and wildcard characters to create a powerful rule set that will be able to restrict the access to the registry of all or specific programs and processes. The rule set is saved as a simple text file that can be freely edited, provided admin credentials are supplied. A program restart is required to apply the changes.

The default rule set the application comes with includes options to automatically block attempts to modify startup locations in the registry. In other words, if any applications want to set itself to start with Windows, NoVirusThanks Registry Guard will react and restrict its actions, logging the event in its main window.

Talking about the main window, it features a minimalistic design with a large area to show the event log, alongside buttons for editing the rules and exporting the log.

For each blocked action, NoVirusThanks Registry Guard displays the timestamp, the operation that was restricted (read, write, delete, etc.), the location of the process that tried to modify the registry, the thread ID, the registry key location, and the rule that was applied.

An additional tool is the key converter, which can transform a Win32 key name into a native one.

With an intelligently designed rule set to rely on, NoVirusThanks Registry Guard can actively monitor your system’s registry and prevent malicious applications from performing changes you did not authorize. Its kernel-mode driver can protect registry locations without affecting the computer’s performance significantly.

Aside from restricting autostart-related actions, it can be configured to prevent browser settings modifications and many more. However, perhaps it would be better to have an option to prompt you for action instead of automatically blocking all the events.