low-level, real-time registry monitor

Not sure what happened to the web site but snapfiles still offers this.
RegistryProt is a standalone, compact, low-level, real-time registry
monitor. By monitoring important locations and keys in the Windows
system registry, RegistryProt will alert whenever a key is added or
changed and then give the option of accepting the key change, reverting
back to the original key setting, or deleting the key. A very useful
tool to detect Trojan infection or other undesired system changes.FREEWARE http://www.snapfiles.com/get/regprot.html