Locked files/keys

[mwalimu]

There are malware infections that create registry keys that are "locked", i.e. impossible to remove, modify, or rename, as well as files that cannot be deleted, renamed, or even looked at (the case I'm familiar with involved a rootkit).

There are malware infections that modify registry keys to undesired values.

Would it be possible, or very effective, for the good guys to employ the same kind of tricks? That is, produce an anti-malware tool that would "lock" certain files or registry keys to their known good values and allow the user to control of what's locked. Or does such a tool already exist?

[Ibrad]

I think some AV vendors do this but I do not 100% know what ones do.

[screen317]

There are malware infections that create registry keys that are "locked", i.e. impossible to remove, modify, or rename, as well as files that cannot be deleted, renamed, or even looked at (the case I'm familiar with involved a rootkit).

Well "impossible" is always relative, heh.

There is security software that does this, and in theory it's a good enough idea, but the implementation may have adverse effects (for instance, MBAM scans sometimes have unexpected results when addressing locked files).

[AdvancedSetup]

I think it's often bad as it typically blows up in your face and is used in other ways against you. Sort of like Spybot Tea Timer. It's great idea and tool but often locks in Malware or puts it back because the user doesn't know how to answer if they should allow or put it back.