TripWire and Registry Changes

I was wondering if there is anyone here using TripWire for Servers - the Windows version. I have been using it for a little while at work, and I am having trouble interpreting changes picked up in the registry. Each time I get an alert about the registry, I do a google or check the microsoft KB. Sometimes, I am able to figure out why the values changed, but other times, I come up empty-handed. Does anyone have any recommendations on books or resources for understanding the registry and changes that may be made to it as a machine's configuration changes? Any suggestions or ideas would be appreciated. I have been having difficulty picking out a book online. I have also registered on Winguides , and my questions have never been answered since I have joined. Perhaps, it is because they are too specific. I am not sure, but I would like to learn.


Thanks

t2k2

I have been reading the book that I "review" in the link below. It has helped me understand the registry and changes that take place all the time.

I am not experienced with Trip Wire, but that is on my list of "projects".

Check this out.

This book was written specifically for the XP version of windows, but there are very little changes between 2k and XP registry-wise. Either way, you'll learn a sh17 load. I have.

Hey thanks for the link phish. I really appreciate the recommendation. I'll have to look into this. If anyone has any other ideas or suggestions to go along with phishphreek80's, I would be grateful.

the cleaner from moosoft tracks registry changes asks if you want to accept them and will open a registry editor to show your the proposed changes on request. even after the expiration date for the trojan scanner the registry tracker keeps working.