Может тебе нужно искать Advanced Registry Tracer - она позволяет делать и сравнивать два снимка реестра. Вот немножко из её описания:
Unlike Registry monitoring software (such as RegMon and
Win-Expose Registry), and most uninstallers (CleenSweep,
Uninstall, etc.), ART compares full copies of the
Registry made at different times, while the software
mentioned above just monitors all accesses to the
Registry in real time. So, our method allows to track all
the changes, and doesn\'t affect the system performance.
