I wonder what are the main registry windows keys malware target often ? I would love to code a program that will check the state of those windows registry keys for eventual modifications by malware.
The most common? Probably HKLM\Software\Microsoft\Windows\CurrentVersion\Run -- it's how programs arrange to be run at startup. Of course, a lot of perfectly harmless programs also use it, so watching it won't gain you much.
The problem with simply watching registry keys for modification is that normal programs also change many of them. You can't, for example, tell the difference between a spyware toolbar installing itself and an ordinary toolbar being installed just by watching Internet Explorer's section of the registry.