What you really want to do is to block access to those keys, and _also_ to save the results to a .reg file. Then you can leave the blocker running most of the time, and then periodically see if there's anything in the .reg file that should have been allowed.