Runtime behavior alerts of this type inform the user that an attempt has been made to modify the registry of the computer in a manner known to be used by rootkits. Any attempt at this behavior could indicate a malware infection.
HIPS/RegMod-022 will likely show alerts on known system components which will have been compromised. Users that receive HIPS/RegMod-022 alerts are advised to contact Sophos Technical Support for further help.
Please note that the behavior of some legitimate product installers can sometimes resemble that of malware. For this reason, installing or updating software carries an increased likelihood of unwanted HIPS detections and we recommend configuring HIPS to Alert Only mode for the duration of any product installs or updates. For further information please refer to the following knowledgebase article deciding whether to allow or block a file.