Changeset 1406
- Timestamp:
- 03/31/08 15:01:15 (4 months ago)
- Files:
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
honeyclient/trunk/thirdparty/capture-mod/FileMonitor.exl
r1405 r1406 130 130 #- Write .* .+\.bat 131 131 #- Write .* .+\.cmd 132 #comm anted out for VMwareService.exe, since it writes .inf files.132 #commented out for VMwareService.exe, since it writes .inf files. 133 133 #- Write .* .+\.inf 134 134 - Write .* .+\.lnk … … 292 292 + Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Cookies\\.+ 293 293 + Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Cookies\\index.dat 294 + Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\WinSxS\\Policies\\.* 295 + Write C:\\WINDOWS\\system32\\svchost\.exe C:\\
