Changeset 1513

Show
Ignore:
Timestamp:
04/11/08 09:09:51 (1 month ago)
Author:
xkovah
Message:

another false positive from IE7 running

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/trunk/thirdparty/capture-mod/FileMonitor.exl

    r1511 r1513  
    301301+   Write   C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\WinSxS\\Policies\\.* 
    302302+   Write   C:\\WINDOWS\\system32\\svchost\.exe C:\\ 
     303 
     304#### HONEYCLIENT AUTO EXCLUDE SCRIPT 
     305#No guarantees that the % will be interpreted literally by the regex processing...but this is what it spit out 
     306+   Write   C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Desktop\\%USERPROFILE%\\UserData\\index\.dat