Changeset 1621

Show
Ignore:
Timestamp:
06/11/08 14:51:42 (2 months ago)
Author:
kindlund
Message:

Updated exclusion list to reflect benign activity in 94659f4c88f24420487e5a5202

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/trunk/thirdparty/capture-mod/FileMonitor.exl

    r1578 r1621  
    334334+   Write   C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\LocalService 
    335335+   Write   C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\config\\SysEvent\.Evt 
     336 
     337# VMware Tools 
     338+   Write   C:\\Program Files\\VMware\\VMware Tools\\VMwareUser\.exe    C:\\Documents and Settings\\Administrator\\Local Settings\\Temp.* 
     339+   Delete  C:\\Program Files\\VMware\\VMware Tools\\VMwareUser\.exe    C:\\Documents and Settings\\Administrator\\Local Settings\\Temp.*