Changeset 1639
- Timestamp:
- 06/24/08 18:18:35 (2 months ago)
- Files:
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
honeyclient/trunk/thirdparty/capture-mod/ProcessMonitor.exl
r1522 r1639 15 15 ### Microsoft Internet Explorer 6.0 ### 16 16 ################################################### 17 + iexplore.exe .* C:\\Program Files\\Internet Explorer\\iexplore .exe17 + iexplore.exe .* C:\\Program Files\\Internet Explorer\\iexplore\.exe 18 18 #agent server is an activeX control that starts upon displaying multimedia content 19 + agentsvr.exe .* C:\\WINDOWS\\msagent\\agentsvr .exe19 + agentsvr.exe .* C:\\WINDOWS\\msagent\\agentsvr\.exe 20 20 #messenger activeX 21 + msmsgs.exe .* C:\\Program Files\\Messenger\\msmsgs .exe21 + msmsgs.exe .* C:\\Program Files\\Messenger\\msmsgs\.exe 22 22 ################################################### 23 23 ### Honeyclient added/specific? ### … … 36 36 37 37 #### HONEYCLIENT AUTO EXCLUDE SCRIPT 38 + setup_wm.exe .* C:\\Program Files\\Windows Media Player\\setup_wm .exe39 + wmplayer.exe .* C:\\Program Files\\Windows Media Player\\wmplayer .exe38 + setup_wm.exe .* C:\\Program Files\\Windows Media Player\\setup_wm\.exe 39 + wmplayer.exe .* C:\\Program Files\\Windows Media Player\\wmplayer\.exe 40 40 41 41 #### HONEYCLIENT AUTO EXCLUDE SCRIPT - Internet Explorer 7 Updates 42 + verclsid.exe .* C:\\WINDOWS\\system32\\verclsid .exe42 + verclsid.exe .* C:\\WINDOWS\\system32\\verclsid\.exe 43 43 #### HONEYCLIENT AUTO EXCLUDE SCRIPT 44 44 #This is related to the language bar...I just installed updates, and it was newly activated 45 45 #thus I consider it something valid to add 46 + ctfmon.exe .* C:\\WINDOWS\\system32\\ctfmon .exe46 + ctfmon.exe .* C:\\WINDOWS\\system32\\ctfmon\.exe 47 47 48 48 #### HONEYCLIENT AUTO EXCLUDE SCRIPT - IE7 accessing live.com 49 + infocard.exe .* C:\\WINDOWS\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\infocard .exe49 + infocard.exe .* C:\\WINDOWS\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\infocard\.exe
