Changeset 1678

Show
Ignore:
Timestamp:
07/10/08 14:02:03 (2 months ago)
Author:
knwang
Message:

Updated Process and File exclusion lists for MSN Messenger Autostart (39dda3c828a589a3c75dede5c3).

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/trunk/thirdparty/capture-mod/FileMonitor.exl

    r1671 r1678  
    9797+   Write   C:\\Program Files\\Messenger\\msmsgs\.exe   C:\\Documents and Settings\\.+\\NTUSER.DAT.LOG 
    9898+   Delete  C:\\Program Files\\Messenger\\msmsgs\.exe   C:\\Documents and Settings\\.+\\NTUSER.DAT.LOG 
     99+   Write   C:\\Program Files\\Messenger\\msmsgs\.exe   C:\\Documents and Settings\\.+\\NTUSER.DAT 
    99100+   Write   C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe  E:\\\$LogFile 
    100101+   Write   C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe  E:\\\$Directory 

  • honeyclient/trunk/thirdparty/capture-mod/ProcessMonitor.exl

    r1647 r1678  
    5454# IE - Random Crashing Due To Poor Application Coding 
    5555+   drwtsn32.exe    .*  C:\\WINDOWS\\system32\\drwtsn32\.exe 
     56 
     57# IE - MSN Messenger Autostart  
     58+   msmsgs.exe  .*  C:\\Program Files\\Messenger\\msmsgs\.exe