Changeset 410
- Timestamp:
- 05/29/07 23:27:22 (1 year ago)
- Files:
-
- honeyclient/trunk/etc/honeyclient.xml (modified) (4 diffs)
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
honeyclient/trunk/etc/honeyclient.xml
r409 r410 141 141 <regex>C:/Documents and Settings/Administrator/Cookies.*</regex> 142 142 <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Macromedia/Flash Player.*</regex> 143 <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Microsoft/Windows Media.*</regex> 143 144 <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles.*</regex> 144 145 <regex>C:/Documents and Settings/Administrator/Local Settings/History/History.IE5.*</regex> … … 158 159 <regex>C:/WINDOWS/SYSTEM32/config/SecEvent.evt</regex> 159 160 <regex>C:/WINDOWS/SYSTEM32/config/SysEvent.evt</regex> 161 <regex>C:/WINDOWS/SYSTEM32/config/software</regex> 160 162 <regex>C:/WINDOWS/SYSTEM32/config/software.log</regex> 161 163 <regex>C:/WINDOWS/SYSTEM32/config/system.LOG</regex> 164 <regex>C:/WINDOWS/SYSTEM32/Macromed/Flash.*</regex> 162 165 <regex>C:/WINDOWS/SYSTEM32/wbem.*</regex> 163 166 <regex>C:/WINDOWS/WindowsUpdate.log</regex> … … 189 192 <exclude_list description="List of perl regular expressions, each matching one or more registry key directory names to exclude from analysis. These entries match registry key directories that change normally during the course of driving the target application. As such, they are excluded from analysis in order to reduce false positives. As in normal regular expressions, each backslash (\) must be escaped (\\) and each regex must not end with any backslash character."> 190 193 <regex>^HKEY_CURRENT_USER\\SessionInformation.*$</regex> 194 <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex> 191 195 <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex> 192 196 <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International$</regex> … … 238 242 <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex> 239 243 <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex> 244 <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\MediaPlayer\\Preferences.*$</regex> 240 245 <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex> 241 246 <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex>
