home *** CD-ROM | disk | FTP | other *** search
/ Computer Active Guide 2009 February / UG2.ISO / Programos / OutpostSecuritySuiteProInstall_samag.exe / {code_GetDest} / machine.ini < prev    next >
Encoding:
INI File  |  2009-01-23  |  33.3 KB  |  894 lines
  1. ; Warning! Agnitum Ltd. is not responsible for your system security and proper functioning
  2. ; in case of manual modification of this file
  3.  
  4. ; -------------------------------------------------------------------------------------------------------------------------
  5. ; General Settings
  6. ; -------------------------------------------------------------------------------------------------------------------------
  7.  
  8. [General]
  9. ; This value configures firewall driver behavior in case of unexpected ACS shutdown.
  10. ; If TRUE, all network activity is blocked.
  11. ExitProtection=TRUE
  12.  
  13. ; Protection of Outpost files and registry after service shutdown.
  14. SelfProtectinOnExit=TRUE
  15.  
  16. ; Enable or disable TCP telnet server on 805 port
  17. EnableDebugTCPServer=false
  18.  
  19. ; Enable or disable monitor(op_mon) start/stop service(acs)
  20. MonitorControllService=true
  21.  
  22. ; Do you want to start acs service if outpost gui is started
  23. StartACSOnMonitorStartup=yes
  24.  
  25. ; Disables sending and receiving rules to/from driver. Use for debug purposes
  26. DisableSendDriverRules=false
  27.  
  28. ; Enable or disable corporate mode functionality
  29. CorporateMode=false
  30.  
  31.  
  32. [GeneralDebug]
  33. ; 
  34. ; This value configures firewall driver behavior in case of unexpected ACS shutdown.
  35. ; If TRUE, all network activity is blocked.
  36. ExitProtection=FALSE
  37.  
  38. ; Protection of Outpost files and registry after service shutdown.
  39. SelfProtectinOnExit=FALSE
  40.  
  41. ; Enable or disable TCP telnet server on 805 port
  42. EnableDebugTCPServer=true
  43.  
  44. ; Enable or disable monitor(op_mon) start/stop service(acs)
  45. MonitorControllService=false
  46.  
  47. ; Do you want to start acs service if outpost gui is started
  48. StartACSOnMonitorStartup=true
  49.  
  50. ; Disables sending and receiving rules to/from driver. Use for debug purposes
  51. DisableSendDriverRules=false
  52.  
  53. ; Enable or disable corporate mode functionality
  54. CorporateMode=false
  55.  
  56. [GlobalFirewallRules]
  57.  
  58. ; block netbios rules
  59. BlockNetbios=yes
  60.  
  61. ; block no-first fragments arrives before first fragment
  62. BlockNoOrderedFragment=yes
  63.  
  64. ; block icmp do not allowed by settings
  65. BlockNotAllowedICMP=yes
  66.  
  67. ; -------------------------------------------------------------------------------------------------------------------------
  68. ; Antileak Settings
  69. ; -------------------------------------------------------------------------------------------------------------------------
  70. [Antileak]
  71.  
  72. ; Allow controlling the TerminateProcess API
  73. ProcessTerminateControl=yes
  74.  
  75. ; Allow controlling the Direct Disk access
  76. DirectDiskControl=yes
  77.  
  78. ; -------------------------------------------------------------------------------------------------------------------------
  79. ; AFW Driver Settings
  80. ; -------------------------------------------------------------------------------------------------------------------------
  81. [AFW]
  82.  
  83. ; Allow traffic processing in user mode.
  84. EnableContentHandler=TRUE
  85. EnableContentProcessing=TRUE
  86.  
  87. ; -------------------------------------------------------------------------------------------------------------------------
  88. ; On Access Virus Scanner Settings
  89. ; -------------------------------------------------------------------------------------------------------------------------
  90. [OnAccessScanner]
  91.  
  92. ; Enable on-access scanner functionality. This functionality can be disanled due to compatibility reason
  93. ; with third-party AV software
  94. EnableScanner=true
  95.  
  96. ; If enabled, on-access scanner do not scan files on close.
  97. CompatibilityMode=false
  98.  
  99. ; If enabled, on-access scanner do not scan files on any access
  100. CompatibilityDisableOnAnyAccess=false
  101.  
  102. ; If enabled, use extended attributes for cache files(not modified attributes)
  103. ; depricated EnableAttributes=true
  104. CompatibilityEnableAttributes=true
  105.  
  106. ; -------------------------------------------------------------------------------------------------------------------------
  107. ; Antimalware Settings
  108. ; -------------------------------------------------------------------------------------------------------------------------
  109. [Antimalware]
  110. Engines=hax,asw,vb
  111. RebootScanProfile=
  112. RebootScan=FALSE
  113.  
  114.  
  115. ; -------------------------------------------------------------------------------------------------------------------------
  116. ; Autoupdate Settings
  117. ; -------------------------------------------------------------------------------------------------------------------------
  118. [update]
  119.  
  120. ; Path to the update server including root folder.
  121. server=http://updates.agnitum.com/update_suite20
  122.  
  123. ; Local path for update operation. This folder will contain all files, created during update operation.
  124. update_dir=update_oss20
  125.  
  126. [ConfigWizard]
  127. UpdatePreset=FALSE
  128. SmartScan=TRUE
  129.  
  130. ; -------------------------------------------------------------------------------------------------------------------------
  131. ; News download Settings
  132. ; -------------------------------------------------------------------------------------------------------------------------
  133. [news]
  134.  
  135. ; news download path from the root of acs.exe
  136. NewsPath=news
  137.  
  138. ; date of last news downloaded from server
  139. ;LastNewsBuild=1
  140.  
  141.  
  142. [Languages]
  143. CurrentLang=en
  144. LangList=en|ru
  145.  
  146. ; -------------------------------------------------------------------------------------------------------------------------
  147. ; Multimacros Description
  148. ; -------------------------------------------------------------------------------------------------------------------------
  149. ; Records containing such fragments will be expanded into several records. 
  150. ; For example:
  151. ; REGISTRY\{MachineOrUser}\Software\Microsoft\Windows\CurrentVersion\Run
  152. ; will be expanded as:
  153. ; REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  154. ; REGISTRY\<User>\Software\Microsoft\Windows\CurrentVersion\Run
  155.  
  156. [SoftwareClasses64]
  157. ; 'Software' registry section description for x86 and x64 Windows platforms.
  158. SOFTWARE\CLASSES\
  159. SOFTWARE\CLASSES\Wow6432Node
  160.  
  161. [MachineOrUser]
  162. ; Description of registry sections that are common for a user and a system.
  163. MACHINE
  164. <User>
  165.  
  166. [OpenOrRunAs]
  167. ; Registry records - either Open, or RunAs - for shell.
  168. open
  169. runas
  170.  
  171. [ControlSet]
  172. ; x64 interceptor identifies ControlSet* as CurrentControlSet.
  173. ControlSet*
  174. CurrentControlSet
  175.  
  176. ; pre-defined groups:
  177. ; [System64]
  178. ; [Software64]
  179. ; [SoftwareClasses64]
  180.  
  181. ; -------------------------------------------------------------------------------------------------------------------------
  182. ; Macros Description
  183. ; -------------------------------------------------------------------------------------------------------------------------
  184.  
  185. [Macro]
  186. ; This section contains macro definitions. They can be applied to SelfProtection rules.
  187. ; Macros is defined in the following format: 
  188. ; MacroName=Value
  189. ; Macros is used the following way: <MacroName>. <MacroName> substring is replaced by Value.
  190. ; Recursive macros definition is allowed, for example:
  191. ; Macro1=aaa
  192. ; Macro2=<Macro1>bbb
  193. ; However in direct sequence only (Macro1 macros should be defined before using Macro2).
  194. ; WindowsDir and SystemDir macroses are already defined.
  195. DriversDir=<SystemDir>\Drivers
  196. FiltDir=<SystemDir>\Filt
  197. FullAccess=read write rename delete exec connect open_process thread_start thread_stop write_mem thread_ctx
  198. NoLearn=no_learn_open no_learn_exec no_learn_read no_learn_write no_learn_create no_learn_delete no_learn_rename
  199. LimitedAccess=no_learn_open read exec thread_start no_set_hook no_send_close allow_init_dde no_send_input 
  200. LimitedAccessNoLearn=<LimitedAccess> <NoLearn>
  201. AllFiles=*
  202. SystemDir32OrWow=<WindowsDir>\{System64}
  203. MachineServices=MACHINE\System\{ControlSet}\Services
  204. MachineControl=MACHINE\System\{ControlSet}\Control
  205. MachineCurrentVersion=MACHINE\Software\Microsoft\Windows\CurrentVersion
  206. MachineNTCurrentVersion3264=MACHINE\{Software64}\Microsoft\Windows NT\CurrentVersion
  207. CurrentVersionUserMachine3264={MachineOrUser}\{Software64}\Microsoft\Windows\CurrentVersion
  208. User=USER\*
  209.  
  210. ; Compiler directories are added to exclusions for debug convenience.
  211. [VCDirs]
  212. e:\msdev.2005
  213. e:\msdev.2008
  214. C:\Program Files\Microsoft Visual Studio 8
  215. c:\Program Files\Microsoft Visual Studio 9.0
  216.  
  217. ; Compiler files
  218. [Compilers]
  219. cl.exe
  220. link.exe
  221.  
  222. ; Windbg directories are added to exclusions for debug convenience.
  223. [WinDBGDirs]
  224. c:\Program Files\Debugging Tools for Windows
  225. c:\Program Files (x86)\Debugging Tools for Windows
  226.  
  227. ; Compiler files
  228. [DebuggerFiles]
  229. agestore.exe
  230. breakin.exe
  231. cdb.exe
  232. dbengprx.exe
  233. dbgrpc.exe
  234. dbgsrv.exe
  235. dbh.exe
  236. dumpchk.exe
  237. dumpexam.exe
  238. gflags.exe
  239. i386kd.exe
  240. ia64kd.exe
  241. kd.exe
  242. kdbgctrl.exe
  243. kdsrv.exe
  244. kill.exe
  245. list.exe
  246. logger.exe
  247. logviewer.exe
  248. ntsd.exe
  249. remote.exe
  250. rtlist.exe
  251. symchk.exe
  252. symstore.exe
  253. tlist.exe
  254. umdh.exe
  255. windbg.exe
  256.  
  257. ; Sysinternals directories are added to exclusions for debug convenience.
  258. [SysInternalDirs]
  259. c:\Sys Internals
  260.  
  261. ; Compiler files
  262. [SysInternalFiles]
  263. ProcessExplorer\procexp.exe
  264. ProcessMonitor\Procmon.exe
  265.  
  266. ; Compiler files are added to exclusions for debug convenience.
  267. [VCFiles]
  268. {VCDirs}\common7\ide\devenv.exe
  269. {VCDirs}\vc\bin\x86_amd64\{Compilers}
  270. {VCDirs}\vc\bin\md64\{Compilers}
  271. {VCDirs}\vc\bin\{Compilers}
  272. {VCDirs}\Common7\IDE\Remote Debugger\x64\msvsmon.exe
  273. {VCDirs}\Common7\IDE\mspdbsrv.exe
  274.  
  275. ; WinDBG files are added to exclusions for debug convenience.
  276. [WinDbgFiles]
  277. {WinDBGDirs}\{DebuggerFiles}
  278.  
  279. ; SysInternals files are added to exclusions for debug convenience.
  280. [WinDbgFiles]
  281. {WinDBGDirs}\{DebuggerFiles}
  282.  
  283. ; SysInternals files are added to exclusions for debug convenience.
  284. [SysIntFiles]
  285. {SysInternalDirs}\{SysInternalFiles}
  286.  
  287. ; -------------------------------------------------------------------------------------------------------------------------
  288. ; Self-Protection Settings
  289. ; -------------------------------------------------------------------------------------------------------------------------
  290. [UserAntileakExclusions]
  291. ; This section contains applications that are not monitored by Anti-leak.
  292. <SystemDir>\alg.exe
  293. <SystemDir>\dwm.exe
  294. <SystemDir>\wmiprvse.exe
  295. <SystemDir>\wdfmgr.exe
  296. <SystemDir>\taskeng.exe
  297.  
  298. [AntileakExclusions]
  299. ; This section contains applications that are not monitored by Anti-leak.
  300. <SystemDir>\ntoskrnl.exe
  301. <SystemDir>\csrss.exe
  302. <SystemDir>\lsass.exe
  303. <SystemDir>\lsm.exe
  304. <SystemDir>\smss.exe
  305. <SystemDir>\svchost.exe
  306. <SystemDir>\winlogon.exe
  307. <SystemDir>\taskeng.exe
  308. {OutpostExecutable}
  309. {UserAntileakExclusions}
  310.  
  311. [SelfProtectionExclusions]
  312. ; This section contains self-protection exclusions.
  313.  
  314. [OutpostExecutable]
  315. ; This section defines a set of applications that have access to Outpost folder and registry.
  316. <ExecDir>\acs.exe
  317. <ExecDir>\op_mon.exe
  318. <ExecDir>\feedback.exe
  319. <ExecDir>\unins0??.exe
  320. <ExecDir>\plugins\anti-spam\asp_srv.exe
  321. <ExecDir>\plugins\anti-spam.x64\asp_srv.exe
  322.  
  323. [DriverNames]
  324. sandbox
  325. afw
  326. afwcore
  327. vbengnt
  328.  
  329. [DriverPluginNames]
  330. vbfilt
  331. aswfilt
  332.  
  333. [OutpostFiles]
  334. ; This section describes the set of Outpost files.
  335. <ExecDir>\*
  336. <FiltDir>\*
  337. <DriversDir>\afw.sys
  338. <DriversDir>\afwcore.sys
  339. <DriversDir>\sandbox.sys
  340. <DriversDir>\sandbox64.sys
  341. <DriversDir>\vbengnt.sys
  342.  
  343. <SystemDir>\config\prcdrv.acl
  344. <SystemDir>\config\prc.acl
  345. <SystemDir>\config\afw_db.conf
  346. <SystemDir>\config\afw_hm.conf
  347.  
  348.  
  349. [OutpostRegistry]
  350. ; Registry keys which only Outpost has access to.
  351. REGISTRY\<MachineCurrentVersion>\Uninstall\Agnitum Outpost Firewall Pro*\*
  352. REGISTRY\<MachineCurrentVersion>\Uninstall\Agnitum Outpost Security Suite Pro*\*
  353. REGISTRY\<MachineCurrentVersion>\Run\OutpostMonitor
  354. REGISTRY\<MachineCurrentVersion>\Run\OutpostFeedBack
  355. REGISTRY\<MachineCurrentVersion>\App Paths\acs.exe\*
  356. REGISTRY\<MachineServices>\{DriverNames}\*
  357. REGISTRY\<MachineServices>\{DriverPluginNames}\*
  358. REGISTRY\<MachineServices>\acssrv\*
  359.  
  360. [ProtectedObjects]
  361. ; This section describes objects protected by self-protection mechanism.
  362. {OutpostFiles}
  363. {OutpostRegistry}
  364.  
  365.  
  366. [TrustedApplications]
  367. ; This section describes the set of applications that have access to Outpost folder.
  368. ; In this folder self-protection exclusions are stored.
  369. ; This application should better be removed after first start.
  370. ;<SystemDir32OrWow>\runonce.exe
  371. <SystemDir32OrWow>\autochk.exe
  372. <SystemDir32OrWow>\csrss.exe
  373. <SystemDir32OrWow>\svchost.exe
  374. <SystemDir32OrWow>\dfrgntfs.exe
  375. {AntileakExclusions}
  376. {SelfProtectionExclusions}
  377.  
  378. [FilteredApplications]
  379. ; This section contains applications for which write access is blocked without notification from Outpost.
  380. <SystemDir32OrWow>\mshta.exe
  381. <SystemDir32OrWow>\rundll32.exe
  382. <SystemDir32OrWow>\taskmgr.exe
  383. <SystemDir32OrWow>\searchindexer.exe
  384.  
  385. [RegistryApplications]
  386. <SystemDir32OrWow>\ntoskrnl.exe
  387. ; ≤Σαδσφε ≈≥εß√ φσ ß√δε Γετ∞εµφε±≥Φ ∩≡εΦτΓεδⁿφε ∞σφ ≥ⁿ start type
  388. ;<SystemDir32OrWow>\services.exe
  389.  
  390.  
  391. [AntispamRegEntries]
  392. spam threshold
  393. unsure threshold
  394. enable outlook
  395. enable express
  396.  
  397. [LogsExt]
  398. .log
  399. .0
  400.  
  401. [TrustedLogs]
  402. wl_hook
  403. oe_mail
  404. oe_mydb
  405. oe_scan
  406. oe_train
  407. oe_sink_old
  408. op_mail
  409. op_scan
  410. op_train
  411. op_gui
  412. selection
  413. enum
  414. expiredmail
  415. adviser
  416. asp_ipc
  417. memlog
  418. asp_srv
  419. tb_mail
  420. transact
  421.  
  422. [UninstallData]
  423. unins0??.dat
  424.  
  425.  
  426. [SelfProtection]
  427. ; In this section self-protection rules are described.
  428.  
  429. ; Rules for controlling file operations are written in the following format:
  430. ; object_set, access mask, subject_set
  431. ;
  432.  
  433. ; access mask:
  434. ; Attributes available for file operations (FILE=)
  435. ; read                - object read operation is allowed to the entity
  436. ; write                - object write operation is allowed to the entity
  437. ; delete            - operation of deleting the object file is allowed to the entity
  438. ; exec                - operation of launching the object is allowed to the entity
  439. ; connect            - operation of launching the object is allowed to the entity
  440. ; hidden            - operation of object masquerading from the entity
  441. ; full_access        - object has full access to the entity
  442. ; read_only            - object has read only access to the entity
  443.  
  444. ; open_process        - process opening is allowed
  445. ; thread_start        - remote thread starting is allowed
  446. ; thread_stop        - remote thread stopping is allowed
  447. ; write_mem            - remote writing to process memory is allowed
  448. ; thread_ctx        - remote setting of process context is allowed
  449.  
  450. ; no_scan           - do not scan object with on-access antivirus
  451. ; scan_on_exec      - scan file only if it is opened for execution
  452. ; no_override        - do not override rule if it is already defined for given object and subject
  453.  
  454. ; no_learn          - on blocking by the rule, service will not be notified
  455. ; no_learn_open     - service will not be notified on blocking open operation
  456. ; no_learn_exec     - --""-- launch operation
  457. ; no_learn_read     - --""-- read operation
  458. ; no_learn_write    - --""-- write operation
  459. ; no_learn_create   - --""-- creation operation
  460. ; no_learn_delete   - --""-- deletion operation
  461. ; no_learn_rename   - --""-- rename operation
  462.  
  463. ; Entity description. If entity name ends with \*, two rules are added.
  464. ; One for the entity, another for its child structures with the specified mask
  465.  
  466. {OutpostExecutable}       -> {ProtectedObjects}  = <FullAccess>
  467. {TrustedApplications}     -> {ProtectedObjects}  = <FullAccess> 
  468. <AllFiles>                -> {ProtectedObjects}  = <LimitedAccess>
  469. <AllFiles>                -> <ExecDir>\?         = read write exec
  470. {FilteredApplications}    -> {OutpostFiles}      = <LimitedAccessNoLearn>
  471. {RegistryApplications}    -> {OutpostRegistry}   = <FullAccess>
  472.  
  473.  
  474. <WindowsDir>\explorer.exe -> <ExecDir>\Thumbs.db = <FullAccess>
  475. <WindowsDir>\explorer.exe -> {OutpostExecutable} = <LimitedAccess> allow_send_input allow_send_close
  476.  
  477. ;http://btsx/ticket.aspx?id=13688
  478. <SystemDir32OrWow>\mshta.exe -> <ExecDir>\unins0??.exe = <LimitedAccess> open_process
  479. ;<AllFiles>                -> <ExecDir>\Plugins\BrowserBar\ie_bar.ini = <FullAccess>
  480. <AllFiles>                -> <ExecDir>\ie_bar.ini = <FullAccess>
  481. <AllFiles> -> <ExecDir>\{UninstallData} = <FullAccess> no_scan
  482. <AllFiles> -> <ExecDir>\log\{TrustedLogs}{LogsExt} = <FullAccess> no_scan
  483. <AllFiles> -> <ExecDir>\plugins\anti-spam\data\*  = <FullAccess> no_scan
  484. <AllFiles> -> <ExecDir>\plugins\anti-spam\*  = <FullAccess> no_scan
  485. <AllFiles> -> <ExecDir>\plugins\anti-spam.x64\*  = <FullAccess> no_scan
  486. <AllFiles> -> <ExecDir>\plugins\anti-spam.x64\data\*  = <FullAccess> no_scan
  487. <AllFiles> -> REGISTRY\<User>\Software\agnitum\Security Suite\{AntispamRegEntries} = <FullAccess>
  488.  
  489. ; Φ±Ωδ■≈σφΦ  - ∩≡Φ Φτ∞σφσφΦΦ Ωεφ⌠Φπ≤≡α÷ΦΦ ±Φ±≥σ∞α ∩≡ε∩Φ±√Γασ≥≥ Γ ²≥Φ Γσ≥ΩΦ φεΓ√σ τφα≈σφΦ 
  490. *->REGISTRY\<MachineServices>\afw\Parameters\Adapters\* = <FullAccess>
  491. *->REGISTRY\<MachineServices>\afw\Parameters\NdisAdapters\* = <FullAccess>
  492. *->REGISTRY\<MachineServices>\afw\Enum\* = <FullAccess>
  493. *->REGISTRY\<MachineServices>\afwcore\Enum\* = <FullAccess>
  494. *->REGISTRY\<MachineServices>\afwcore\Enum\* = <FullAccess>
  495. *->REGISTRY\<MachineServices>\acssrv\Enum\* = <FullAccess>
  496. *->REGISTRY\<MachineServices>\sandbox\Enum\* = <FullAccess>
  497. *->REGISTRY\<MachineServices>\sandbox64\Enum\* = <FullAccess>
  498.  
  499. ; φσ τα∙Φ∙ασ∞ ßεδⁿ°σ ∩≡ε÷σ±±εΓ csrss.exe - ∩ε²≥ε∞≤ ∩≡αΓΦδε φσ ≥≡σß≤σ≥± 
  500. ;<SystemDir>\services.exe -> <SystemDir>\csrss.exe = <FullAccess>
  501.  
  502. [SelfProtectionDebugAdd]
  503. {VCFiles}     -> {ProtectedObjects}  = <FullAccess> 
  504. {WinDbgFiles}     -> {ProtectedObjects}  = <FullAccess> 
  505. {SysIntFiles}     -> {ProtectedObjects}  = <FullAccess> 
  506. ; -------------------------------------------------------------------------------------------------------------------------
  507. ; On Access Scanner Rules
  508. ; -------------------------------------------------------------------------------------------------------------------------
  509. [NoScanExtensions]
  510. .log
  511. .pf
  512. .ci
  513. .dir
  514. .cdf-ms
  515. .part
  516.  
  517. [RegsitryFileStorage]
  518. default
  519. components
  520. sam
  521. security
  522. software
  523. system
  524. components
  525. default.sav
  526. sam.sav
  527. security.sav
  528. software.sav
  529. system.sav
  530. default.old
  531. sam.old
  532. security.old
  533. software.old
  534. system.old
  535.  
  536. [OnAccessScannerRules]
  537.  
  538. ; do not scan own log files when we write them
  539. ; {OutpostExecutable} -> <ExecDir>\log\* = <FullAccess> no_scan
  540. * -> <SystemDir>\Drivers\Etc\hosts=<FullAccess> no_scan no_override
  541.  
  542. ; do not allow malware to inject to outpost components
  543. {OutpostExecutable} -> * = <FullAccess> scan_on_exec
  544. *-><SystemRoot>\ProgramData\Agnitum\Security Suite\antispam_stat.ini=<FullAccess> no_scan
  545. *-><ExecDir>\plugins\anti-spam\data\base\*=<FullAccess> no_scan
  546. *-><ExecDir>\plugins\anti-spam.x64\data\base\*=<FullAccess> no_scan
  547.  
  548. * -> <SystemRoot>\System Volume Information\* = <FullAccess> scan_on_exec
  549. * -> <WindowsDir>\Prefetch\* = <FullAccess> scan_on_exec
  550. * -> <SystemDir>\wbem\logs\* = <FullAccess> scan_on_exec
  551.  
  552.  
  553. <SystemDir>\svchost.exe -> <WindowsDir>\* = <FullAccess> scan_on_exec
  554. <SystemDir>\ntoskrnl.exe -> <WindowsDir>\* = <FullAccess> scan_on_exec
  555.  
  556.  
  557. <SystemDir>\DfrgNtfs.exe -> * = <FullAccess> scan_on_exec
  558. <SystemDir>\SearchIndexer.exe -> * = <FullAccess> scan_on_exec
  559. <SystemDir>\SearchFilterHost.exe -> * = <FullAccess> scan_on_exec
  560. <SystemDir>\SearchProtocolHost.exe -> * = <FullAccess> scan_on_exec
  561.  
  562. <SystemDir>\wbem\wmiadap.exe -> <SystemDir>\perf*.dat = <FullAccess> no_scan
  563.  
  564. * -> \EXTENSIONS\*{NoScanExtensions} = no_scan
  565. * -> <SystemDir>\config\{RegsitryFileStorage} = <FullAccess> no_scan
  566. * -> <SystemDir>\config\regback\{RegsitryFileStorage} = <FullAccess> no_scan
  567. * -> <WindowsDir>\AppPatch\sysmain.sdb = <FullAccess> no_scan
  568. * -> <WindowsDir>\AppPatch\drvmain.sdb = <FullAccess> no_scan
  569.  
  570.  
  571.  
  572. ; -------------------------------------------------------------------------------------------------------------------------
  573. ; System Monitor Settings (for debug purposes)
  574. ; -------------------------------------------------------------------------------------------------------------------------
  575.  
  576. [SandboxMonitor]
  577. ; This section describes monitor settings used for debug purposes only.
  578. ; Macroses do not work here.
  579.  
  580. ; Operation mask for monitor. Available values:
  581. ; open exec read write close delete rename 
  582. Operations=
  583.  
  584. ; Whether operations with folders are monitored.
  585. FolderOperaton=TRUE
  586.  
  587. ; Whether operations with registry are monitored.
  588. RegistryOperation=TRUE
  589.  
  590. ; Whether operations with processes are monitored.
  591. InterprocOperation=FALSE
  592.  
  593. ; Whether non-file operations are monitored.
  594. FileOperation=FALSE
  595.  
  596.  
  597. ; -------------------------------------------------------------------------------------------------------------------------
  598. ; System Events Learning Settings
  599. ; -------------------------------------------------------------------------------------------------------------------------
  600.  
  601. [LearnOperations]
  602. ; This section describes learning channel settings.
  603. ; Macroses do not work in this section.
  604.  
  605. ; Operation mask for the learning channel. Available values:
  606. ; open exec read write close delete rename start stop 
  607. Operations=open exec read write close delete rename
  608.  
  609. ; Whether operations with folders are monitored.
  610. FolderOperaton=TRUE
  611.  
  612. ; Whether operations with registry are monitored.
  613. RegistryOperation=TRUE
  614.  
  615. ; Whether operations with processes are monitored.
  616. InterprocOperation=TRUE
  617.  
  618. ; Whether non-file operations are monitored.
  619. FileOperation=TRUE
  620.  
  621.  
  622. ; -------------------------------------------------------------------------------------------------------------------------
  623. ; ImproveNet Settings
  624. ; -------------------------------------------------------------------------------------------------------------------------
  625.  
  626. [ImproveNet]
  627. ; This section describes ImproveNet settings.
  628.  
  629. ; URL of the server where improve_net reports are stored
  630. URL=http://improvenet.agnitum.com/improvenet.php
  631.  
  632. ; ImproveNet task scheduling settings:
  633.  
  634. ; If ScheduleDay parameter is specified, ImproveNet task will be performed weekly,
  635. ; ScheduleDay specifies the number of a day, available values are 0-6 (0 corresponds to Monday).
  636. ; If ScheduleHour and ScheduleMinute are not specified, they are considered equal to 0.
  637. ScheduleDay=
  638.  
  639. ; If ScheduleHour parameter is specified (without ScheduleDay parameter), ImproveNet task will be performed
  640. ; daily, ScheduleHour specifies the number of an hour, available values are 0-23.
  641. ; If ScheduleMinute not specified, it is considered equal to 0.
  642. ScheduleHour=14
  643.  
  644. ; If ScheduleMinute parameter is specified (without ScheduleDay and ScheduleHour), ImproveNet task will be
  645. ; performed hourly, ScheduleMinute specifies the number of a minute, available values are 0-59.
  646. ScheduleMinute=0
  647.  
  648. ; ScheduleDay, ScheduleHour, ScheduleMinute settings can be specified together, 
  649. ; for example, if all these parameters are specified, ImproveNet task will be performed weekly on the specified day,
  650. ;  at the specified time.
  651.  
  652. [HTTPService]
  653. ; This section describes HTTP settings used in http_service.
  654.  
  655. ; HTTPVersion parameter specifies version to be used in requests,
  656. ; available values are 0.0, 1.0, 1.1
  657. HTTPVersion=1.0
  658.  
  659. ; AppendProductArg parameter specifies that product name should be added to each request,
  660. ; available values are TRUE, FALSE
  661. AppendProductArg=FALSE
  662.  
  663. ; AllowCaching parameter enables/disables caching,
  664. ; available values are TRUE, FALSE
  665. AllowCaching=FALSE
  666.  
  667. ; Proxy parameter defines whether proxy should be used, available
  668. ; values are auto, specified, disabled
  669. Proxy=auto
  670.  
  671. ; ProxyAddress, ProxyPort parameters are used if Proxy=specified,
  672. ; these parameters specify proxy server address and port
  673. ProxyAddress=
  674. ProxyPort=8080
  675.  
  676. ; ProxyAuth parameter specifies that proxy requires authorization, availavle values are TRUE, FALSE;
  677. ; ProxyLogin, ProxyPassword parameters specify credentials
  678. ProxyAuth=false
  679.  
  680. ; ProxyLogin, ProxyPassword parameters specify login and password for the proxy that requires autorization.
  681. ProxyLogin=
  682. ProxyPassword=
  683.  
  684. ; Number of attempts http_service does when it cannot complete request successfully.
  685. ; Minimum value is 3, maximum is 12.
  686. FailureAttempts=12
  687.  
  688.  
  689. [Protect]
  690. ; Protect plug-in state. If FALSE, no configuration in driver.
  691. Enable=TRUE
  692.  
  693. ; Maximum number of remote hosts for each attack, after which 
  694. ; the reports are stopped till report_timeout expiration.
  695.  
  696. MaxReportHost=10
  697.  
  698. ; Pause before repeated message about the attack for the 
  699. ; remote host, in hundreds ms.
  700. ReportTimeout=6000
  701.  
  702.  
  703. ; -------------------------------------------------------------------------------------------------------------------------
  704. ; Critical Objects Monitor Settings
  705. ; -------------------------------------------------------------------------------------------------------------------------
  706. [SystemMonitor]
  707. ; Main object monitor section.
  708. ; This section describes records for monitor.
  709. RegAutoStart=Auto Start Entries
  710. RegAutoLoad=Auto Start Modules
  711. RegWinLogon=WinLogon Settings
  712. RegShellExtensions=Shell Extensions
  713. RegShellCriticalEntries=Shell Critical Entries
  714. RegApplicationRestrictions=Application Restrictions
  715. RegActiveDesktop=Active Desktop
  716. RegInternetSettings=Internet Settings
  717. RegInternetExplorerPlugins=Explorer Plug-Ins
  718. RegInternetExplorerSettings=Explorer Settings
  719. Reg3rdPartyApplications=Third-Party Applications
  720. LegacyConfigurationFiles=Legacy Configuration Files
  721.  
  722. [DefragApp]
  723. ; Defragmentation sotfware category.
  724. <SystemDir32OrWow>\dfrgntfs.exe
  725.  
  726. [RegShellExtensions]
  727. ; Shell Extensions.
  728. *->REGISTRY\<MachineCurrentVersion>\Explorer\Browser Helper Objects\*=read
  729. *->REGISTRY\<MachineCurrentVersion>\Shell Extensions\Approved\*=read
  730. *->REGISTRY\<MachineCurrentVersion>\ShellServiceObjectDelayLoad\*=read
  731. *->REGISTRY\<MachineCurrentVersion>\Explorer\RemoteComputer\NameSpace\*=read
  732. *->REGISTRY\<CurrentVersionUserMachine3264>\Explorer\SharedTaskScheduler\*=read
  733. *->REGISTRY\MACHINE\{SoftwareClasses64}\SystemFileAssociations\shellex\ContextMenuHandlers\*=read
  734. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Active Setup\Installed Components\*=read
  735. <WindowsDir>\explorer.exe->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Active Setup\Installed Components\*=read write
  736.  
  737. [RegShellCriticalEntries]
  738. ; Object 'Windows Shell Open Commands' (85)----------
  739. *->REGISTRY\MACHINE\{SoftwareClasses64}\exefile\shell\{OpenOrRunAs}\command\*=read
  740. *->REGISTRY\MACHINE\{SoftwareClasses64}\comfile\shell\{OpenOrRunAs}\command\*=read
  741. *->REGISTRY\MACHINE\{SoftwareClasses64}\piffile\shell\{OpenOrRunAs}\command\*=read
  742. *->REGISTRY\MACHINE\{SoftwareClasses64}\batfile\shell\{OpenOrRunAs}\command\*=read
  743. *->REGISTRY\MACHINE\{SoftwareClasses64}\cmdfile\shell\{OpenOrRunAs}\command\*=read
  744. *->REGISTRY\MACHINE\{SoftwareClasses64}\scrfile\shell\{OpenOrRunAs}\command\*=read
  745. *->REGISTRY\<CurrentVersionUserMachine3264>\Explorer\ShellExecuteHooks\*=read
  746. *->REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\*\LocalServer32\*=read
  747.  
  748. [RegApplicationRestrictions]
  749. ; Application restrictions.
  750. *->REGISTRY\<User>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\*=read
  751. *->REGISTRY\<User>\Software\Microsoft\Windows\CurrentVersion\Policies\System\*=read
  752. *->REGISTRY\<User>\Software\Policies\Microsoft\Internet Explorer\Control Panel\*=read
  753. *->REGISTRY\{MachineOrUser}\{Software64}\Policies\Microsoft\Internet Explorer\Restrictions\*=read
  754. *->REGISTRY\<MachineCurrentVersion>\Policies\DisableRegistryTools=read
  755. ;[ay] not sure why i have to add this rule
  756. ;*->REGISTRY=read
  757.  
  758. [RegInternetSettings]
  759. ; LSP providers.
  760. *->REGISTRY\<MachineServices>\WinSock2\Parameters\*=read
  761. *-><SystemDir>\Drivers\Etc\hosts=read no_scan
  762. <SystemDir32OrWow>\svchost.exe-><SystemDir>\Drivers\Etc\hosts=read write
  763. {DefragApp}-><SystemDir>\Drivers\Etc\hosts=read write
  764.  
  765. [RegActiveDesktop]
  766. ; Active Desktop settings.
  767. *->REGISTRY\<User>\Control Panel\Desktop\*=read
  768. *->REGISTRY\<User>\Control Panel\Desktop\WindowMetrics\*=read write delete
  769. *->REGISTRY\<User>\Software\Microsoft\Internet Explorer\Desktop\General\*=read
  770. *->REGISTRY\<User>\Software\Microsoft\Internet Explorer\Desktop\Components\*=read
  771. <WindowsDir>\explorer.exe->REGISTRY\<User>\Software\Microsoft\Internet Explorer\Desktop\General\*=read write delete
  772.  
  773. [RegInternetExplorerPlugins]
  774. ; Internet Explorer Plug-Ins.
  775. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\MenuExt\*=read
  776. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Extensions\*=read
  777. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Explorer Bars\*=read
  778. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Plugins\Extension\*=read
  779. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Toolbar\ShellBrowser\*=read
  780. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Toolbar\WebBrowser\*=read
  781. <WindowsDir>\explorer.exe->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Toolbar\ShellBrowser\*=read write
  782. <ProgramDir>\Internet Explorer\iexplore.exe->REGISTRY\{MachineOrUser}\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\*=read write
  783. <ProgramDirWow>\Internet Explorer\iexplore.exe->REGISTRY\{MachineOrUser}\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\WebBrowser\*=read write
  784. <ProgramDir>\Internet Explorer\iexplore.exe->\REGISTRY\{MachineOrUser}\SOFTWARE\MICROSOFT\Internet Explorer\Extensions\*=read write
  785. <ProgramDirWow>\Internet Explorer\iexplore.exe->\REGISTRY\{MachineOrUser}\SOFTWARE\Wow6432Node\MICROSOFT\Internet Explorer\Extensions\*=read write
  786. <ExecDir>\op_mon.exe->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Extensions\*=read write
  787.  
  788. [RegInternetExplorerSettings]
  789. ; Internet Explorer URLs
  790. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Main\Start Page=read
  791. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\Main\Search Page=read
  792. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\AboutURLs\*=read
  793. *->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\URLSearchHooks\*=read
  794. <SystemDir32OrWow>\ie4uinit.exe->REGISTRY\{MachineOrUser}\{Software64}\Microsoft\Internet Explorer\*=read write delete
  795.  
  796. [RegAutoStart]
  797. ; Startup Registry Files.
  798. *->REGISTRY\<CurrentVersionUserMachine3264>\Run\*=read
  799. *->REGISTRY\<CurrentVersionUserMachine3264>\RunOnce\*=read
  800. *->REGISTRY\<CurrentVersionUserMachine3264>\RunOnceEx\*=read
  801. *->REGISTRY\<CurrentVersionUserMachine3264>\RunServices\*=read
  802. *->REGISTRY\<User>\Software\Microsoft\Windows NT\CurrentVersion\Windows\load=read
  803. *->REGISTRY\<User>\Software\Microsoft\Windows NT\CurrentVersion\Windows\run\*=read
  804. *->REGISTRY\<MachineNTCurrentVersion3264>\Image File Execution Options\*=read
  805. *->REGISTRY\<MachineCurrentVersion>\policies\Explorer\Run\*=read
  806. ;*->C:\Documents and Settings\*\StartMenu\Programs\Startup\*=read
  807. <SystemDir>\ctfmon.exe->REGISTRY\USER\*\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe=read write delete
  808. <SystemDir>\ctfmon.exe->REGISTRY\USER\*\Software\Microsoft\Windows\CurrentVersion\Run\internat.exe=read write delete
  809. <SystemDir>\wermgr.exe->REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LHWerQueuedReporting=read write delete
  810. *-><WindowsDir>\Tasks\*=read
  811. *-><DriversDir>\*.sys=read exec
  812. <ExecDir>\op_mon.exe-><DriversDir>\*.sys=<FullAccess>
  813. ; [ay] http://btsx/ticket.aspx?id=15050
  814. *-><WindowsDir>\System\*=read exec delete open_process
  815. *-><SystemDir32OrWow>\*=read exec delete open_process
  816. *-><SystemDir32OrWow>\config\*=<FullAccess>
  817. *-><SystemDir32OrWow>\spool\*=<FullAccess>
  818. *-><SystemDir32OrWow>\WBEM\*=<FullAccess>
  819.  
  820. ; [ay] not sure these rules works
  821. ; *-><SystemDir32OrWow>\*\*=<FullAccess>
  822.  
  823. ; [ay] http://btsx/ticket.aspx?id=15045
  824. *->REGISTRY\<MachineControl>\Terminal Server\Wds\rdpwd\StartupPrograms=read
  825. *->KNOWNDLLS\*=read exec
  826.  
  827.  
  828.  
  829. [RegAutoLoad]
  830. ; AppInit Dlls.
  831. *->REGISTRY\MACHINE\{Software64}\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs=read
  832. *->REGISTRY\MACHINE\{Software64}\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs=read
  833. *->REGISTRY\MACHINE\{Software64}\Microsoft\Windows NT\CurrentVersion\Windows\IconServiceLib=read
  834. ; [ay] http://btsx/ticket.aspx?id=15046
  835. *->REGISTRY\<MachineServices>\SENS\Parameters\ServiceDll=read
  836. *->REGISTRY\MACHINE\{Software64}\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger=read
  837.  
  838.  
  839.  
  840.  
  841. [RegWinLogon]
  842. ; Windows Logon Policies.
  843. *->REGISTRY\<MachineNTCurrentVersion3264>\Winlogon\GPExtensions\*=read
  844. *->REGISTRY\<MachineNTCurrentVersion3264>\Winlogon\Notify\*=read
  845. *->REGISTRY\<MachineNTCurrentVersion3264>\WOW\boot\shell=read
  846. *->REGISTRY\<MachineNTCurrentVersion3264>\Winlogon\Userinit=read
  847. *->REGISTRY\<MachineNTCurrentVersion3264>\Winlogon\UIHost=read
  848. *->REGISTRY\{MachineOrUser}\Software\Policies\Microsoft\Windows\System\Scripts\Logon\*=read
  849. *->REGISTRY\<User>\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell*=read
  850.  
  851. [Reg3rdPartyApplications]
  852. ; Critical non-MS application settings.
  853.  
  854.  
  855. [ProtectedConfigFiles]
  856. ; Configuration files protected from modification.
  857. <WindowsDir>\win.ini
  858. <WindowsDir>\system.ini
  859. <SystemRoot>\autoexec.bat
  860. <SystemRoot>\config.sys
  861. <WindowsDir>\winstart.bat
  862. <WindowsDir>\dosstart.bat
  863. <SystemDir>\autoexec.nt
  864. <SystemDir>\config.nt
  865.  
  866.  
  867. [LegacyConfigurationFiles]
  868. ; Windows win.ini file.
  869. *->REGISTRY\<MachineNTCurrentVersion3264>\IniFileMapping\system.ini\*=read
  870. *->REGISTRY\<MachineNTCurrentVersion3264>\IniFileMapping\win.ini\*=read
  871. *->REGISTRY\<MachineNTCurrentVersion3264>\IniFileMapping\control.ini\*=read
  872. *->{ProtectedConfigFiles}=read
  873. {DefragApp}->{ProtectedConfigFiles}=read write
  874.  
  875.  
  876. ; REGISTRY\<MachineServices>\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\*
  877. ; REGISTRY\<MachineServices>\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\*
  878. ; REGISTRY\<MachineServices>\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\*
  879. ; REGISTRY\<MachineServices>\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\*
  880. ; Off screen
  881. ; ActiveX registration
  882. ; Services registration
  883. ; Object 'Explorer Trojan' (93)----------
  884. ; Dir: ±:\. Search explorer.exe
  885. ; FILE: 'C:\WINDOWS\control.ini' listen 'MMCPL-inetcpl.cpl' section-value. Check data for 'no' value.
  886. ; [RestrictAnonymous]
  887. ; Windows Restrict Anonymous
  888. ; REGISTRY\MACHINE\SYSTEM\ControlSet*\Control\Lsa\restrictanonymous
  889. ; [RegActiveSetup]
  890. ; Installed Components
  891. ;
  892. [license]
  893. Reseller=samag
  894.