вот кусок лога при открытии файла вордом
читать дальше »
OPEN C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Options: Open Access: Read 294 10:12:53 explorer.exe:1916 QUERY INFORMATION C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Attributes: A 295 10:12:53 explorer.exe:1916 QUERY INFORMATION C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Length: 61240 296 10:12:53 explorer.exe:1916 CLOSE C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS 297 10:12:53 explorer.exe:1916 QUERY INFORMATION C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Attributes: A 298 10:12:53 explorer.exe:1916 OPEN C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Options: Open Access: 00100020 299 10:12:53 explorer.exe:1916 QUERY INFORMATION C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Length: 61240 300 10:12:53 explorer.exe:1916 CLOSE C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS 301 10:12:53 explorer.exe:1916 QUERY INFORMATION C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Attributes: A 302 10:12:53 explorer.exe:1916 QUERY INFORMATION C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Attributes: A 303 10:12:53 explorer.exe:1916 OPEN C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS Options: Open Access: 00100020 304 10:12:53 explorer.exe:1916 CLOSE C:\Program Files\Microsoft Office\Office12\msohevi.dll SUCCESS 305 10:12:53 explorer.exe:1916 OPEN C:\Program Files\Microsoft Office\Office12\msohevi.dll.2.Manifest NOT FOUND Options: Open Access: 001200A9 306 10:12:53 explorer.exe:1916 OPEN C:\Program Files\Microsoft Office\Office12\msohevi.dll.2.Config NOT FOUND Options: Open Access: 001200A9 307 10:12:53 csrss.exe:664 OPEN C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\ SUCCESS Options: Open Directory Access: 00100001 308 10:12:53 csrss.exe:664 DIRECTORY C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\ SUCCESS FileBothDirectoryInformation: *.policy 309 10:12:53 csrss.exe:664 DIRECTORY C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\ SUCCESS FileBothDirectoryInformation 310 10:12:53 csrss.exe:664 DIRECTORY C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\ NO MORE FILES FileBothDirectoryInformation 311 10:12:53 csrss.exe:664 CLOSE C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\ SUCCESS 312 10:12:53 csrss.exe:664 OPEN C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.1433.policy SUCCESS Options: Open Sequential Access: Read 313 10:12:53 csrss.exe:664 QUERY INFORMATION C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.1433.policy SUCCESS FileFsVolumeInformation 314 10:12:53 csrss.exe:664 QUERY INFORMATION C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.1433.policy BUFFER OVERFLOW FileAllInformation 315 10:12:53 csrss.exe:664 READ C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.1433.policy SUCCESS Offset: 0 Length: 4095 316 10:12:53 csrss.exe:664 READ C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.1433.policy END OF FILE Offset: 804 Length: 8178 317 10:12:53 csrss.exe:664 CLOSE C:\WINDOWS\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.1433.policy SUCCESS 318 10:12:53 csrss.exe:664 OPEN C:\WINDOWS\Ass
