请教高手！！

无聊

刚用毛豆不到一天时间，自己简单的设置了一些规则，然后使用CLT进行测试，结果如下：

COMODO Leaktests v.1.1.0.3
Date 15:19:33 - 2009-12-21
OS Windows XP SP3 build 2600
1. RootkitInstallation: MissingDriverLoad	Protected
2. RootkitInstallation: LoadAndCallImage	Protected
3. RootkitInstallation: DriverSupersede	Protected
4. RootkitInstallation: ChangeDrvPath	Protected
5. Invasion: Runner	Protected
6. Invasion: RawDisk	Protected
7. Invasion: PhysicalMemory	Protected
8. Invasion: FileDrop	Protected
9. Invasion: DebugControl	Protected
10. Injection: SetWinEventHook	Protected
11. Injection: SetWindowsHookEx	Protected
12. Injection: SetThreadContext	Protected
13. Injection: Services	Vulnerable
14. Injection: ProcessInject	Protected
15. Injection: KnownDlls	Protected
16. Injection: DupHandles	Protected
17. Injection: CreateRemoteThread	Protected
18. Injection: APC dll injection	Protected
19. Injection: AdvancedProcessTermination	Protected
20. InfoSend: ICMP Test	Protected
21. InfoSend: DNS Test	Protected
22. Impersonation: OLE automation	Protected
23. Impersonation: ExplorerAsParent	Protected
24. Impersonation: DDE	Protected
25. Impersonation: Coat	Protected
26. Impersonation: BITS	Protected
27. Hijacking: WinlogonNotify	Protected
28. Hijacking: Userinit	Protected
29. Hijacking: UIHost	Protected
30. Hijacking: SupersedeServiceDll	Vulnerable
31. Hijacking: StartupPrograms	Vulnerable
32. Hijacking: ChangeDebuggerPath	Protected
33. Hijacking: AppinitDlls	Protected
34. Hijacking: ActiveDesktop	Protected
Score 310/340

可以看到，有三项测试没有通过！
我对规则进行了修改之后进行测试还是这样，
请问那些没有通过的测试，应该怎样在毛豆里添加规则以实现完全通过测试呢？
请教高手！！
先谢过了！！

月光下的忍者

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\*

无聊

谢版主，这个是Hijacking: SupersedeServiceDll的，对吗？
刚才看了一下毛豆的说明：
[quote]30. Hijacking: SupersedeServiceDll
What does it do ? Tries to modify 揝erviceDll

username

13. Injection: Services
2009-12-21 15:46:09    创建注册表项    阻止
进程: d:\program files\comodo\clt\clt.exe
目标: HKEY_LOCAL_MACHINE\system\currentcontrolset\services\new_service
规则: [注册表组]系统服务 -> [注册表]*\SYSTEM\*controlset*\Services\*

30. Hijacking: SupersedeServiceDll
2009-12-21 15:46:33    修改注册表值    阻止
进程: d:\program files\comodo\clt\clt.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS\Parameters\servicedll
值: \\?\globalroot\systemroot\system32\snes.dll
规则: [注册表组]保护系统服务项 -> [注册表]*\SYSTEM\*\Services\SENS\*

ps：推荐用*\SYSTEM\*controlset*\Services\* 值ServiceDll来拦

31. Hijacking: StartupPrograms
2009-12-21 15:47:00    修改注册表值    阻止
进程: d:\program files\comodo\clt\clt.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
值: D:\Program Files\Comodo\CLT\clt.exe
规则: [注册表组]自动运行程序所在位置_ -> [注册表]*\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd; StartupPrograms

无聊

感谢以上热心帮忙的同仁！
现在已经完全通过了！[:27:]
十分感谢！！
节省篇幅，结果就不上了！

无聊

请问四楼用的是MD的日志吗？
本想上手MD，后来看没有免费的，
就改投毛豆了，感谢提供解决方法！