سلسلة ادوات مهمه ( 1 )

المصدر: سلسلة ادوات مهمه ( 1 )
في منتدى : منتدى [ حلول مشاكل الحاسوب الشائعة ]

هلااا فيكم جميعاا ,,
اليكم هذه السلسله من الادوات المفيده ,, وكل اداة إن شاء الله بتكون بموضوع مستقل

الاداة الاولى : CurrProcess v1.11

لأستعراض جميع العمليات التي بالذاكره ,, وتستطيع مشاهدة ملفات الــ DLL لكل عملية
وبهذه الاداة تستطيع التحكم بالعمليات ( من ايقاف & استعراض معلومات العمليه & عمل تقارير ,,, الخ )





وهذا رابط الاداة
http://www.nirsoft.net/utils/cprocess.zip






وشلون نستفيد من هذه الاداة المهمه ,, لحل مشاكل الفيروسات للأعضاء
عملت سكربت لتشغيل الاداة وعمل تقرير بالعمليات الجاريه فقط ,,
اللهم دبل كلك بالماوس ,, لحظات ويظهر لك التقرير ,, وتنسخه وتلصقه بمشاركتك

رابط الاداة + سكربت التشغيل وعمل التقرير

http://www.zyzoom.net/zyzoom_absba/cprocess/Zyzoom_cprocess.exe

وقبل الشرح ,, بودي اوضح ملفات النظام المهمه والتي تعمل بالذاكره
ومسارها دائما ( WINDOWS/SYSTEM32 )
والتي دائما الفيروسات تستخدم هذه الاسماء ( حتى نعتقد انه ملف النظام ) وما نحذفه

قائمة الملفات :
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
ومثل ما ذكرت هذه الملفات مسارها دائما ( WINDOWS/SYSTEM32 )

<<<<<<<<< حلووو الكلااام :tongue: لكن وشلون افرق بينهم وبين الفيروسات
اكتشافهم سهل مررره
ملفات النظام تكون معلوماتها في التقرير كالتالي :



اسم الملف
اسم المنتج ( لازم يظهر كما بالصوره السابقه )
رقم الاصدار ( لازم يظهر كما بالصوره السابقه )
وصف للمنتج ( لازم يظهر كما بالصوره السابقه )
الشركه المنتجه للملف ( لازم يظهر كما بالصوره السابقه )

مكان الملف ومساره ,, لازم يكون في WINDOWS/SYSTEM32
المشغل للملف ,, لازم يكون NT AUTHORITY\SYSTEM

غير السابق / اعتمد ان الملف مليون بالميه :tongue: انه ملف خبيث
مثل هذا الملف ( svchost.exe ) نفس ملف النظام ,, لكن بدون معلومات عن اسم المنتج ولا رقم اصدار ولاا اسم الشركه التي عملت هذا الملف
والأهم : مكان الملف ومساره ,, لازم يكون في WINDOWS/SYSTEM32
واخيناا مساره في WINDOWS
والمشغل للملف ,, لازم يكون NT AUTHORITY\SYSTEM
واخيناا مشغله turky2




<<<<<<<<<<< طيب الحين عرفنا ان الملف فايروس ,, بالله وشلون نشوته :biggrin: من جهاز العضوو

نعمل سكربت ,, لايقاف عملية الملف svchost.exe في الذاكره ,, بعدها نقدر نحذفه بسهوله
ولايقاف العملية نستخدم الامر taskkill

كود:

 
taskkill /F /IM svchost.exe

حيث F لايقاف العمليه بقوه :tongue:
IM لتحديد اسم ملف العملية

<<<<<<<<<<<<<<<<< كلاامك صحيح ,, لكن فيه نفس اسم الملف svchost.exe الخاص بالنظام
<<<<<<<< واذا عطلته راح يعاد تشغيل الجهاز

الله يذكرك بالشهاده :tongue: في هذه الحالة : نستخدم رقم العملية بدون اسم الملف
والــ ProcessID للملف ( svchost.exe ) الخبيث = 2728 ( كما بهذه الصوره )



وراح نستخدم الــ PID/ بدلاا من IM/
والامر بيكون بهذا الشكل

كود:

 
taskkill /F /PID 2728

وهذا امر حذف الملف

كود:

DEL /Q /F /A C:\win2\svchost.exe

حيث DEL امر حذف
Q حذف على الصامت
F حذف بالقوه ( بدون رسائل تأكيد للحذف )
A تطنيش سمات الملف ( file attributes ) سواء كان سماته ,, نظام او مخفي او للقراءه فقط

السكربت بشكله النهائي

كود:

 
taskkill /F /PID 2728
DEL /Q /F /A C:\win2\svchost.exe

ننسخه ونفتح برنامج المفكره للويندوز ( notepad )
ونلصقه ,, ونحفظه كــ ملف دفعي batch file بالامتداد bat.
ونرفعه للعضووو ,, وعند تشغيله على جهازه ,, راح يحذف الملف الخبيث ( svchost.exe )







تحياتي لكم جميعااا ,, ونلتقي بحول الله في شرح اداة جديده



محبكم / تركي العتيبي
زيزوم

​

 

الف شكر لك يا مبدع

بارك الله فيك

وجزاك الله خير

 

بارك الله فيك
لكن هل يجب اغلاق جميع البرامج قبل استخدامها

 

ابداااااااااااااااااااااع كسر الدنيا ,,,,

مليووون شكر يا مبدع المبدعين

 

يعطيك العافية جعلها الله بميزان حسناتك

 

يعطيك العافيه ياتركي على الادوات ..

والله يجزاك خير

الجنرال

 

جزاك الله خير وجعلها الله في ميزان حسناتك

الله يوفقك وفي انتظار المزيد بارك الله فيك

 

مشكور وبارك الله فيك

اخي العزيز زيزوووم على هالابداع

تقبل الله منا ومنك صالح الاعمال

 

يعطيك العافيه يا قلبي على الادوات ..
​

 

تسلم ايدك يا زيزوووم

 

بارك الله فيكم اعزائي
لاهنتم وتسلموون والله

 

وفيك بارك وسلم ,,

الافضل اغلااق جميع البرامج ,, حتى يظهر التقرير قصير :biggrin:

 

==================================================
Process Name : smss.exe
ProcessID : 820
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Windows NT Session Manager
Company : Microsoft Corporation
Window Title :
File Size : 50,688
File Created Date : 12/08/26 06:09:46 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\System32\smss.exe
Base Address : 0x48580000
Created On : 30/09/28 02:15:36 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 372 K
Mem Usage Peak : 464 K
Page Faults : 214
Pagefile Usage : 164 K
Pagefile Peak Usage : 1672 K
File Attributes : A
==================================================
==================================================
Process Name : csrss.exe
ProcessID : 876
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Client Server Runtime Process
Company : Microsoft Corporation
Window Title :
File Size : 6,144
File Created Date : 12/08/26 06:09:23 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\csrss.exe
Base Address : 0x4A680000
Created On : 30/09/28 02:15:40 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4504 K
Mem Usage Peak : 5124 K
Page Faults : 6951
Pagefile Usage : 1880 K
Pagefile Peak Usage : 1880 K
File Attributes : A
==================================================
==================================================
Process Name : winlogon.exe
ProcessID : 904
Priority : High
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Windows NT Logon Application
Company : Microsoft Corporation
Window Title :
File Size : 502,272
File Created Date : 12/08/26 06:09:52 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\winlogon.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:42 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 940 K
Mem Usage Peak : 10872 K
Page Faults : 7071
Pagefile Usage : 6212 K
Pagefile Peak Usage : 6904 K
File Attributes : A
==================================================
==================================================
Process Name : services.exe
ProcessID : 948
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Services and Controller app
Company : Microsoft Corporation
Window Title :
File Size : 108,032
File Created Date : 12/08/26 06:09:45 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\services.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:45 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 3576 K
Mem Usage Peak : 3672 K
Page Faults : 2166
Pagefile Usage : 1836 K
Pagefile Peak Usage : 2044 K
File Attributes : A
==================================================
==================================================
Process Name : lsass.exe
ProcessID : 960
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : LSA Shell (Export Version)
Company : Microsoft Corporation
Window Title :
File Size : 13,312
File Created Date : 12/08/26 06:09:35 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\lsass.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:45 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 1244 K
Mem Usage Peak : 6304 K
Page Faults : 8511
Pagefile Usage : 3888 K
Pagefile Peak Usage : 4028 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1144
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:48 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 5132 K
Mem Usage Peak : 5236 K
Page Faults : 1487
Pagefile Usage : 3220 K
Pagefile Peak Usage : 23564 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1208
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:49 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 4332 K
Mem Usage Peak : 4340 K
Page Faults : 1215
Pagefile Usage : 1916 K
Pagefile Peak Usage : 1976 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1312
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\System32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:50 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 26616 K
Mem Usage Peak : 35160 K
Page Faults : 19153
Pagefile Usage : 18984 K
Pagefile Peak Usage : 27732 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1360
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:51 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 3448 K
Mem Usage Peak : 3476 K
Page Faults : 901
Pagefile Usage : 2464 K
Pagefile Peak Usage : 2508 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1504
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:52 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 3408 K
Mem Usage Peak : 3460 K
Page Faults : 923
Pagefile Usage : 1332 K
Pagefile Peak Usage : 1396 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1616
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:15:55 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 7188 K
Mem Usage Peak : 7376 K
Page Faults : 1943
Pagefile Usage : 5080 K
Pagefile Peak Usage : 5640 K
File Attributes : A
==================================================
==================================================
Process Name : Explorer.EXE
ProcessID : 1992
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)
Description : Windows Explorer
Company : Microsoft Corporation
Window Title : الاداة الاولى CurrProcess v1.11
File Size : 1,033,216
File Created Date : 12/08/26 06:09:31 ص
File Modified Date : 28/05/28 10:23:07 ص
Filename : C:\WINDOWS\Explorer.EXE
Base Address : 0x01000000
Created On : 30/09/28 02:16:01 م
Visible Windows : 3
Hidden Windows : 36
User Name : ASA\ADMIN
Mem Usage : 25816 K
Mem Usage Peak : 28668 K
Page Faults : 59066
Pagefile Usage : 16168 K
Pagefile Peak Usage : 19060 K
File Attributes : A
==================================================
==================================================
Process Name : ctfmon.exe
ProcessID : 480
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : CTF Loader
Company : Microsoft Corporation
Window Title :
File Size : 15,360
File Created Date : 12/08/26 06:09:56 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\ctfmon.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:07 م
Visible Windows : 0
Hidden Windows : 5
User Name : ASA\ADMIN
Mem Usage : 3756 K
Mem Usage Peak : 3756 K
Page Faults : 1078
Pagefile Usage : 1104 K
Pagefile Peak Usage : 1240 K
File Attributes : A
==================================================
==================================================
Process Name : Apoint.exe
ProcessID : 572
Priority : Normal
Product Name : Alps Pointing-device Driver
Version : 6.0.2.186
Description : Alps Pointing-device Driver
Company : Alps Electric Co., Ltd.
Window Title :
File Size : 196,608
File Created Date : 12/08/26 08:54:59 ص
File Modified Date : 03/02/25 05:40:42 ص
Filename : C:\Program Files\Apoint2K\Apoint.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:08 م
Visible Windows : 0
Hidden Windows : 3
User Name : ASA\ADMIN
Mem Usage : 5320 K
Mem Usage Peak : 5320 K
Page Faults : 1426
Pagefile Usage : 1896 K
Pagefile Peak Usage : 2040 K
File Attributes : A
==================================================
==================================================
Process Name : CeEKey.exe
ProcessID : 584
Priority : Normal
Product Name : EKey Application
Version : 1, 0, 0, 31
Description : TOSHIBA HotKey Utility
Company : COMPAL ELECTRONIC INC.
Window Title :
File Size : 671,744
File Created Date : 03/08/26 01:04:52 م
File Modified Date : 03/08/26 01:04:52 م
Filename : C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:08 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 4696 K
Mem Usage Peak : 4776 K
Page Faults : 1239
Pagefile Usage : 2128 K
Pagefile Peak Usage : 2156 K
File Attributes : A
==================================================
==================================================
Process Name : TPTray.exe
ProcessID : 592
Priority : Normal
Product Name : TPTray Application
Version : 1, 0, 0, 7
Description : TPTray Application
Company : COMPAL ELECTRONIC INC.
Window Title :
File Size : 53,248
File Created Date : 21/07/26 06:11:58 م
File Modified Date : 21/07/26 06:11:58 م
Filename : C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:08 م
Visible Windows : 0
Hidden Windows : 3
User Name : ASA\ADMIN
Mem Usage : 4484 K
Mem Usage Peak : 4564 K
Page Faults : 1192
Pagefile Usage : 2064 K
Pagefile Peak Usage : 2100 K
File Attributes : A
==================================================
==================================================
Process Name : ZoomingHook.exe
ProcessID : 624
Priority : Normal
Product Name :
Version : 1, 0, 0, 1
Description : TOSHIBA Zooming Utility Hotkey Hook
Company : TOSHIBA
Window Title :
File Size : 24,576
File Created Date : 29/04/26 08:58:44 ص
File Modified Date : 29/04/26 08:58:44 ص
Filename : C:\WINDOWS\system32\ZoomingHook.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:09 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 3608 K
Mem Usage Peak : 3608 K
Page Faults : 919
Pagefile Usage : 1732 K
Pagefile Peak Usage : 1732 K
File Attributes : A
==================================================
==================================================
Process Name : TCtrlIOHook.exe
ProcessID : 632
Priority : Normal
Product Name :
Version : 1, 0, 0, 4
Description : TOSHIBA Control Utility Hotkey Hook
Company : TOSHIBA
Window Title :
File Size : 28,672
File Created Date : 18/07/26 03:49:28 م
File Modified Date : 18/07/26 03:49:28 م
Filename : C:\WINDOWS\system32\TCtrlIOHook.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:09 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 5108 K
Mem Usage Peak : 5108 K
Page Faults : 1355
Pagefile Usage : 2180 K
Pagefile Peak Usage : 2184 K
File Attributes : A
==================================================
==================================================
Process Name : Apntex.exe
ProcessID : 636
Priority : Normal
Product Name : Alps Pointing-device Driver for Windows NT/2000/XP
Version : 5.0.1.15
Description : Alps Pointing-device Driver for Windows NT/2000/XP
Company : Alps Electric Co., Ltd.
Window Title :
File Size : 45,056
File Created Date : 12/08/26 08:54:59 ص
File Modified Date : 25/12/23 06:08:42 م
Filename : C:\Program Files\Apoint2K\Apntex.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:09 م
Visible Windows : 0
Hidden Windows : 3
User Name : ASA\ADMIN
Mem Usage : 2744 K
Mem Usage Peak : 2812 K
Page Faults : 732
Pagefile Usage : 708 K
Pagefile Peak Usage : 728 K
File Attributes : A
==================================================
==================================================
Process Name : TPSMain.exe
ProcessID : 648
Priority : Normal
Product Name : TOSHIBA Power Saver
Version : 1, 0, 15, 0
Description :
Company : TOSHIBA Corporation
Window Title :
File Size : 266,240
File Created Date : 12/08/26 09:17:25 ص
File Modified Date : 07/07/26 01:33:46 م
Filename : C:\WINDOWS\system32\TPSMain.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:10 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 4880 K
Mem Usage Peak : 4880 K
Page Faults : 1282
Pagefile Usage : 3388 K
Pagefile Peak Usage : 3416 K
File Attributes : A
==================================================
==================================================
Process Name : TvsTray.exe
ProcessID : 668
Priority : Normal
Product Name : TOSHIBA Virtual Sound
Version : 1, 0, 0, 4
Description : TOSHIBA Virtual Sound Taskbar Module
Company : TOSHIBA Corporation
Window Title :
File Size : 73,728
File Created Date : 12/08/26 09:23:38 ص
File Modified Date : 26/02/26 03:25:34 م
Filename : C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:10 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 3220 K
Mem Usage Peak : 3312 K
Page Faults : 888
Pagefile Usage : 896 K
Pagefile Peak Usage : 932 K
File Attributes : A
==================================================
==================================================
Process Name : tfswctrl.exe
ProcessID : 684
Priority : Normal
Product Name :
Version : 1.04.08a
Description : Drive Letter Access Component
Company : Sonic Solutions
Window Title :
File Size : 122,941
File Created Date : 12/08/26 09:32:33 ص
File Modified Date : 23/04/26 04:33:00 ص
Filename : C:\WINDOWS\system32\dla\tfswctrl.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:11 م
Visible Windows : 0
Hidden Windows : 3
User Name : ASA\ADMIN
Mem Usage : 4120 K
Mem Usage Peak : 4120 K
Page Faults : 1096
Pagefile Usage : 1144 K
Pagefile Peak Usage : 1168 K
File Attributes : A
==================================================
==================================================
Process Name : hkcmd.exe
ProcessID : 772
Priority : Normal
Product Name : Intel(R) Common User Interface
Version : 3.0.0.4363
Description : hkcmd Module
Company : Intel Corporation
Window Title :
File Size : 77,824
File Created Date : 12/08/26 03:59:58 م
File Modified Date : 13/06/26 06:06:12 م
Filename : C:\WINDOWS\system32\hkcmd.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:11 م
Visible Windows : 0
Hidden Windows : 12
User Name : ASA\ADMIN
Mem Usage : 3216 K
Mem Usage Peak : 3224 K
Page Faults : 824
Pagefile Usage : 868 K
Pagefile Peak Usage : 988 K
File Attributes : A
==================================================
==================================================
Process Name : TPSBattM.exe
ProcessID : 792
Priority : Normal
Product Name : TOSHIBA Power Saver
Version : 1, 0, 2, 0
Description :
Company : TOSHIBA Corporation
Window Title :
File Size : 40,960
File Created Date : 12/08/26 09:17:25 ص
File Modified Date : 07/07/26 01:33:34 م
Filename : C:\WINDOWS\system32\TPSBattM.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:11 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 3272 K
Mem Usage Peak : 3272 K
Page Faults : 847
Pagefile Usage : 1052 K
Pagefile Peak Usage : 1052 K
File Attributes : A
==================================================
==================================================
Process Name : egui.exe
ProcessID : 796
Priority : Normal
Product Name : Eset Smart Security
Version : 3, 0, 414 RC1
Description : Eset GUI
Company : Eset
Window Title :
File Size : 1,283,328
File Created Date : 10/09/28 06:16:32 ص
File Modified Date : 10/09/28 06:16:32 ص
Filename : C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:12 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 6536 K
Mem Usage Peak : 6736 K
Page Faults : 2046
Pagefile Usage : 1712 K
Pagefile Peak Usage : 1932 K
File Attributes : A
==================================================
==================================================
Process Name : CPF.exe
ProcessID : 1436
Priority : Normal
Product Name : COMODO Firewall Pro
Version : 2.4.0.58
Description : COMODO Firewall Pro
Company : COMODO
Window Title :
File Size : 1,115,728
File Created Date : 29/09/28 07:27:39 م
File Modified Date : 29/09/28 07:27:29 م
Filename : C:\Program Files\Comodo\Firewall\CPF.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:14 م
Visible Windows : 0
Hidden Windows : 156
User Name : ASA\ADMIN
Mem Usage : 17472 K
Mem Usage Peak : 17472 K
Page Faults : 22783
Pagefile Usage : 14228 K
Pagefile Peak Usage : 21028 K
File Attributes : A
==================================================
==================================================
Process Name : toscdspd.exe
ProcessID : 1448
Priority : Normal
Product Name : CD/DVD Drive Acoustic Silencer
Version : 1, 0, 6, 0
Description : CD/DVD Drive Acoustic Silencer
Company : TOSHIBA
Window Title :
File Size : 65,536
File Created Date : 12/08/26 09:36:41 ص
File Modified Date : 03/03/26 10:26:06 ص
Filename : C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:15 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 3140 K
Mem Usage Peak : 3140 K
Page Faults : 814
Pagefile Usage : 912 K
Pagefile Peak Usage : 912 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1724
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:16:21 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 3300 K
Mem Usage Peak : 3304 K
Page Faults : 869
Pagefile Usage : 2268 K
Pagefile Peak Usage : 2292 K
File Attributes : A
==================================================
==================================================
Process Name : CFSvcs.exe
ProcessID : 1740
Priority : Normal
Product Name : ConfigFree(TM)
Version : 6, 0, 0, 1
Description : Service of ConfigFree.
Company : TOSHIBA CORPORATION
Window Title :
File Size : 40,960
File Created Date : 12/08/26 09:28:08 ص
File Modified Date : 07/12/25 11:38:38 م
Filename : C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:21 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 756 K
Mem Usage Peak : 4480 K
Page Faults : 1307
Pagefile Usage : 2352 K
Pagefile Peak Usage : 2364 K
File Attributes : A
==================================================
==================================================
Process Name : cmdagent.exe
ProcessID : 1776
Priority : Normal
Product Name : Comodo Firewall
Version : 2.4.0.20
Description : Comodo Agent Service
Company : COMODO
Window Title :
File Size : 361,040
File Created Date : 29/09/28 07:27:39 م
File Modified Date : 29/09/28 07:27:28 م
Filename : C:\Program Files\Comodo\Firewall\cmdagent.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:23 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 7828 K
Mem Usage Peak : 7920 K
Page Faults : 8428
Pagefile Usage : 6816 K
Pagefile Peak Usage : 7780 K
File Attributes : A
==================================================
==================================================
Process Name : DVDRAMSV.exe
ProcessID : 1808
Priority : Normal
Product Name :
Version : 3, 0, 0, 0
Description : DVD-RAM Utility Helper Service
Company : Matsushita Electric Industrial Co., Ltd.
Window Title :
File Size : 110,592
File Created Date : 18/05/28 05:14:18 م
File Modified Date : 13/07/25 07:33:00 ص
Filename : C:\WINDOWS\system32\DVDRAMSV.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:24 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 1776 K
Mem Usage Peak : 1776 K
Page Faults : 447
Pagefile Usage : 620 K
Pagefile Peak Usage : 620 K
File Attributes : A
==================================================
==================================================
Process Name : ekrn.exe
ProcessID : 1836
Priority : Normal
Product Name : Eset Smart Security
Version : 3, 0, 414 RC1
Description : Eset Service
Company : Eset
Window Title :
File Size : 451,840
File Created Date : 10/09/28 06:16:42 ص
File Modified Date : 10/09/28 06:16:42 ص
Filename : C:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe
Base Address : 0x00400000
Created On : 30/09/28 02:16:26 م
Visible Windows : 0
Hidden Windows : 3
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 27740 K
Mem Usage Peak : 40248 K
Page Faults : 273499
Pagefile Usage : 23780 K
Pagefile Peak Usage : 59520 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1920
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:16:27 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4320 K
Mem Usage Peak : 4396 K
Page Faults : 1242
Pagefile Usage : 2536 K
Pagefile Peak Usage : 2648 K
File Attributes : A
==================================================
==================================================
Process Name : alg.exe
ProcessID : 844
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Application Layer Gateway Service
Company : Microsoft Corporation
Window Title :
File Size : 44,544
File Created Date : 12/08/26 06:09:21 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\System32\alg.exe
Base Address : 0x01000000
Created On : 30/09/28 02:17:10 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 3652 K
Mem Usage Peak : 3656 K
Page Faults : 955
Pagefile Usage : 1256 K
Pagefile Peak Usage : 1276 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 2416
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 12/08/26 06:09:49 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\System32\svchost.exe
Base Address : 0x01000000
Created On : 30/09/28 02:17:16 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 3544 K
Mem Usage Peak : 3552 K
Page Faults : 919
Pagefile Usage : 1660 K
Pagefile Peak Usage : 1684 K
File Attributes : A
==================================================
==================================================
Process Name : TFncKy.exe
ProcessID : 3308
Priority : Normal
Product Name : TFncKy
Version : 3.19.00
Description : TFncKy
Company : TOSHIBA Corporation
Window Title :
File Size : 184,320
File Created Date : 12/08/26 09:17:50 ص
File Modified Date : 09/04/26 09:14:12 ص
Filename : C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe
Base Address : 0x00400000
Created On : 30/09/28 02:18:02 م
Visible Windows : 0
Hidden Windows : 2
User Name : ASA\ADMIN
Mem Usage : 5108 K
Mem Usage Peak : 5108 K
Page Faults : 1305
Pagefile Usage : 2484 K
Pagefile Peak Usage : 2484 K
File Attributes : A
==================================================
==================================================
Process Name : iexplore.exe
ProcessID : 3292
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
Description : Internet Explorer
Company : Microsoft Corporation
Window Title : سلسلة ادوات مهمه ( 1 ) - زيزوووم للأمن والحمايه - Microsoft Internet Explorer
File Size : 93,184
File Created Date : 12/08/26 07:22:36 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\Program Files\Internet Explorer\iexplore.exe
Base Address : 0x00400000
Created On : 30/09/28 03:20:57 م
Visible Windows : 1
Hidden Windows : 20
User Name : ASA\ADMIN
Mem Usage : 47196 K
Mem Usage Peak : 77776 K
Page Faults : 57441
Pagefile Usage : 32188 K
Pagefile Peak Usage : 62984 K
File Attributes : A
==================================================
==================================================
Process Name : run.exe
ProcessID : 3380
Priority : Normal
Product Name :
Version : 0. 0.
Description :
Company :
Window Title :
File Size : 132,254
File Created Date : 30/09/28 12:39:30 م
File Modified Date : 22/09/28 07:52:46 م
Filename : C:\DOCUME~1\ADMIN\LOCALS~1\Temp\cpr\run.exe
Base Address : 0x00400000
Created On : 30/09/28 03:51:49 م
Visible Windows : 0
Hidden Windows : 0
User Name : ASA\ADMIN
Mem Usage : 2276 K
Mem Usage Peak : 2288 K
Page Faults : 650
Pagefile Usage : 728 K
Pagefile Peak Usage : 784 K
File Attributes : A
==================================================
==================================================
Process Name : cmd.exe
ProcessID : 132
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Windows Command Processor
Company : Microsoft Corporation
Window Title :
File Size : 388,608
File Created Date : 12/08/26 06:09:23 ص
File Modified Date : 18/06/25 12:00:00 م
Filename : C:\WINDOWS\system32\cmd.exe
Base Address : 0x4AD00000
Created On : 30/09/28 03:51:49 م
Visible Windows : 0
Hidden Windows : 1
User Name : ASA\ADMIN
Mem Usage : 2776 K
Mem Usage Peak : 2784 K
Page Faults : 729
Pagefile Usage : 2088 K
Pagefile Peak Usage : 2092 K
File Attributes : A
==================================================
==================================================
Process Name : CProcess.exe
ProcessID : 2736
Priority : Normal
Product Name : CurrProcess
Version : 1.11
Description : CurrProcess
Company : NirSoft
Window Title :
File Size : 35,840
File Created Date : 30/09/28 12:39:30 م
File Modified Date : 08/06/26 04:46:34 ص
Filename : C:\DOCUME~1\ADMIN\LOCALS~1\Temp\cpr\CProcess.exe
Base Address : 0x00400000
Created On : 30/09/28 03:51:49 م
Visible Windows : 0
Hidden Windows : 0
User Name : ASA\ADMIN
Mem Usage : 2284 K
Mem Usage Peak : 2332 K
Page Faults : 916
Pagefile Usage : 960 K
Pagefile Peak Usage : 1016 K
File Attributes : A
==================================================​

 

ياكثر البرامج اللي تشتغل عندك هع

 

الله يعطيك العافيه

 

ابدااع رهييييب وليس بغريب على الحبيييييب

 

بارك الله فيك

هل كلها سليمة ام ان هناك اي مشكلة

=======

 

اخوي تركي ​

شرح رائع ​

ما قصرت والله ​

:redface: بس عندي مشكلهـ بالفهم​

​

​

هذا يحذف الملف الخبيث هذا svchost بس .. ؟؟​

اذا كان نعم .. كيف احذف بقية الملفات الخبيثة ​

 

هلااا وغلاااا فيكم ,,
تسلموون وبارك الله فيكم ,, لمروركم المميز

 

وفيك بارك اخي العزيز ,,

اللي في التقرير ,, سليمه