.•:*¨`*:•. تقرير شامل عن أخطر فيروس ''Tazebama'' .•:*¨`*:•.

[center][u][size=29][color:318c=#ff0033][img(235,180)]http://www.heartfeltgreets.com/grandeurwelcomepic.jpg[/img][/color][/size][/u]</STRONG>
[u][size=29][color:318c=darkblue][img(204,16)]http://www.heartfeltgreets.com/grandeurdivide.gif[/img][/color][/size][/u]</STRONG>
[color:318c=darkblue][img]https://2img.net/h/i154.photobucket.com/albums/s269/Sfarjal/Fawasell/Bismilah/Sfarjal14.gif[/img][/color]
[color:318c=darkblue][img]https://2img.net/h/i154.photobucket.com/albums/s269/Sfarjal/Fawasell/Bismilah/13.gif[/img][/color]
[color:318c=darkblue][img]https://2img.net/h/i154.photobucket.com/albums/s269/Sfarjal/Fawasell/Sfarjal13.gif[/img][img]https://2img.net/h/i154.photobucket.com/albums/s269/Sfarjal/Fawasell/Sfarjal13.gif[/img][img]https://2img.net/h/i154.photobucket.com/albums/s269/Sfarjal/Fawasell/Sfarjal13.gif[/img][/color]
[color:318c=darkblue][img]https://2img.net/h/i224.photobucket.com/albums/dd268/pi4ever_2007/f066.gif[/img][/color]
[color:318c=darkblue][img(204,16)]http://www.heartfeltgreets.com/grandeurdivide.gif[/img][/color]
[u][size=29][color:318c=darkblue]تقـــرير شامل :</STRONG>[/color][/size][/u]</STRONG>
[size=21]</STRONG>[/size]</STRONG>
[size=21][color:318c=darkblue] عن الفيروس [size=25]TazeBama[/size]</STRONG>[/color][/size]</STRONG>
[size=21]</STRONG></STRONG>[/size]
[size=21][color:318c=darkblue]والذي يسمى أيضاً Win32.Mabezat.b</STRONG></STRONG>[/color][/size]
[size=21]</STRONG></STRONG>[/size]
[size=21][color:318c=darkblue][img]https://2img.net/h/i224.photobucket.com/albums/dd268/pi4ever_2007/f066.gif[/img] </STRONG></STRONG>[/color][/size]
[size=21]</STRONG>[/size]</STRONG>
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img]</STRONG>[/color][/size]</STRONG>
[size=25][color:318c=darkblue]هذا تقرير شامل عن أخطر فيروس </STRONG>[/color][/size]</STRONG>
[size=25][color:318c=darkblue]واجهه العديد من الأعضاء.</STRONG>[/color][/size]</STRONG>
[size=21]</STRONG>[/size]</STRONG>
[size=21]</STRONG>[/size]</STRONG>
[size=21][color:318c=darkblue]انشأ هذه الملفات (الفيروسات) داخل الفلاش ديسك Flash Disque:</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]My documents .exe</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]Readme.doc .exe</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]tazebama.exe</STRONG></STRONG>[/color][/size]
[color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img]</STRONG>[/color]
[size=21][color:318c=darkblue]اعادة نفس الملفات داخل قرص النظام مثلاً C :</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]My documents .exe</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]Readme.doc .exe</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]tazebama.exe</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]zPharaoh.inf</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img]</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]ثم ينشأ داخل المجلد Mes documents :</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]readme.doc .exe</STRONG></STRONG>[/color][/size]
[size=21]</STRONG></STRONG>[/size]
[color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img] </STRONG>[/color]
[size=21][color:318c=darkblue]ينشأ مع برامج اقلاع الويندوز boot:</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]zPharaoh.exe</STRONG>[/color][/size]
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img] </STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]ينشأ داخل المجلد Documents and Settings :</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]tazebama.dll</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]_tazebama.dl</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]_hook.dl</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img] </STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]ينشأ داخل المجلد Application Data :</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]مجلد باسم tazebama</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]وفي داخل هذا المجلد تجد:</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]zPharaoh.dat</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]tazebama.log</STRONG></STRONG>[/color][/size]
[size=21]</STRONG></STRONG>[/size]
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img] </STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]ينشأ في جميع أجزاء القرص الصلب :</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]zPharoh.exe</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]Autorun.inf</STRONG></STRONG>[/color][/size]
[size=21]</STRONG></STRONG>[/size]
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img] </STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]ينشأ داخل المجلد cookies :</STRONG></STRONG>[/color][/size]
[size=21][color:318c=darkblue]Mabezat.B</STRONG></STRONG>[/color][/size]
[size=21]</STRONG></STRONG>[/size]
[color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img]</STRONG>[/color]
[size=21][color:318c=darkblue]يغير في قيمة الريجستر Regedit:</STRONG></STRONG>[/color][/size]
[size=9][color:318c=darkblue]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0"
</STRONG>[/color][/center]
[/size][center][size=21]</STRONG>[/size]</STRONG>
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img]</STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]ثم داخل كل مجلد يحتوي على هذه الامتدادات :</STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue].hlp .pdf.html .txt .aspx.cs .aspx .psd .mdf .rtf</STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue].htm .ppt .php .asp .pas .h .cpp .xls .doc .rar .zip .mdb</STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue][img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img] </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]يقوم بانشأ بداخل ذلك المجلد: </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]windows.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]office_crack.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]serials.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]passwords.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]windows_secrets.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]source.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]imp_data.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]documents_backup.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]backup.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]MyDocuments.rar </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]HpphmfUppmcbsOpujgjfs/fyf </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]GoogleToolbarNotifier.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]PanasonicDVD_DigitalCam.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Antenna2Net.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]RadioTV.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Microsoft MSN.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Sony Erikson DigitalCam.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]IDE Conector P2P.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Windows Keys Secrets.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]FaxSend.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]RecycleBinProtect.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Disk Defragmenter.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]CD Burner.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]ShowDesktop.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]BrowseAllUsers.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]LockWindowsPartition.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Win99compatibleXP.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]MakeUrOwnFamilyTree.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]WindowsXp StartMenu Settings.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Recycle Bin.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Adjust Time.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Microsoft Windows Network.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]HP_LaserJetAllInOneConfig.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]FloppyDiskPartion.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]msjavx86.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]AmericanOnLine.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Crack_GoogleEarthPro.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Lock Folder.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]InstallMSN11En.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]InstallMSN11Ar.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]JetAudio dump.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]KasperSky6.0 Key.doc.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Office2007 Serial.txt.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Office2007 CD-Key.doc.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]Make Windows Original.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]NokiaN73Tools.exe </STRONG>[/color][/size]</STRONG>
[size=21][color:318c=darkblue]WinrRarSerialInstall.exe</STRONG>[/color][/size]</STRONG>
[color:318c=darkblue] [img]http://www.zyzoom.net/vb_up/upload/wh_50735542.gif[/img]</STRONG>[/color]
[color:318c=darkblue][img]https://2img.net/h/i224.photobucket.com/albums/dd268/pi4ever_2007/f066.gif[/img]</STRONG>[/color]
[size=21]</STRONG></STRONG>[/size]
</STRONG>[/center]