关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 . _& U- x! c% G9 A3 d" F7 H0 w7 W论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 0 k% o: r8 F3 o r, O, ?同时我们看到国外也有类似的情况出现： McAfee: # N* H. d% s; T d/ W! L8 cTrendMicro: 6 U q& G/ ^; a' f& [3 r相关链接： 6 ?9 x+ ?" o6 \, n* i) [5 t/ B2007-03-29 23:25 更新： 2007-04-04 09:03 更新： 4 h" _) [& p' I5 jMicrosoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902)

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 $ l' ]2 T$ c! U0 l9 a微软恶意软件删除工具 VISTA补丁 2003补丁 2000补丁

pwch

N年前就打过免疫器

N-1年前就打好了官方补丁

8 A% A' j4 V) n) w: {% C7 J当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

/ E0 b6 v' p9 r( a7 B病毒特征
" _& W+ W( B3 d" g3 L3 ~The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

Downloads a file from a predetermined domain. The domain may be any of the following:
+ f% p; k" Q# s
' R; x* `6 w. Y4 o6 J: h# E& d) ^
6 E1 U: a8 s* `) ?7 Q5 Fkutsap.com
vxiframe.biz
sweetbar.com
troyanov.net
# v  l. z* O" n: D

Saves the downloaded file and executes it. The file may have one of the following names:


  C% l2 B$ E9 Z; f: i[Current folder]\mhh.exe
%UserProfile%\Desktop\mhh.exe
%System%\web.exe
& k  P2 a, y4 a# j3 x* A
Note:
[Current folder] is the folder where the Trojan was originally executed.
%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


$ I/ }: s$ s) x) l6 _6 `$ m8 ZEnds the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.

; X5 R, p0 j! `: ]* b5 z
& X. `; O1 f0 H. D清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...

% ^" m$ e* u  u9 h" J2 g# {
好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我