关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 9 X7 z8 S' O7 R% s ?3 D5 a% e3 P同时我们看到国外也有类似的情况出现： McAfee: 1 O/ [+ p8 [7 v/ L$ BTrendMicro: ; W4 Q. ~+ O/ I* _- d9 n9 v: p2 Q相关链接： 8 C; Z$ H8 G3 u/ V8 N5 p# N8 a* L2007-03-29 23:25 更新： ; y. A$ P) q0 i) ^2007-04-04 09:03 更新： * K$ P6 J8 \/ ?, E4 \7 QMicrosoft Security Bulletin MS07-017 . j! d% E0 W" n6 ~& bVulnerabilities in GDI Could Allow Remote Code Execution (925902) . T9 s Z7 p. ` k% o5 X

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 $ N+ E) f* f7 T& U* T4 s微软恶意软件删除工具 VISTA补丁 2003补丁 2000补丁

pwch

N年前就打过免疫器
1 F; o0 t3 V7 M
% k0 y/ M) ?& o4 R) A$ DN-1年前就打好了官方补丁

4 ^5 k. I# S/ P  _, D当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2
) J# u; D1 n1 p( j  {7 ^4 X1 I) U0 z
" [) n! h$ X( ^/ ]) e病毒特征
The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

' C' t6 f  `$ R( PDownloads a file from a predetermined domain. The domain may be any of the following:

0 o- q8 D2 x$ M
: j4 E. p1 O2 S/ p- t. r- D% skutsap.com
; |9 j/ {7 t0 }8 i+ M+ qvxiframe.biz
9 j# t0 C6 o4 `9 xsweetbar.com
$ J& J/ @( @% I) Z: D- y% Wtroyanov.net
! T' Q. z: j# D% F& q
5 U8 T) `. f- g2 x
Saves the downloaded file and executes it. The file may have one of the following names:


6 r7 Q% ^& g/ X9 @, W' h, L+ g) ?6 L% T[Current folder]\mhh.exe
2 S2 I& D- ?+ Z" m; W%UserProfile%\Desktop\mhh.exe
8 l6 C/ b/ j% B%System%\web.exe

4 u) {& z. [/ R: r* b5 B0 N6 }; @Note:
[Current folder] is the folder where the Trojan was originally executed.
%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
* C5 u% o) w* ~/ m9 M% ?* _  @%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


$ f& m! y' G& ?" m& h  bEnds the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.


清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

% T" ^: I% i' v! y' }/ O; s, ?Disable System Restore (Windows Me/XP).
Update the virus definitions.
% P2 y+ d8 U, @Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...

( X. s5 K5 j+ q) U" u/ d
. [1 f3 y* j4 O7 W. s( w. _; L. v好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我