关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 + c: |6 B, U1 I+ M" C该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 / @5 G! w; _ k2 E7 j6 `4 p论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 同时我们看到国外也有类似的情况出现： McAfee: ; f4 `$ _& Q5 f7 i+ p6 A0 q! W4 uTrendMicro: ! V ~; ~5 v" j2 ?4 U7 P相关链接： / o" f) \% |! X) M' W. h3 n2007-03-29 23:25 更新： : b( y8 t( @+ C5 H M; i3 y2007-04-04 09:03 更新： 7 I- C* x& e( ?! O' t c/ E1 |3 eMicrosoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902)

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： , h3 d1 K9 B0 i; y6 U8 gXP补丁 0 _& j. B* e* ?# M i微软恶意软件删除工具 & K, {# F' x8 k; L0 j6 K2 @VISTA补丁 # S- e+ }- Q8 o0 |/ j% p0 ^( _4 s2003补丁 2000补丁 ' o& Z. U- z; q' j" ^; R) S

pwch

N年前就打过免疫器
6 L. n% V& l+ y. q, @& ^5 V
( T8 l: x9 t2 DN-1年前就打好了官方补丁

当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

病毒特征
! K7 o- H, L  `! M) ?The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
2 L- N. f0 j3 J1 K( Z
Downloads a file from a predetermined domain. The domain may be any of the following:


kutsap.com
vxiframe.biz
) l/ n1 l7 J9 P9 Asweetbar.com
; @* F: y& h" R+ }troyanov.net

% \9 b; [- n7 K1 q
+ C2 L' T3 w+ ^Saves the downloaded file and executes it. The file may have one of the following names:

. B8 y: ?: ]! x
2 ?% P3 w3 Q3 R[Current folder]\mhh.exe
4 ~5 S- u9 j7 o2 J+ T# G%UserProfile%\Desktop\mhh.exe
%System%\web.exe

3 [( Q: l; P: S1 [Note:
[Current folder] is the folder where the Trojan was originally executed.
( J3 o( b# ]* ]%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


! W1 S$ P# x- q& \' |3 ^: fEnds the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
# C+ C8 U( c, t) X& j. v
! i2 l( F/ }+ c7 e- n+ w
2 E: C4 x0 S9 i+ o- u5 G( `0 U清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
9 l8 ]6 e7 k+ o
+ ^; {6 J; {0 s- a8 IDisable System Restore (Windows Me/XP).
3 B% W/ r# R9 g- r: qUpdate the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...


好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我