关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 8 t% N- n/ q/ C3 U) C% y同时我们看到国外也有类似的情况出现： McAfee: TrendMicro: $ g% {9 P# ~" {相关链接： 2007-03-29 23:25 更新： $ V/ c+ @) S: P x/ [3 P. @2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 ( L0 L" p- p% ~3 ?Vulnerabilities in GDI Could Allow Remote Code Execution (925902)

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： $ B. c- ?8 k$ m6 ~& J' v& \! zXP补丁 微软恶意软件删除工具 VISTA补丁 2003补丁 2000补丁 3 W7 S* a: W8 u/ F P9 N

pwch

N年前就打过免疫器
8 {) y) S# R5 K( P3 w
- b3 J/ g. E( S8 QN-1年前就打好了官方补丁

" k: j, o+ A; w( n  Q! J当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

病毒特征
: d* z6 U7 ^" I1 y5 S0 B; f% _/ }The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

5 ?6 j$ C' N1 _( z) ]& XDownloads a file from a predetermined domain. The domain may be any of the following:
! J9 T9 `8 Y* k& y- a
. {; l' n5 j- \. `7 r/ }
4 S$ h9 _' c6 B  f  Ukutsap.com
vxiframe.biz
2 j6 |; H5 M, \$ isweetbar.com
" `# g  P/ t- b1 B* s2 I5 utroyanov.net


+ F0 w8 v3 f0 ^! M2 K% @Saves the downloaded file and executes it. The file may have one of the following names:


( z+ v* t' C9 b8 l9 E5 g[Current folder]\mhh.exe
. K) A5 q8 Y/ y( T" E%UserProfile%\Desktop\mhh.exe
5 U8 [" q5 ~7 G; V- @%System%\web.exe
" T, [- H! f6 f; W* k
Note:
[Current folder] is the folder where the Trojan was originally executed.
%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
1 d( ^& k4 H- ?4 S+ {%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
' j8 i# ]+ {/ c: J

8 Y  t. l- c8 [* {  }! O5 n& {Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
, z# T/ S9 n! h0 U/ S9 n7 t- a/ q; `
' y) h- S; F. T' y- M
( y* a! c% J/ C% ?  Q8 {- B1 Y1 A1 E清除方法
, _( E7 I0 ~+ w3 D  EThe following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
4 w4 [% s! ^3 R8 D% Y0 ?% b
3 ]5 j$ \0 _+ i7 WDisable System Restore (Windows Me/XP).
; v$ f/ E& K4 s( [* }) F; @Update the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...
2 d( L3 U) A; \1 |$ G, P. [
( D* x% U4 r; Q( ]# E
$ B4 i  ?- Z% R) }* S1 g, M好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我