关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 1 Q9 d/ ]; d G; n! h0 D同时我们看到国外也有类似的情况出现： 7 i5 k w8 J- {McAfee: TrendMicro: 相关链接： 2007-03-29 23:25 更新： 2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902) + W+ n' G) E; R- b

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 微软恶意软件删除工具 $ k* X# [5 B+ LVISTA补丁 2003补丁 2000补丁 3 o* \% H1 `/ q2 b+ F

pwch

N年前就打过免疫器
! b2 c0 a* Z) v) H
7 g" [/ @4 V8 `$ h5 i: r7 }* l; uN-1年前就打好了官方补丁

当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2
( v9 S3 S9 k" ]. M# h1 i8 u
: U+ }6 R( t0 B5 X- t8 H病毒特征
/ T8 f* c) ], N9 m  D2 QThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

, ]* O' F; P0 XDownloads a file from a predetermined domain. The domain may be any of the following:

- G1 k  d& X7 b: P& W
# n) ~' G8 `. Kkutsap.com
: [- A0 @8 ]5 x' w. `2 T6 svxiframe.biz
) o0 _0 @  `' G  ^sweetbar.com
troyanov.net


  K- t9 R. R9 U  NSaves the downloaded file and executes it. The file may have one of the following names:
: z* D) u3 m4 g* Y

[Current folder]\mhh.exe
! ~( \- p# ]% r3 q  z6 I% J%UserProfile%\Desktop\mhh.exe
%System%\web.exe
9 t0 n6 V2 p$ \/ Z+ z" F& U4 ^5 f7 O
; S3 H. z& q( H# ~/ t; q- cNote:
[Current folder] is the folder where the Trojan was originally executed.
5 T% S: R3 Z3 J3 `( ]. I%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
: U9 x' ~$ V& b" R% w

Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
8 v9 l0 y( O* H
: c* p, }8 l: G
2 x% Z" E- Q5 R+ v7 [4 c% O, V清除方法
- g& k& c0 {) w5 ^) eThe following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
% s; W1 o  C1 p, _
Disable System Restore (Windows Me/XP).
( k" V7 U! ?0 AUpdate the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...
: @! P8 k0 G9 U8 [9 `) s6 I" B

# Z, ]: R! x' M7 c4 Y8 ~- o好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我