关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 5 N' A5 w" ], X# o0 T论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 同时我们看到国外也有类似的情况出现： - A! `. p# Y7 R% C$ h; A$ r* LMcAfee: ( d; h% D9 Y* B7 _! N/ I, ~, ATrendMicro: 0 l( a1 H4 z5 q6 ]" R7 d2 q2 P相关链接： # _) M: H6 g* P4 R2 U% A" S& v2007-03-29 23:25 更新： 2007-04-04 09:03 更新： 0 L) B3 v6 V' [" r4 d! ?! fMicrosoft Security Bulletin MS07-017 9 A1 M% }3 }0 _4 q8 X8 o, CVulnerabilities in GDI Could Allow Remote Code Execution (925902) " e6 D9 N' a' B

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 微软恶意软件删除工具 4 A/ j2 ?8 P" G) S8 PVISTA补丁 # p$ D% r1 W! j+ p# B8 ~) i2003补丁 2000补丁 $ a- a% w8 U6 H' d6 b1 o( [. }3 M + m! L5 G3 m# l9 ^( {

pwch

N年前就打过免疫器

N-1年前就打好了官方补丁

5 f0 O8 n: \& p6 g, F9 H3 O当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

病毒特征
The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
) N3 L' N0 N9 ?& O6 I
Downloads a file from a predetermined domain. The domain may be any of the following:

7 ~/ E+ [2 n% {% I
+ }. Y/ u# B4 zkutsap.com
vxiframe.biz
3 P* C. L" _4 g2 wsweetbar.com
troyanov.net
7 p" c; I( s% p( o
% O  u/ K; p7 N. O% @& e. r7 W' L
Saves the downloaded file and executes it. The file may have one of the following names:
+ r8 [) c- R+ ^6 o' H( c
" [. L4 g; x- E* }( X
* n! A/ S( z/ D8 }7 d[Current folder]\mhh.exe
3 P2 \: n7 E( U$ q6 J! O%UserProfile%\Desktop\mhh.exe
%System%\web.exe
+ O% ?7 w; M. n, }8 n$ J
& k; ^0 R! V3 n" I4 cNote:
[Current folder] is the folder where the Trojan was originally executed.
%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
, F# m' r* P8 n0 K% a%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
2 b) [$ ~6 w* [+ G+ D
- y9 _+ [: k; t
" E% E3 v' X# d" Z) [! c* V7 J0 M清除方法
1 ?/ w  z# L8 z+ i" O& IThe following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

# ?) S+ }( s. w1 IDisable System Restore (Windows Me/XP).
8 R6 G) U5 I. C2 Z0 l0 NUpdate the virus definitions.
7 S( M' z5 R3 Q7 f0 XRun a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...
6 u8 ~& r( D) z

5 Z/ N  x: |% S8 l3 {  z" G好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我