关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 4 M" b7 ^* ]- ~& J @论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 同时我们看到国外也有类似的情况出现： f" m9 k' |) I2 A( BMcAfee: 0 ]* L; Z$ R. |9 bTrendMicro: 7 F, x! V6 t4 r, Q" n2 O' e相关链接： 2007-03-29 23:25 更新： 2007-04-04 09:03 更新： 3 u; X' ]& F" ]Microsoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902) , b: x# `4 i6 r* z

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： B5 l8 G% j" F+ l, s% @+ ^XP补丁 微软恶意软件删除工具 VISTA补丁 - `& g/ m2 s+ y' [9 r, J0 A2003补丁 2 q( I- I; o `$ j- P( v2000补丁

pwch

N年前就打过免疫器
2 O! i1 B+ {& \$ Z- W
7 O8 i! t8 S- w! |N-1年前就打好了官方补丁
9 a2 c( V- U. _. H4 U6 X
9 T! w2 X9 X5 z; W+ C" j当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

8 i: i" q8 e1 f; ~3 x0 C病毒特征
# S4 Q. _( b) f- |1 }The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

Downloads a file from a predetermined domain. The domain may be any of the following:


( P$ l- U1 [# j7 Ckutsap.com
1 n( `! T8 @5 Q( w8 xvxiframe.biz
sweetbar.com
troyanov.net

: d' C' w. U* J) M$ J; L
Saves the downloaded file and executes it. The file may have one of the following names:
: M# n' y% e0 W! S7 L& m+ \

4 G- c  K1 a# R9 u[Current folder]\mhh.exe
- g1 K  E0 U( V3 @%UserProfile%\Desktop\mhh.exe
5 [# |' y, k! F& V" C( y+ p0 ^) g%System%\web.exe

4 v% A' `4 S7 ?Note:
[Current folder] is the folder where the Trojan was originally executed.
' ^; o# @& k- Q; m$ Y%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
" b! @2 ?; ^9 H7 K%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
4 _* x3 B7 o! @# i+ }

清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
/ o' U9 f' k" i
' h7 s7 D. G5 x: @3 w& VDisable System Restore (Windows Me/XP).
Update the virus definitions.
2 ^0 M) i" s. g' c0 k, f  tRun a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...


2 c8 u- u3 f- z9 P+ }- k: E; T好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我