关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 ) }( Y! [: t4 E6 I8 u7 d5 B该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 ) u# b0 u6 Q0 G论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% ( L2 Z6 L% B6 d8 ] Y6 d0 Y同时我们看到国外也有类似的情况出现： ( b; @, ], A. H% Z/ B kMcAfee: TrendMicro: 相关链接： % r+ p- b/ P, C H. B2007-03-29 23:25 更新： . @! [4 J) u& ~/ m0 g! U2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902) . b7 |; P5 X8 c" u. D

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 微软恶意软件删除工具 ; ~6 b4 s/ {0 _% WVISTA补丁 0 f) D6 R& L9 |) c2003补丁 2000补丁

pwch

N年前就打过免疫器

N-1年前就打好了官方补丁

4 z& }5 v: k  U4 J当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

( Z1 b  ^( y( f. Z& p, I( {* A病毒特征
3 t7 k7 R6 {, [4 G* jThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
" `, v: `, m# s4 M0 g
, L- E, N, o5 F, \) FDownloads a file from a predetermined domain. The domain may be any of the following:
3 g$ V7 w7 O% r" N9 p

kutsap.com
! _& s  C) K7 R; Q6 W/ wvxiframe.biz
) m, D. D/ R: s2 Asweetbar.com
) Y. k& _, v5 ^0 h3 A* Wtroyanov.net

) `2 |  R. D) |4 V
' I/ o$ n+ d6 K) V' Z) ^Saves the downloaded file and executes it. The file may have one of the following names:

# j+ p. F, C8 v+ \0 d8 `) }) l
[Current folder]\mhh.exe
: B( t: \  m2 r%UserProfile%\Desktop\mhh.exe
( i! L4 Y9 J5 ^( W3 L/ k  g%System%\web.exe
+ g/ B- ~8 |5 ~( D+ t3 t
* S& R; A& c! q! k$ Y9 ?# yNote:
[Current folder] is the folder where the Trojan was originally executed.
%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
( s# u: h, q8 }( I9 Z. q7 c

" g7 W3 {, b* J4 HEnds the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.

/ Q7 ~7 r; _4 y/ C+ z! O
清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

( V0 J( `* U! M, C% J) g8 o3 c1 yDisable System Restore (Windows Me/XP).
! k5 h- t5 p1 O5 d) HUpdate the virus definitions.
/ N, h$ v" i6 H5 nRun a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...


好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我