关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 3 C2 B) V; w# l' G' \+ q论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% : {1 l0 {( }6 r* _3 Z$ }. F同时我们看到国外也有类似的情况出现： % b4 ^$ E _& i3 x1 v2 UMcAfee: TrendMicro: 8 O! _ J2 y& f8 O6 Q: e5 c% P! }4 T相关链接： . I1 k) b1 d/ {$ j8 X5 a6 F2007-03-29 23:25 更新： 2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 3 Z* w3 e3 s0 _' RVulnerabilities in GDI Could Allow Remote Code Execution (925902) ! L9 w: D6 w8 g, k" f7 d: C

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 微软恶意软件删除工具 0 q" |1 K, u3 B' t9 P+ `VISTA补丁 2003补丁 " Q! N8 W) P2 ` \8 e4 f% y' V+ v2000补丁

pwch

N年前就打过免疫器

" u& x1 g- q* L+ c- cN-1年前就打好了官方补丁
3 p' J# k: U! L- }
6 I% H3 F! h* a4 q当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

病毒特征
( M( }% d: H! _6 s/ KThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
6 o4 [6 j0 T) T3 I( X2 K
3 r9 e/ J; X" TDownloads a file from a predetermined domain. The domain may be any of the following:

6 P" y7 X) n, y* `+ Z
kutsap.com
4 m  d% R8 o! L" ^$ V/ vvxiframe.biz
4 A+ X. P! n7 tsweetbar.com
* K3 b% M# S( D5 W) X) k% m7 Rtroyanov.net
) D5 e1 F( \1 j' |3 S8 u$ _
) j* B- q6 E: a) A# R' r9 U
4 m( F( c) F/ K, w/ E; _. g0 QSaves the downloaded file and executes it. The file may have one of the following names:

; X; K5 q# ^6 J0 e+ w
) {9 |4 h" @% c. \& h# r5 d4 m[Current folder]\mhh.exe
%UserProfile%\Desktop\mhh.exe
%System%\web.exe

Note:
- A1 k1 \* p, z& r+ g[Current folder] is the folder where the Trojan was originally executed.
%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- L0 `, f$ l, r" a9 s9 b# S# ~
* B$ @# q3 i% I" v, x$ @' `* z
Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
) a" V5 m% |9 E
6 D  q  R& L6 ^6 }3 A* i7 A% k
5 K- n+ p  ~* R+ [* v, U清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
. w& N: O, q7 y2 Q0 T) z# IUpdate the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...


好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我