关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% ; x9 x3 G2 s$ f+ |$ S8 p7 X- b) b同时我们看到国外也有类似的情况出现： & L: o; {; h5 M6 C- M) P8 OMcAfee: TrendMicro: 相关链接： 9 ?9 }7 K: E# j$ \2007-03-29 23:25 更新： . C* y7 \! C, b# c7 O# Y2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902)

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 " f4 x) ^( y+ a! }5 X' V' \微软恶意软件删除工具 ! ~8 s' e% h/ K! C" T$ P4 |- F, vVISTA补丁 1 x4 \4 Z; N* P2 }: _2003补丁 2000补丁 " N8 E, ]+ B( A8 p + L1 v" y* X6 i5 Q; N. A; F7 ]( d

pwch

N年前就打过免疫器
2 m7 ~, X: ~0 O2 b% Y2 G9 m3 E
/ Q  ^$ S" F3 G( k' n. U" xN-1年前就打好了官方补丁

0 e6 k+ ^+ C% l4 X- \3 }当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

: X& e# u+ F6 m7 m病毒特征
The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
. ~* O2 O) d; c4 ?) i" ~
+ [) k. _$ m  S, D' `, `Downloads a file from a predetermined domain. The domain may be any of the following:
9 Z& p1 U& h  T; s$ M. }2 f
* x3 y( ?2 i# o/ S4 d1 P0 n
kutsap.com
: w: Z2 a: [) O2 P) L% |$ P; nvxiframe.biz
$ Z. f+ T2 ]5 Z4 p4 Hsweetbar.com
troyanov.net
. r, V9 x& j& a: Y( D

2 p1 C/ |8 l0 D" gSaves the downloaded file and executes it. The file may have one of the following names:

; l9 v: \! x/ q2 v1 T) {/ B) x: X
: U% X5 b, W5 E, @5 w) e[Current folder]\mhh.exe
%UserProfile%\Desktop\mhh.exe
) R3 w$ E* M5 p: ]5 R. d& _. Y! E: p! G  f%System%\web.exe
) s, f/ i2 u  L4 L
Note:
) V9 j- n5 N) G* u3 E. \6 l" Y0 k[Current folder] is the folder where the Trojan was originally executed.
+ Y9 j, \$ h1 C  t%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
) z" y% h# O% }  G2 a%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

; Z3 T; s% D; z# q$ f
Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.


6 @7 w4 L+ n1 H: g9 s清除方法
% |  J9 W! t( ^' J4 i: M" ^) iThe following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
+ j& _! S# Q0 V
Disable System Restore (Windows Me/XP).
* l- x' S& C; ^3 O; o: q3 n, m( oUpdate the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...
  h1 G' k4 l3 K  b
. E* z! O* x' b7 g7 D
) z/ K; j* d" N; B8 W8 ^, c好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我