关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 * R, |% y( v* q/ B8 \2 I) d9 q* @论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 7 ~4 j. j/ N5 M' S$ ]. z+ I同时我们看到国外也有类似的情况出现： 8 W/ j, b X7 ]0 a$ e/ ?1 s5 ZMcAfee: / R5 b9 W7 G7 j% TTrendMicro: ! O) y% q% H0 E: |; [8 w. ^6 A8 q5 y6 ~相关链接： 1 W- Z& \. _# X1 X9 O2 W9 u; l2007-03-29 23:25 更新： 0 G( p9 P' n4 a3 b& P+ i/ E/ C7 T% @2007-04-04 09:03 更新： $ s; `% m* `% t+ n8 JMicrosoft Security Bulletin MS07-017 $ s6 L0 M: U/ m& B1 h; eVulnerabilities in GDI Could Allow Remote Code Execution (925902) 6 m! J+ C, Y! m% b$ D9 X0 ?" a

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： $ H. x% q6 l! L. f5 C% E5 ?XP补丁 微软恶意软件删除工具 VISTA补丁 ) X# u* t V# T; ?- Z; y' f2003补丁 : |& O" h" u) F/ r$ ?; t) Q2 g8 S' K2000补丁 * ~3 ]2 T4 R" `2 @5 ^ `% @

pwch

N年前就打过免疫器
- i" @8 J" d. [* t
: ^% n. p9 G) A/ q( g: k& TN-1年前就打好了官方补丁

- Z$ v4 e! m5 R7 Z. N0 `! n$ l当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

病毒特征
The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
' f3 r1 o. N) f6 j( h. e! }
6 I3 o& _( m% g0 s/ p  }9 U- KDownloads a file from a predetermined domain. The domain may be any of the following:


4 W+ `+ i* M7 z+ okutsap.com
! G. x6 Y1 W6 e3 R4 ~# ~! H; cvxiframe.biz
- v3 K  D0 W+ H" g( E$ _/ A* Ssweetbar.com
troyanov.net
8 ]' h! Y, w" m- ?
' P- E* {1 Y6 ~, k7 `( a+ S& t1 r
( r9 K2 c. O6 i3 Y+ u; HSaves the downloaded file and executes it. The file may have one of the following names:
; \5 H+ H" c( z/ z0 N* r

+ m, W! k: T( F$ W9 ^% U[Current folder]\mhh.exe
/ L' M% }8 b- b%UserProfile%\Desktop\mhh.exe
! X9 u3 X" ?# J* M! b* K" b%System%\web.exe

4 l% N# R/ _- i! g! K& RNote:
  W; D+ \9 C+ f[Current folder] is the folder where the Trojan was originally executed.
! ~, k% g! v- ~' J$ J%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


1 {7 c, W6 w% T/ |4 l9 B+ `Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
! k5 f. O  n! @8 H

4 s" D5 o5 P; Q) T8 H' b清除方法
+ o/ A& w1 N* S, q" k$ v: DThe following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

$ f0 h' O5 k# J' C) s& [! WDisable System Restore (Windows Me/XP).
Update the virus definitions.
, n, t5 z+ Z! d. Y* o0 _, IRun a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...
0 |  w0 m/ t8 X5 X

好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我