关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 同时我们看到国外也有类似的情况出现： McAfee: 4 M; d6 e& ~$ r9 p; r, i. Y3 }TrendMicro: 相关链接： ! Z( u8 S9 c2 v: T2 V2 _2007-03-29 23:25 更新： 2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 ; O2 K' J# l9 j/ ?Vulnerabilities in GDI Could Allow Remote Code Execution (925902) " a5 [/ Z* L' q( |

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 ! m$ B5 M, z$ U" B微软恶意软件删除工具 VISTA补丁 2003补丁 # F3 o' g3 Z8 D3 f& _2000补丁 : m: Y: `6 Q9 h& p& n* s* p ~

pwch

N年前就打过免疫器
* Q+ H" o: `1 n7 ]) [/ e
N-1年前就打好了官方补丁
  h+ h  a3 p, H/ b/ Y
当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

& ^, f8 U; G" q4 p1 R0 W+ o病毒特征
8 E, x4 B& h' \& CThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

9 K7 R8 }: q) H4 GDownloads a file from a predetermined domain. The domain may be any of the following:
) r# J! y0 k& E. Q; r; G

kutsap.com
! S8 p- L* k4 e1 F9 U5 H+ \% f' \1 vvxiframe.biz
0 u5 V  G" N" |  e. b; |3 ?8 m6 xsweetbar.com
/ h; w: N* F$ Ztroyanov.net


5 M! W' j" L) O/ x: v1 bSaves the downloaded file and executes it. The file may have one of the following names:

' k6 R. z6 j; W4 S  C
[Current folder]\mhh.exe
%UserProfile%\Desktop\mhh.exe
& r6 P8 D1 i7 r) d3 B5 q+ V+ S%System%\web.exe
6 m. Y$ M; |  M$ c7 b
3 G7 ^2 @: U5 s) `; mNote:
[Current folder] is the folder where the Trojan was originally executed.
%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
4 L7 T4 \7 R7 Z%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
* m! h+ e" k/ a" C4 {

Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
( ?+ B# d6 ~. }+ ?) [, m; \& @3 w

清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
- k1 W9 ~& V, `) h9 C; ~$ i
Disable System Restore (Windows Me/XP).
Update the virus definitions.
( j( K. n% z" p1 u/ m+ o( [0 ZRun a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...


  S/ H& P! U" b3 C好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我