关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 同时我们看到国外也有类似的情况出现： - Z9 |" C3 X# x# l( uMcAfee: TrendMicro: 相关链接： 8 M8 Z/ s& }8 j" v: M/ g2007-03-29 23:25 更新： 8 O6 n9 a( S# E% o' O" A8 s1 H! J2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 : m! J2 V- n% qVulnerabilities in GDI Could Allow Remote Code Execution (925902)

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 微软恶意软件删除工具 9 X( W. X' D# `5 ?% }7 D: N% O! yVISTA补丁 2003补丁 $ ], x' e! s: r0 s: Z2 o# T6 Z2000补丁 9 a# ^# u/ i/ s* l* l& K% [. _; G ! M$ J7 A% o" T# I7 N0 S: J, K. B5 l

pwch

N年前就打过免疫器

N-1年前就打好了官方补丁

3 t* a8 v1 p4 }+ L8 f当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2
  q+ e8 n$ P7 p+ s- M, \8 U
& x, w+ a# h& U1 I( @$ H病毒特征
" M& P& u3 h( r( }$ F8 a! LThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
5 Y$ i- S) o6 c" {/ c9 {
Downloads a file from a predetermined domain. The domain may be any of the following:

- g9 I5 ?( R- K  a' ~& Q, }
' ], j6 S8 I; ckutsap.com
) w4 W, ?2 o& W7 A0 Qvxiframe.biz
sweetbar.com
troyanov.net
% |  t5 u8 L# U7 n
7 f( t$ b$ }+ K7 X, Y
; J! F" [$ w# X! CSaves the downloaded file and executes it. The file may have one of the following names:


" {8 n- Y9 T7 M* r( H+ v2 B+ @, w[Current folder]\mhh.exe
8 W$ U7 L. r) K4 i( }  @%UserProfile%\Desktop\mhh.exe
* C2 E2 v7 Y) E- s/ t8 v%System%\web.exe

Note:
0 u# \: R: _  A2 e5 @[Current folder] is the folder where the Trojan was originally executed.
- i4 f! o, z2 s' ?7 M# m* C: S, d3 ?%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
2 l  M1 s3 \, r. W8 |  j%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  X& v# Z& b) d- k
/ M+ g. R4 y' n0 }3 r+ R2 V, r
Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
5 U+ e+ E7 s- k- \, z2 m% m# p
% T9 v8 ?0 ~% d; P1 \: t
清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
. {. d# k$ p0 a2 {' ]) xUpdate the virus definitions.
' z' K0 x( ~. G6 R( ]Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...


好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我