关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 4 A6 M m1 I. e. N同时我们看到国外也有类似的情况出现： + F' F7 U+ W: i6 QMcAfee: TrendMicro: % [. a- a3 t* Y2 i# O$ V! F相关链接： 2007-03-29 23:25 更新： 2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 ) m: n- [' u- D) W. {Vulnerabilities in GDI Could Allow Remote Code Execution (925902) ' e1 B2 J" H: ]7 f$ [. `

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 : |& p& u2 L) m; O/ y% k; J微软恶意软件删除工具 VISTA补丁 2003补丁 2000补丁 $ m3 ~5 d) T( p P' Q , _" U4 T7 N c7 q+ r' U

pwch

N年前就打过免疫器

, E/ g  s8 Y5 n; I; ON-1年前就打好了官方补丁
* e4 D3 K8 q6 T6 R9 t0 X$ a
$ T% p9 {+ [) ^1 U; N$ p. I* ~当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2

病毒特征
9 D* c+ V/ X% u" m. i8 yThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:
1 J7 o  w1 k7 {+ }
; g- }: Y4 c; u8 u: S2 g& D' D4 P! fDownloads a file from a predetermined domain. The domain may be any of the following:
) g* I" q  x  U- u
! x2 K* h; x0 i' ]) e
kutsap.com
2 r" @; O/ E/ P3 t) F+ nvxiframe.biz
8 C- T; D: D/ y1 lsweetbar.com
5 D6 i# S3 y3 K& V+ ^& q  Z) i, o% [troyanov.net
; j6 ~2 ]0 k& r% Y: }) L( ~" |0 k8 W

, ]9 F# ]& s) m8 cSaves the downloaded file and executes it. The file may have one of the following names:


* k8 A  U0 h$ X5 ~7 `. x[Current folder]\mhh.exe
1 y3 P# x0 D! K%UserProfile%\Desktop\mhh.exe
%System%\web.exe

& p4 w2 ]1 S, F1 e5 dNote:
9 ^' H* e% l' C5 d, |' J( B5 H[Current folder] is the folder where the Trojan was originally executed.
! u# H. J5 w7 z4 O# y%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
& U' A% l( |+ [2 {& S, U0 u7 _% f

Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.


6 _5 f4 W! F! x# `  L5 l清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
& X3 Y5 T' N, j1 l
Disable System Restore (Windows Me/XP).
- S4 e. d: b5 i  Q. A% G0 z, EUpdate the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...
# Q. l/ O0 b$ w4 b) X% U/ N' d
6 y9 a6 s$ W! W0 g. y# z3 ?
6 N* m- H! m+ l5 \& j& x好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我