关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 G( F; v( t( m1 ^* _& O* z该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% - [: A$ R, i0 a) C/ q同时我们看到国外也有类似的情况出现： McAfee: TrendMicro: + Y* t1 Z# c0 P4 t/ f8 [相关链接： 2007-03-29 23:25 更新： 2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902)

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： / a- Y T' m+ H& IXP补丁 $ g! {, E% M- B; R6 `微软恶意软件删除工具 VISTA补丁 2003补丁 , z8 _8 H, f8 h4 ^ @" l2000补丁 * ~5 A3 A5 \- \- A6 L

pwch

N年前就打过免疫器
% Q* L# t# F1 b1 ]0 H1 F
N-1年前就打好了官方补丁

当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2
- [4 l4 `+ J0 n! _
病毒特征
2 T! E4 \4 B# ?* n. F0 J' GThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

6 K5 E$ @) v: |6 Q7 p2 DDownloads a file from a predetermined domain. The domain may be any of the following:
3 c4 I$ u6 w$ v, ^+ \9 D
  _) }: g5 n& g" d: O% ~6 o. C
& u1 G! w5 J/ B/ lkutsap.com
vxiframe.biz
0 L' ?9 `- w( U/ O3 Msweetbar.com
troyanov.net

7 U* ^) [4 v) i3 h" S& O; p
: ~( {; E6 b4 T) y1 B* \, DSaves the downloaded file and executes it. The file may have one of the following names:

3 D/ p* |; o9 a+ g% g
- H4 _* r" M, Y: ^4 w; N: X7 b[Current folder]\mhh.exe
%UserProfile%\Desktop\mhh.exe
4 j" \6 P" h3 h0 P%System%\web.exe
" l7 x% W# p+ i* l; p7 I6 T' T
7 ~$ ]$ ]7 V* v$ V0 H( PNote:
( e- T0 Y9 v; b[Current folder] is the folder where the Trojan was originally executed.
: b& W0 J2 J  ]* b+ c%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
! ]! l# [4 i- A
  c7 }& L' x- Q$ Q: [
清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
/ k& `6 C, ?# U! h; z
5 x7 e0 C( j1 r  v; |* X0 k6 _3 F% O4 ZDisable System Restore (Windows Me/XP).
6 P' @( z) f$ F8 c. Z# U; bUpdate the virus definitions.
. x$ f+ e3 J0 H/ Z4 ?Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...


好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我