关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% 同时我们看到国外也有类似的情况出现： McAfee: " v: n1 Y7 c0 M: o4 d8 s6 D4 FTrendMicro: * D/ _" e9 N2 l* @7 s' Q相关链接： 2007-03-29 23:25 更新： . `7 T' S0 Z4 a/ h! W: Z2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 3 y) S3 Q# Z5 p# _' J$ ^% _& ~Vulnerabilities in GDI Could Allow Remote Code Execution (925902)

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： # N: x- B! E5 j* n. n5 P) N; z8 PXP补丁 $ I: x7 ^: q) E$ U1 M# {) `微软恶意软件删除工具 ; p, ]5 a0 b; NVISTA补丁 2003补丁 2000补丁 " M9 v6 w4 O! N% J 1 G4 {# X5 v9 l

pwch

N年前就打过免疫器

) O6 m9 L  `* E" z3 y- sN-1年前就打好了官方补丁

3 a: L; p, R+ ]& L$ }4 a当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2
* [2 W* v  K# r4 j
病毒特征
. O; q3 ~. c! `! U3 y6 @/ rThe Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

3 V2 W, ]0 [2 c: O- tDownloads a file from a predetermined domain. The domain may be any of the following:
& J( p! M9 H7 w. v) J) S
9 P* b, N, M% H. c' j9 s
3 O  s) u( Q& d; H$ }9 ]kutsap.com
* E  C. x0 v+ n. h: z, uvxiframe.biz
sweetbar.com
% X! O( T, T) j6 q+ W/ D0 I8 Qtroyanov.net
8 d+ i9 P; S6 L5 i2 z

" P) S* f( g5 u$ @- oSaves the downloaded file and executes it. The file may have one of the following names:
2 P. a: b& E6 ]' e7 ]: ~, W
6 R. y7 F2 p, i% V, v4 p$ H1 l5 J% z+ c: o
9 F( B+ j& ^( ]9 _. z7 ?[Current folder]\mhh.exe
" ~1 M! @0 A" b, @6 W%UserProfile%\Desktop\mhh.exe
%System%\web.exe
! b% b3 u4 U' v5 s& f! T, f  R
1 h% p  h2 w2 PNote:
[Current folder] is the folder where the Trojan was originally executed.
& ^: Q3 \# e& P%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

. a4 e  C$ a2 l* W: S9 b% R
Ends the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.
7 X& T* B. L7 C9 I
  g  B4 u- q9 u$ Y
清除方法
* x6 G2 W, s, r2 P8 Y6 a; I8 R* RThe following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...
, F% g- T3 B2 ~% Q' ^4 |% F

1 `, |/ M# j6 P4 o1 X好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我