关于ANI病毒，安妮病毒的解决办法

=|HERO|=redone

高危!Windows ANI漏洞官方补丁下载 该漏洞名称为：GDI漏洞导致远程执行代码（925902），影响所有基于NT架构Windows系统，安全级别为高危级，建议所有用户立即更新。该补丁替代了06年发布的KB912919，微软本次同时发布了针对7种操作系统的补丁。 论坛发布的图片，链接均有可能让浏览者中招，只要没有打上微软新补丁，中招率接近100% # m; b# h2 F9 i9 u! t同时我们看到国外也有类似的情况出现： + z5 Z" G! c) E1 [. uMcAfee: TrendMicro: # m+ R0 Z" l& b相关链接： 2007-03-29 23:25 更新： 2007-04-04 09:03 更新： Microsoft Security Bulletin MS07-017 Vulnerabilities in GDI Could Allow Remote Code Execution (925902) , e3 B5 M6 [* c. _6 Y# k! Q

各版本操作系统补丁（KB925902）下载页面，均不需要正版验证： XP补丁 ; \/ _0 _" }4 Y- _微软恶意软件删除工具 VISTA补丁 . ?- G+ @6 }* T( Y+ x3 r9 r2003补丁 8 w# z& |9 x ~3 u0 X* X2000补丁

pwch

N年前就打过免疫器

* d! k/ a# X5 {- VN-1年前就打好了官方补丁
" Y( P: t" {2 P) n
) N' I5 [) F+ j- E: w当时偶发帖子还木有人理

=|HERO|=aodaod

哦哦！正在下

=|HERO|=Yuchuan

http://securityresponse.symantec ... 3724-99&tabid=2
+ A% E4 B# ]7 _, M" H/ @
病毒特征
The Trojan arrives as a malformed animated cursor (an .ani file). When a malformed .ani file is viewed using Windows Explorer or Internet Explorer, Trojan.Anicmoo.D performs the following actions:

Downloads a file from a predetermined domain. The domain may be any of the following:
/ \8 k$ S' |  m4 H, F
: [) L$ l7 t; t4 a2 E4 i) C
( g. {8 }( s1 l3 q" ^* tkutsap.com
vxiframe.biz
sweetbar.com
& V! o8 H0 k% s- @" otroyanov.net
, @! t1 a9 p6 Z2 G. v

9 A& T! _6 P# H1 ^" j! O9 Q) lSaves the downloaded file and executes it. The file may have one of the following names:

+ x5 R& }3 P/ [3 O& D% r2 [% n1 l
. o2 [& |0 W' I% u2 s: ^[Current folder]\mhh.exe
%UserProfile%\Desktop\mhh.exe
%System%\web.exe
4 u; Q$ h9 a5 L1 e
Note:
[Current folder] is the folder where the Trojan was originally executed.
( I. i* e! U' F/ x; u2 p- u5 p%UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- m  b. ^$ q* F) I) f# I
% y$ y- z4 l9 _' a# X. [
% W, u' a7 m) @( GEnds the Trojan processes after a period of time has elapsed. This period of time depends on the CPU speed and other environmental factors.


, {# G  J" n- W9 i, H清除方法
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

4 f) d0 u, a4 H: g# ]6 aDisable System Restore (Windows Me/XP).
( e( [' ]. z) i9 g" s8 @Update the virus definitions.
# u* }+ C: C8 D- g3 oRun a full system scan and delete all the files detected as Trojan.Anicmoo .

=|HERO|=HUMMER

o

=|HERO|=LonWang

顶...

9 d: j+ ~9 g4 z1 P+ v/ g
好像自动更新里面已经安装完了...

=|HERO|=YDE

有没有瘟98的补丁啊

quicksand1984

谢谢拉　红一大哥　你９了我