ANI-virus

"David H. Lipman" <DLipman~nospam~@Verizon.Net> schreef in bericht
news:k%bXh.8299$Fs6.3825@trnddc03...
> From: "Jan Smit" <ft1370nospam.RemoveThis@hotmail.com>
>
> | How can I delete the Exploit.Win32.IMG-ANI.gen virus?
> | Thanks,
> | Jan
>
>
>
> It is NOT a virus. It is Exploit code.
> It isn't even an EXE, DLL or other binary file so just delete it !
>
> Can I take a guess that this is a JPG file of less than 1KB ?
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm

No, I even can't find the file. My virusscanner did recognize the file, put
it in quarantaine and that seems OK. But after a few hours it came back.
Jan
>
>
>
 >> Stay informed about: ANI-virus 

From: "Jan Smit" <ft1370nospam.DeleteThis@hotmail.com>

|
| No, I even can't find the file. My virusscanner did recognize the file, put
| it in quarantaine and that seems OK. But after a few hours it came back.
| Jan

It is Exploit Code and they "don't come back" you got it by re-visiting a web site or
re-reading email that had this exploit in it.

Please post extracts of the log file of your un-named virus scanner.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
 >> Stay informed about: ANI-virus 

"David H. Lipman" <DLipman~nospam~@Verizon.Net> schreef in bericht
news:Z3SXh.2151$Wa.1874@trnddc08...
> From: "Jan Smit" <ft1370nospam.DeleteThis@hotmail.com>
>
> |
> | No, I even can't find the file. My virusscanner did recognize the file,
> put
> | it in quarantaine and that seems OK. But after a few hours it came back.
> | Jan
>
> It is Exploit Code and they "don't come back" you got it by re-visiting a
> web site or
> re-reading email that had this exploit in it.
>
> Please post extracts of the log file of your un-named virus scanner.
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm



Dave, thanks for your answer.
I use Kaspersky Anti-Virus 6.0:

quarantined: malware Exploit.Win32.IMG-ANI.gen (modification) File:
C:\Documents and Settings\Paul\Local Settings\Temporary Internet
Files\Content.IE5\EFIALQHZ\xpsp2_2180[1].jpg

detected: malware Exploit.Win32.IMG-ANI.gen (modification) URL:
http://zert.isotf.org/tests/xpsp2_2622.jpg

deleted: malware Exploit.Win32.IMG-ANI.gen (modification) File: C:\Documents
and Settings\Paul\Local Settings\Temporary Internet
Files\Content.IE5\XRKUON1J\xpsp2_2622[1].jpg
 >> Stay informed about: ANI-virus 

From: "Jan Smit" <ft1370nospam RemoveThis @hotmail.com>

|
| Dave, thanks for your answer.
| I use Kaspersky Anti-Virus 6.0:
|
| quarantined: malware Exploit.Win32.IMG-ANI.gen (modification) File:
| C:\Documents and Settings\Paul\Local Settings\Temporary Internet
| Files\Content.IE5\EFIALQHZ\xpsp2_2180[1].jpg
|
| detected: malware Exploit.Win32.IMG-ANI.gen (modification) URL:
| http://zert.isotf.org/tests/xpsp2_2622.jpg
|
| deleted: malware Exploit.Win32.IMG-ANI.gen (modification) File: C:\Documents
| and Settings\Paul\Local Settings\Temporary Internet
| Files\Content.IE5\XRKUON1J\xpsp2_2622[1].jpg
|

So this wasn't truly malware. It was a proof of vulnerability test URL that had an ANI
Exploit in a JPG file. The JPG was then found in the cache.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
 >> Stay informed about: ANI-virus 

"David H. Lipman" <DLipman~nospam~@Verizon.Net> schreef in bericht
news:Mo8Yh.4630$A72.1361@trnddc07...
> From: "Jan Smit" <ft1370nospam.RemoveThis@hotmail.com>
>
> |
> | Dave, thanks for your answer.
> | I use Kaspersky Anti-Virus 6.0:
> |
> | quarantined: malware Exploit.Win32.IMG-ANI.gen (modification) File:
> | C:\Documents and Settings\Paul\Local Settings\Temporary Internet
> | Files\Content.IE5\EFIALQHZ\xpsp2_2180[1].jpg
> |
> | detected: malware Exploit.Win32.IMG-ANI.gen (modification) URL:
> | http://zert.isotf.org/tests/xpsp2_2622.jpg
> |
> | deleted: malware Exploit.Win32.IMG-ANI.gen (modification) File:
> C:\Documents
> | and Settings\Paul\Local Settings\Temporary Internet
> | Files\Content.IE5\XRKUON1J\xpsp2_2622[1].jpg
> |
>
> So this wasn't truly malware. It was a proof of vulnerability test URL
> that had an ANI
> Exploit in a JPG file. The JPG was then found in the cache.
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
OK, but I still have an animated cursor and red vertical lines on my
monitor! I got the advise to try the above mentioned site to clean the
infection.
 >> Stay informed about: ANI-virus 

From: "Jan Smit" <ft1370nospam DeleteThis @hotmail.com>


| OK, but I still have an animated cursor and red vertical lines on my
| monitor! I got the advise to try the above mentioned site to clean the
| infection.
|

You have an animated cursor because you CHOSE to have an animated cursor!

I have no dea why you have a red verticle line on you monitor. If it is a LCD monot it may
be going bad.

As for the http://zert.isotf.org web site, it is NOT an anti virus/malware site and will not
clean an infection. It is a site in Computer Security (COMSEC) and often has demonstation
URLs that are based upon epxploitation coding but does not have a payload. That means you
can test to see if your software/OS has a tested vulnerability or not.

If you are worried you are infected, started by performing a xcomplaete scan of the entire
system and all files using your Kaspersky AV software.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
 >> Stay informed about: ANI-virus