tagged the worm as Fubalca, while other security companies - no surprise here - applied different monikers. China's Internet Security Response Team (CISRT) warned over the weekend that a worm exploiting ANI was in the wild.

Nope.Īre hackers using the vulnerability? Funny. What about Linux or Mac systems? Are they at risk, too? Hahahahahaha. Both 32- and 64-bit versions are at risk. What versions of Windows are vulnerable? This is the cropper, isn't it? One of the things that makes the ANI bug so dangerous is that it affects every still-supported edition of Windows, including Windows 2000 SP4, XP SP2, Server 2003 (up to SP2), and even Vista. It wasn't until last week - March 28, to be exact - that attacks using the exploit were spotted in the wild (by McAfee) and reported to Microsoft's Security Response Center (MSRC). says it was first notified in late December 2006 by researchers at Determina Inc., but others - including Marc Maiffret of eEye Digital Security - point out that the vulnerability is very similar to one patched in January 2005 that also affected cursor files. Exploits targeting the bug can use ANI files to run malicious code on a victimized PC, infecting it with spyware, stealing identity information or adding it to a botnet of hijacked systems. Microsoft, for example, sometimes includes animated cursors in its optional visual theme downloads. dll that loads animated cursor (.ani) files, which are used to trick out the cursor, changing it from a simple pointer to a short animation. What's the problem, anyway? A critical flaw in User32.dll, specifically in the code of that Windows.

This FAQ on the flaw, explains what it is, which machines are at risk and what you can do to protect yourself. IT staff, small business users and consumers have been trying to figure out which way is up, and whether this is a Big Deal or just another security industry siren blaring in the background. Witness the so-far short-lived flaw in Windows' animated cursors (ANI), which picked up enough steam over the weekend to power a turbine or two. When a major vulnerability affecting every flavor of Windows - including Vista - breaks, it only seems like chaos ensues.

Animated windows cursors