今天我在http://mtv0.51.net/下载的传世外挂用瑞星发现病毒了！杀不掉啊！怎么办啊！
救救我吧！就是这个网址的传世外挂病毒。在线急求高手！多谢多谢多谢！

刚才我看瑞星日志了这个病毒叫Trojan.PSW.Lmir.ip
用什么才能查杀啊？救救我吧！

Trojan.PSW.Lmir.ip
破坏方法：此病毒启动后将自己安装在系统目录下，修改注册表，添加一下的键值
1    HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
"ws_d" : %windir%\ws32.exe

2    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\RunServices
"ws_d" : %windir%\ws32.exe
并且还会修改系统的配置文件system.ini如下：
SYSTEM.INI
[BOOT]
"SHELL" : Explorer.exe %windir%\ws32.exe
利用这些修改达到自动启动运行的目的.
此病毒在后台隐藏运行，在内存中搜索游戏的进程和窗体，窃取游戏的帐号并且通过网络以邮件的方式将
窃取到的游戏的帐号发送出去。
用杀毒软件杀完毒之后再用：运行---MSCONFIG---修改一下SYSTEM。INI文件；然后再用运行---REGEDIT---查找WS32。EXE---然后逐个删除，应该就没问题了

你好，谢谢啊，不过我在注册表里没找到
"ws_d" : %windir%\ws32.exe
1 HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run下只有3个1。默认 2。ctfmon.exe 3。MSMSGS

2 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\RunServices下只有一个默认

SYSTEM.INI也没有ws32.exe
怎么回事啊？拜托了！谢谢谢谢！

你用hijackthis扫描传上来，让大家帮忙看看吧

下面是我用hijackthis扫描，帮忙看看吧，谢谢
Logfile of HijackThis v1.99.1
Scan saved at 22:54:25, on 2005-7-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\瑞星\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\webUp.exe
C:\WINDOWS\Explorer.EXE
d:\瑞星\rfw\RfwMain.exe
D:\瑞星\RAV\RAVTIMER.EXE
D:\瑞星\RAV\RAVMON.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
D:\瑞星\RAV\CCENTER.EXE
D:\瑞星\RAV\Ravmond.exe
C:\WINDOWS\System32\svchost.exe
D:\瑞星\RAV\RavStub.exe
C:\WINDOWS\system32\wscntfy.exe
H:\chadu\HijackThis.exe
D:\金山快意\FastAIT.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\webUp.exe,
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - H:\qq\QQIEHelper.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - D:\下略载豛\Net Transport\NTIEHelper.dll (file missing)
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - D:\金山快意\IEBand.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [RavTimer] D:\瑞星\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RfwMain] "D:\瑞星\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavMon] D:\瑞星\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe C:\WINDOWS\system32\hookdll.dll,ExecFilter solo
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: 使用影音传送带下载 - D:\下载\NETTRA~1\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - D:\下载\NETTRA~1\NTAddList.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\0ffice\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - H:\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - H:\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - H:\qq\SendMMS.htm
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\0ffice\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - H:\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - H:\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - H:\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - H:\qq\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0157cbab88dc9530c902/netzip/RdxIE601_cn.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121481072703
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {E16EB0D0-45DC-4C8F-904C-BCFBA968B6D2} (WebupDLL Control) - http://www.tracq.net/update/webupDll.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C7DFE07-F916-43C0-82B4-9D71DFD49357}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{90F749A8-791E-4F9D-B5BB-9F6960A682DE}: NameServer = 202.102.152.3 202.102.128.68
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\瑞星\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\瑞星\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\瑞星\RAV\Ravmond.exe