Hi,
Ok, most of the "bad" files are gone. Please download L2M9XFix (http://swandog46.geekstogo.com/l2m9xfix.exe) and extract it to a folder. Now, inside this extracted folder, there will be a file...

Hi,
Those files are still there! Now, we have to remove them manually! Open a new file in NotePad and copy the contents of the below "Quote" box to NotePad:-

In NotePad, go to File Menu > Save AS...

Hi,
The Look2Me DLLs are still there. Please download Kill2Me (http://download.bleepingcomputer.com/Merijn/kill2me.zip) and extract it to a folder. Next run Kill2Me.exe and follow the onscreen...

Download KillBox (http://www.bleepingcomputer.com/files/spyware/KillBox.zip), extract it to your desktop.

Run KillBox.exe and check the following box:-
Delete on Reboot

Highlight all the...

Hi,
Please download the 2-week trial version of WebRoot SpySweeper from HERE (http://www.webroot.com/shoppingcart/tryme.php?bjpc=64011&vcode=DT14&WRSID=f7ac6027d5a39c97794291a8547bee72).
Alternate...

Hi,
Open NotePad and copy the contents of the below "Quote" box to it:-

In NotePad, go to File Menu > Save AS and type the filename as Test.BAT and save the file in any desired location. Exit...

Hi,
Log looks clean :) Do you get any alerts from Windows Defender now?

Hi,
Perform an online virus scan at Kaspersky Online Scanner (http://www.kaspersky.com/virusscanner) (Click the "Kaspersky Online Scanner" button). Save the log it gives after the scan.

Run...

Hi,
No, Kaspersky Online Scan doesn't provide the removal facility. But, it's one of the best scanner out there.


Reboot in Safe Mode:-
Restart (or switch ON) the PC. Then, keep tapping the F8...

Hi,
Glad to hear that everything's alright now :D Actually, that "red circle with cross" in System Tray and the changed wallpaper are due to the Smitfraud/Spyfalcon family of malware. When you see...

Hi,

Right-click HERE (http://www.bleepingcomputer.com/files/reg/smitfraud.reg) and choose "Save As" (or "Save Link As" or "Save Target As") option and save the file. Save the file with its default...

Hi,
Let's try a different program. Download roguescanfix_setup (http://users.telenet.be/Beamerke/tools/roguescanfix_setup.exe).

Doubleclick roguescanfix_setup to install it.

After the...

Hi,
Download XP_FIX (http://www.visualtour.com/downloads/xp_fix.exe) and save it on Desktop. Next, run it to fix the "NTVDM....16 bit subsystem" error.


After this, reboot your computer in Safe...

Hi,
Download CCleaner (http://www.filehippo.com/download_ccleaner.html) and install it. Do not run it now!

Download and install Ewido Security Suite v3.5 (http://www.ewido.net/en/download/)....

Hi,
It's LOP spyware. Download HijackThis (http://www.merijn.org/files/hijackthis.zip) and unzip it to dedicated folder (like C:\HijackThisFolder\hijackthis.exe).
Then run it and click the button...

Hi,
Let's fix the background issue now! Reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the...

Also, after doing above mentioned steps, please download SmitfraudFix (http://siri.urz.free.fr/Fix/SmitfraudFix.zip) (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
...

Hi,
Download CCleaner (http://www.filehippo.com/download_ccleaner.html) and install it. Do not run it now!


Please download The Avenger (http://swandog46.geekstogo.com/avenger.zip) by Swandog46...

Hi,

No need to remove this entry!


Please remove the other entries in Safe Mode.

And, after the reboot, download WinPFind.ZIP (http://www.bleepingcomputer.com/files/winpfind.php) and...

Hi,
Download CCleaner (http://www.filehippo.com/download_ccleaner.html) and install it. Do not run it now!


Make Windows to show all files:-
Go to Start > My Computer. Go to Tools menu, click...

Hi,
Go to Start > Run and type services.msc and press ENTER. Here, navigate to the service named NVIDIA Driver Helper Service (nvsvc32.exe) and right-click on it. Then click "Properties". Here, in...

Hi,
NvCplDaemon related to Nvidia graphics cards. Here's a short description:-


Source:- http://castlecops.com/s2547-rundll32_exe_NvQtwk_dll_NvCplDaemon.html

Hi,
CCleaner can take care of those Tracking Cookies. But, do run Ewido or Antivirus scan regularly. I will mark this topic as "Solved" then :D

Hi,
Cookies are not a major spyware threat. They are used by online advertisement services and some websites to "remember" the user's preferences. They can be deleted from within the web browser's...

Hi,
Good to hear that the Desktop background is back to normal :) . Now, to remove some "bad" files.


Open Killbox.exe. Check the following box:-
Delete on Reboot
Highlight all the entries in...

Hi,
Right-click on this link (http://www.bleepingcomputer.com/files/reg/smitfraud.reg) and click "Save Target As" (or "Save Link As") and save the file with the default filename (default filename...

Hi,
Glad to hear that everything's working fine :) Yes, the files alcrmv.exe, alcupd.exe are "relatives" of Alcxmntr.exe. Actually, all these files are related to RealTek Audio driver. But,...

Hi,
There's only one entry to be removed now. Run HijackThis and select the below mentioned entry:-

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

And click "Fix Checked".

Next, delete this...

Hi,
Download CCleaner (http://www.filehippo.com/download_ccleaner.html) and install it. Run CCleaner, click "Options" button and here go to "Advanced" tab and uncheck the option "Only delete files...

Hi,
Download KillBox (http://www.bleepingcomputer.com/files/spyware/KillBox.zip), extract it to your desktop.

Download Hosts.zip (http://www.mvps.org/winhelp2002/hosts.zip) file and save it in a...

And, by the way, that O20 entry is related to Intel Graphics driver and is legitimate. And, Lich.exe is a spyware, we will remove it later :)

Hi,
Perform an online virus scan at Kaspersky Online Scanner (http://www.kaspersky.com/virusscanner) (Click the "Kaspersky Online Scanner" button). Save the log it gives after the scan.

Download...

Hi,
Go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" or "Desktop Uninstall" if present.

Perform an online virus scan at Kaspersky Online Scanner...

Hi,
Log looks clean :) To prevent such infections in future, you can visit this page (http://wiki.castlecops.com/Malware_Prevention:_Prevent_Re-infection). Shall i mark this thread as "Solved"?

Hi,
Can you post a new HijackThis log? Just to make sure that everything's all right!

Hi,
Using KillBox, delete this file:-
C:\WINDOWS\system32\avpe64.sys
Copy the above text and paste it in the "Full path of file to delete" text box in KillBox and select the "Delete on reboot"...

Also, please post back whether you getting any popups or not..

Hi,
Run Webroot SpySweeper and update its definitions. Please download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune.


Please boot the PC in Safe Mode.

Double-click...

Hi,
There are some traces of malware, that we should remove now. Download CWShredder (http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe).


Next, boot in Safe Mode.


Run...

Hi,
Download CCleaner (http://www.filehippo.com/download_ccleaner.html) and install it. Do not run it now!

Download KillBox (http://www.bleepingcomputer.com/files/spyware/KillBox.zip), extract it...