Hi Im new to the forum but have been using Spybot Search and destroy for years it isnt the only Spyware removal tool I use but I still think its one of the best.
I`m hoping that my recent email containing the infected files will be added to Spybot detections and have created a small tool for Manual removal of this now I know what it is Etc Basically search your system32 dir for the file Ntos.exe if its there close the handles using Process Explorer
Open Process Explorer and select winlogon.exe (in the upper pane).
In the lower pane, look for the following files and close their Handles (by right clicking over it)
%windir%\system32\wsnpoem\video.dll
%windir%\system32\wsnpoem\audio.dll
%windir%\system32\ntos.exe
then delete the affending files Manually
these files can cause SVCHOST to crash
Cause problems in USERINIT
and in EXPLORER
they sent packets to Easyglimor.info, and a few others I blocked them initially firewall rules but couldnt locate the files causing the packets Hope this might help !