Manually remove Trojan algssl.exe

Open your Task Manager, if you see a "Form 1" application running all the time, and it is algssl.exe process. Yes, it is a Trojan. Apparently it is a Chinese community thingy. I am not sure how did I get it, but apparently Norton and other anti-virus thing cannot remove it completely. So you have to do it manually.

Most of the online explanation is in Chinese, so I am writing an English one, for people who don't know Chinese but got this Chinese Trojan on their computer.

Step 1:
Kill the algssl.exe process

Step2:
Go to C:\Windows\System32\
Delete algssl.exe, msime80.exe, and msfir80.exe

Step 3:
Edit Registry (run regedit)
Go to:
HKEY_LOCAL_MACHINE\
SOFTWARE\
Microsoft\
Windows\
CurrentVersion\
Explorer\
Advanced\
Folder\
Hidden\
SHOWALL

Delete CheckedValue
Recreate a DWORD CheckedValue with Value = 1

Step 4:
If you are using XP, you probably can turn on "show hidden files" and search for autorun.inf, tel.xls.exe (or sal.xls.exe). All located at the top level of the hard drive (i.e. C:\, D:\, E:\, F:\, G:\...so on) should be removed. Note that your external/pluggable hard drives maybe affected as well, so plug in and do the search and delete for them.

If you are using Vista, unfortunately "show hidden files" is not doing the trick. What I did was using command prompt. You can list hidden files with
C:\>dir /AH
and delete them with
C:\>del /AH autorun.inf
C:\>del /AH sal.xls.exe

*If any of your hard drive was not cleared with these files, when you double click the drive to explore it, the same Trojan would be installed again. So when you switch between drivers, do not double click to explore. You can type E: for example in your explorer bar.

Step 5:
Go back to regedit, go to:
HKEY_LOCAL_MACHINE\
SOFTWARE\
Microsoft\
Windows\
CurrentVersion\
Run

and

HKEY_CURRENT_USER\
Software\
Microsoft\
Windows\
CurrentVersion\
Run

to remove anything with msime80.exe or msfir80.exe.

Step 6:
I don't have to do this step but apparently some people do. Run msconfig, go to Start Up and remove anything with msime80.exe or msfir80.exe.

Restart your machine, everything should be OK now.