This Looks like what you have it is a network worm so that is how it spreads through the network the only difference is the letter this one is (BVK) and yours is (BKV) I'm sure they do the same thing, you can see all the registry changes it makes, and it appears to disable some software and then tries to connect to a server. W32/Sdbot-BVK is a worm and IRC backdoor Trojan for the Windows platform. W32/Sdbot-BVK can spread via network shares protected by weak passwords, or by exploiting common vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), and ASN.1 (MS04-007). W32/Sdbot-BVK runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. W32/Sdbot-BVK includes functionality to access the internet and communicate with a remote server via HTTP. When first run W32/Sdbot-BVK copies itself to \netbtd.exe. The file netbtd.exe is registered as a new system driver service named "NetBTD", with a display name of "NetBTD(ntbtd)" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under: HKLM\SYSTEM\CurrentControlSet\Services\NetBTD\ W32/Sdbot-BVK sets the following registry entries, disabling the automatic startup of other software: HKLM\SYSTEM\CurrentControlSet\Services\Messenger Start 4 HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry Start 4 HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr Start 4 Registry entries are set as follows: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotAllowXPSP2 1 HKLM\SOFTWARE\Microsoft\Ole EnableDCOM N HKLM\SYSTEM\CurrentControlSet\Control\Lsa restrictanonymous 1 Registry entries are created under: HKLM\SOFTWARE\Microsoft\Security Center\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\ RSS:Atom Get reports on the latest virus threats delivered to your computer

Sorry to have to post this here; I am still unable to register at Landzdown. If someone could post this over there, I'd appreciate it very much. I completed the instructions, and had just copied the combofix log and was about to post it here when the screen suddenly went black and then the blue screen came on. It says: A Problem has been detected and windows has been shut down to prevent damage to your computer. BAD_POOL-CALLER If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps: Check to make sure any new hardware or softwar is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows jupdates you might need. If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F to select Advanced Strtup Options, and then select safe mode. Technical information: *** STOP: 0x000000c2 (0x00000007 , 0x00000CD4 , 0x000016EB, 0x81795430) Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group for further assistance. I just typed all of that here (I'm on a different computer) and the blue screen is still up, and the computer is making "working" noise. Should I just turn the power off? I have no idea what to do now. Thanks, Sue

no no you do not clean anything with hijack this you must go to the landzdown forum that was listed and start a thread there in the hijackthis area then post your results from hijack this there in your post, also tell them everything you have done they will come and help you with step by step directions, the hijackthis produces a log file that is what you need to post there for them to review so they know what steps to take, the team there is one of the best on the net so be assured they will help you but it takes time it is not a one deal cure all it is a step by step proceedure. Just tell Corrine that I and Zep sent you there and you can also link back to this thread here so they can see this info. There have been many with that infection recently and they are able to be cleaned. go here register at the forum and post your thread in this area HijackThis Logs

You can get more information about your infection at Symantec's Threat Explorer. Symantec defines a Trojan Horse as: Trojan horses are impostors. The files claim to be desirable programs, but they are malicious. A very important distinction from true viruses is that they do not replicate themselves, as viruses do. Trojan horses contain a malicious code which, when triggered, causes loss or theft of data. For a Trojan horse to spread, you must invite these programs onto your computer; for example, by opening an email attachment. Trojan horses are also known to create a back door on a computer. The back door gives another user access to a system, and possibly allows confidential or personal information to be compromised. Unlike viruses and worms, Trojan horses neither reproduce by infecting other files, nor do they self-replicate. A program that claims to be a desirable program but is malicious. A very important distinction from true viruses is that they do not replicate themselves, as viruses do. Trojan horses contain malicious code, which causes loss or theft of data. For a Trojan horse to spread, you must invite these programs onto your computer; for example, by opening an email attachment. Trojan horses are also known to create a backdoor on a computer. The backdoor gives another user access to a system and possibly allows confidential or personal information to be compromised. Unlike viruses and worms, Trojan horses do not reproduce by infecting other files, nor do they self-replicate.