This Looks like what you have it is a network worm so that is how it spreads through the network the only difference is the letter this one is (BVK) and yours is (BKV) I'm sure they do the same thing, you can see all the registry changes it makes, and it appears to disable some software and then tries to connect to a server. W32/Sdbot-BVK is a worm and IRC backdoor Trojan for the Windows platform. W32/Sdbot-BVK can spread via network shares protected by weak passwords, or by exploiting common vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), and ASN.1 (MS04-007). W32/Sdbot-BVK runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. W32/Sdbot-BVK includes functionality to access the internet and communicate with a remote server via HTTP. When first run W32/Sdbot-BVK copies itself to \netbtd.exe. The file netbtd.exe is registered as a new system driver service named "NetBTD", with a display name of "NetBTD(ntbtd)" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under: HKLM\SYSTEM\CurrentControlSet\Services\NetBTD\ W32/Sdbot-BVK sets the following registry entries, disabling the automatic startup of other software: HKLM\SYSTEM\CurrentControlSet\Services\Messenger Start 4 HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry Start 4 HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr Start 4 Registry entries are set as follows: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotAllowXPSP2 1 HKLM\SOFTWARE\Microsoft\Ole EnableDCOM N HKLM\SYSTEM\CurrentControlSet\Control\Lsa restrictanonymous 1 Registry entries are created under: HKLM\SOFTWARE\Microsoft\Security Center\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\ RSS:Atom Get reports on the latest virus threats delivered to your computer

Unbeknownst to its users, Webshots employed its Webshots Desktop Application (a free program that users can download from their site to manage their online pictures) to install the Kiwee Toolbar as part of a software update for this program. Other than the Wikipedia article (whose references don't appear to have anything to do with the surreptitious installation of Kiwee) and complaints in support forums about problems getting it off a computer, I don't see anything about it being forced on users. Was it one of the many tools bars included with software that installed by default but unchecking a box provided an opt-out? I just don't know. Although several of the search hits I saw included the word "unbeknownst" which leaves me wondering if they were written by the same person or several people parroting the others. In any case, it seems more a case of poorly written code and even poorer judgment on the part of American Greetings than malware. American Greetings does offer instructions on how to remove Kiwee although it sounds like you need to install the latest, greatest version first. I'm not sure I'd be jumping at at offer. Gosh Durn Mike ~ Don't be so rude & judgemental! I didn't get "glitter text" intentionally. Do you have any idea of the number of computers I've looked at with upwards of a half dozen different tools bars installed? Every user claimed they never installed them. Yes they did, when the went click, click, click without bothering to read what was on the screen. Now maybe I got up on my soapbox a little too soon and American Greetings did install poorly written software on their customers' computers without their customers knowledge or consent. If that is the case, I would be writing a nice letter to Mr. Weiss letting him know why he won't be getting any more of my money. Even if it meant giving up a really pretty screen saver.

Here's the issue with firefox, FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109936&tt=100512_2_ FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - b8457168000000000000bc7737387210 FF - user.js: extensions.BabylonToolbar_i.hardId - b8457168000000000000bc7737387210 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15473 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1715:35:37 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: network.protocol-handler.warn-external.dnupdate - false FF - user.js: browser.sessionstore.resume_from_crash - false We will be getting rid of that, by running the tools above.

firstkim, Make sure you are running the current verision of spybot-Search & Destroy open the program and it should be at 1.5, anything lower go to railheadwitzs' link & download the current version it was just updated recently to 1.5 I think this cleaner you bought is adding an entry to the registery so it runs all the time spybot may not like that looks like you have tea timer enabled in spybot that is good but No need for registery cleaner to run all the time, you can tell if it is running if it has created an icon in the task bar by the clock, a registery cleaner should run when you choose to run it.