Hey everybody, I'm hoping someone can help. I got the w32.kwbot.c.worm from kazza and can't shake it. Everytime I run NAV it finds 6 of them in *.CPY files from a \..\restore\temp directory. When I quarantine and delete them and scan again or reboot they are there again. I followed the advice on Symantec's site for removal but either the registry keys aren't there or don't have any of the threads they mention. I did however find the krypton key which I removed. I also installed spybot and hijack this last night. I 'fixed' the entries spybot found and saved a hijack log. I rebooted my computer today and found my show desktop icon from the taskbar is corrupt, the icon changed and it won't find the location when you click on it. The hijack this log also saved as the same weird icon and I had to use 'open with', notepad, to get it to open. The icon things I'm not sure if it was the worm or the scans so I restored my registry from a backup I did and the icons were still weird. I just rescanned and made a new log file for hijack this below. If anyone could provide any help to get rid of the worm or help me get show desktop to work again I would gladly appreciate it. Thank you!