A couple weeks ago, our computer began acting up when internet explorer was activated... Popups, redirected to websites(some illicit), and attached "cool search bar" to the top of browsing windows. My brother uses IE still... I don't know where he was, but I found some sites in the history that didn't look particularly... Good. But that's besides the point. I ran adaware, found a lot of things, quarantined them... Went into the add/remove programs folder, removed some of the programs there... Cleared out IE's cookies and temp folders. Upon opening IE again, it was back. Whether this is connected or not, I don't know, but, yesterday we got a bill in the mail for $40 from PremierPremium saying we made two phone calls to the united kingdoms for pay-per-view Websites. (each call exactly 4 minutes, exactly an hour and a half apart from one another, on the same day) Today, I've been trying to get rid of it... Found it's located in C:/Windows/System under KALVIOH32.exe Upon attempting to delete it, it comes up with the message: Cannot be deleted. Access denied. And, I can't disable it in msconfig, although it is there... It un-disables itself after restarting. Right now, I'm downloading a new version of AVG... I don't think that'll help though. Any help would be greatly appreciated. Update: I was right, AVG didn't detect it. How in the world do you get rid of this thing!?!? Even after doing some research on it, I couldn't find hardly anything... Anything at all would be appreciated.

Your going to have to locate what section of the registry the file is located in and open the registry and delete it directly out of the registry. This is delicate and tricky but it has locked itself into the registrys subcommand HKEY and the only way to remove it is manually. Next id never ever use Internet explorer again after its clean and kick the s--- out of your brother for downloading porn. Because he really screwed the pooch when you lock into the subcommand

Run HiJackThis and then plug the resulting log into their free log scanner. You should be able to get rid of most of the stuff that's in there. larry

After two frustrating days of using SpyBot, the freeware version of AdAware, and Wash n go, as well as several registry editors, I finally resorted to buying Adaware SE from lavasoftusa.com. It comes with Ad-watch, an active monitoring ssystem that does many things, but most importantly it allowed me to "automatically" block the creation of the registry key "Kalvsys", which was re-creating itself every 2-3 seconds. While it was blocked (deleted) I rebooted and the key was/is still gone! Well worth the $27 US that I spent on it.

I have the dam thing too! Thanks to the Kids. Like reply #3 said it re-writes itself to the regestry in two places every 3 seconds. It's in HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\run & run- I tried deleteing it both places and pulling the plug several times but it's too fast. Anyone that pays money to get rid of this s--- is a fool. And do not pay those phone bills either it just incourages them.

Sorry it took me so long to get back here but I'm exausted from trying to clean up this machine. The kids realy trashed it. The solution: Look at kalvwbi32.exe in Windows\System, note the date, use find to find all files with that date, you can delete all that crap. Everything except kalvwbi32.exe Restart windows in safe mode. Start Regedit, click find under edit, type in Kalvsys, find all and delete them. There is the website kalvsys in the Explorer section of the registry. Make sure that you get that too or soon as you go online it will just reinstall itself. And never go to that site looking for these scum all it does is reinfect you. After you eliminate it in the registry you can then delete kalvwbi32.exe in Windows\System and restart in normal mode. And most inportant of all DO NOT pay any phone charges associated with this!!

Thanks... I still don't know if those phone bills were caused by the virus though - I'm afraid it may of been my brother knowingly doing it. Customer Service from PremierPremium(host for sites / people who billed us) seem fairly confident that their pay-per-view websites can't be accessed unless a human goes through the process... Here's part of their email they sent back to me: "You had inquired specifically what web site was accessed. Our records show that a call had been placed to a premium rate adult website called "Live Web Cams". Premier Premium Communications does not own this site and simply is a billing company." and... "In order to be billed on a per minute basis the user needs to take several actions. First action the user would have to take is accepting a certified download. The second action the user had to take was read through a legally binding disclaimer which started the cost of the call and also stated they either had to be the telephone line subscriber or have permission from the telephone line subscriber. Once that step was taken the billing solution would disconnect them from their standard Internet service provider and reconnect them to a premium rate Internet service provider in the United Kingdom. Once the connection has been established, the premium rate web site is shown. Finally once our billing software establishes a connection to our remote billing server in the United Kingdom, the first 2 minutes aren't billed allowing the user plenty of time to disconnect from the service and not be billed if for some rare reason they made a mistake despite our previous precautions or are not interested in the premium rate website content." There was something that popped up on my computer though - but I don't think it was on the date they billed us on... A dialer for something adult, it may of been a webcam service - When trying to close it, it continued connecting, I eventually got it down, but it was not up for the four minutes they say it was. That only happened once though too, not the two times they say it happened. Bleh... And they say if I don't pay in time, it'll be fowarded to a licensed collection agency. I don't THINK PremierPremium is bad, they just... Host sites pay-per-view sites... And collect the money. If any of you KNOW that the Kalvsys, or some other virus / spyware can force your computer on to pay-per-view sites, please tell me, I'd really like to get this resolved... Without paying that $40, and without damaging my parent's credit history... Thanks again for all the help.