How to remove Anti-virus-1 (Removal Guide)

  • February 18, 2009
  • 05:05 PM
  • Read 66,152 times

What is Anti-virus-1?

Anti-virus-1 is a new rogue anti-spyware program from the same family as Antivirus 2010 and Antivirus 360. This program is promoted primarily through two methods. The first is through the use of advertisements that pretend to be online anti-malware scanners. These advertisements go through what appears to be a scan of your machine and then when finished, state that your computer is infected and that you should download Anti-virus-1 to protect yourself. Remember, though, that this is just an advertisement and it has no way of knowing what is running on your computer. The second method that is used to promote this rogue is through the use of Trojans. When certain Trojans are installed on your computer they will display security alerts stating that your computer is infected or that you have some other security risk. When you click on these alerts, it will download and install Anti-virus-1 onto your computer.

  • Anti-virus-1 screen shot
  • Scanning screen
  • Scan summary
  • Scan results
  • Installation of Anti-virus-1
  • IE Hijack #1
  • Internet Explorer Hijack #2
  • Fake Security Alert #1
  • Fake security alert #2
  • Fake PC Magazine Review
  • Fake Cnet Review
  • Fake Review
  • Fake ZDNet Review
  • Fake Windows Security Center
  • Fake Windows Blue Screen
  • Fake reboot screen

When Anti-virus-1 is installed it will configure itself to start automatically when Windows starts. It will also modify your C:\Windows\System32\drivers\etc\hosts file so that when you visit certain sites you will be go to a site under the malware developer's control rather than the legitimate site you were expecting to go to. This allows them to show you information that further promotes the Anti-virus-1 program. When the program is started it will automatically scan your computer and then display a list of infections that cannot be removed unless you first purchase the program. The infections that it will show include Spyware.IEMonster.d,, Spyware.IMMonitor, Infostealer.Banker.E, and Dialer.Xpehbam.biz_dialer among many others. All of these infections do not actually exist on your computer, but are only being shown to scam you into thinking that you have infections on your computer.

While the program is running you will also see security alerts in the form of a balloon appearing from the Windows taskbar. These alerts will have messages like:

Spyware activity alert!
Spyware.IEMonster activity detected. It is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs, including logins and passwords from online banking sessions, eBay, PayPal.


Internal conflict alert.
Anti-virus-1 detected internal software conflict. Some applicztion <sic> tries to get access to system kernel (such behavior is typical to Spyware/Malware). It may cause crash of your computer.

You may also encounter what appears to be a crash screen, or Blue Screen of Death, that states SPYWARE.MONSTER.FX_WILD has been detected. Your computer will then pretend to reboot and in the fake Windows boot screen you will see the following message under the Windows logo:

Your Anti-virus-1 copy is unregistered. Microsoft Security recommends you to activate your antivirus protection software.

When you see these fake taskbar alerts, blue screen crashes, and reboots, please do not be alarmed as they are all fake. In fact the blue screen crash, and the subsequent reboot, are just a screen saver run by the c:\Documents and Settings\All Users\Application Data\AV1\svchost.exe file. In reality your computer never crashed or rebooted.

Though Anti-virus-1 may look like a legitimate anti-malware program it is important to remember that these programs are scripted to always show that you have infections. This program, when run will always show you the same infections, the same alerts, and the same warnings. It does this for one reason and only one reason. To scare you into thinking you are infected and thus you purchase their software. Instead of doing so, please use the free removal guide outlined below to remove Anti-virus-1 and the malware that was installed with it.

Self Help Guide

This guide is intended for advanced computer users only. Please ensure your data is backed up before proceeding. If you’re uncomfortable making changes to your computer, consider having a professional help clean your computer or ask in the forums.
  1. Print out these instructions as we will need to close every window that is open later in the fix.

  2. At this point you should download Malwarebytes Anti-Malware, or MBAM, to scan your computer for any any infections or adware that may be present. Please download Malwarebytes from the following location and save it to your desktop:

    Malwarebytes Anti-Malware Download Link (Download page will open in a new window)

  3. Once downloaded, close all programs and Windows on your computer, including this one.

  4. Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MBAM onto your computer.

  5. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave Launch Malwarebytes Anti-Malware checked. Then click on the Finish button. If MalwareBytes prompts you to reboot, please do not do so.

  6. MBAM will now start and you will be at the main screen as shown below.

    Malwarebytes Anti-Malware

    Please click on the Scan Now button to start the scan. If there is an update available for Malwarebytes it will automatically download and install it before performing the scan.

  7. MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.

    Malwarebytes Anti-Malware

  8. When MBAM is finished scanning it will display a screen that displays any malware that it has detected. Please note that the infections found may be different than what is shown in the image below due to the guide being updated for newer versions of MBAM.

    MalwareBytes Scan Results

    You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.

  9. You can now exit the MBAM program.

Your computer should now be free of the Anti-virus-1 program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.

View Associated Anti-virus-1 Files

c:\Documents and Settings\All Users\Application Data\AV1 c:\Documents and Settings\All Users\Start Menu\Programs\Anti-virus-1 c:\Documents and Settings\All Users\Application Data\AV1\ c:\Documents and Settings\All Users\Application Data\AV1\av1.exe c:\Documents and Settings\All Users\Application Data\AV1\AV1i.exe c:\Documents and Settings\All Users\Application Data\AV1\AV1i2.exe c:\Documents and Settings\All Users\Application Data\AV1\QWProtect.dll c:\Documents and Settings\All Users\Application Data\AV1\svchost.exe c:\Documents and Settings\All Users\Desktop\Anti-virus-1.lnk c:\Documents and Settings\All Users\Start Menu\Programs\Anti-virus-1\Anti-virus-1.lnk c:\Documents and Settings\All Users\Start Menu\Programs\Anti-virus-1\Uninstall.lnk

View Associated Anti-virus-1 Registry Information

HKEY_CURRENT_USER\Software\AV1 HKEY_CURRENT_USER\Software\AV1\AV1\{F275E931-AFEC-4f70-B0D4-CC2731B945E0} HKEY_CLASSES_ROOT\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774} HKEY_CLASSES_ROOT\AppID\QWProtect.DLL HKEY_CLASSES_ROOT\CLSID\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7} HKEY_CLASSES_ROOT\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D} HKEY_CLASSES_ROOT\QWProtect.QWProtectBHO HKEY_CLASSES_ROOT\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70FEAD04-A7FD-4B89-B814-8A8251C90EF7} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Monitor calibration"

This is a self-help guide. Use at your own risk. can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus,Trojan,Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.

search guides


Remember Me
Sign in anonymously