How to remove Anti-virus-1. Removal Guide
Anti-virus-1 is a new rogue anti-spyware program from the same family as Antivirus 2010 and Antivirus 360. These two fake programs are even advertised through the same fake online scanner. The main purpose of Anti Virus 1 is to frighten users and trick money from them. That’s why it is important to remove Anti-Virus-1 upon detection.
When Anti-virus-1 is installed it will configure itself to start automatically when Windows starts. It will also modify your HOSTS file so that when you visit certain sites you will be go to a site under the malware developer’s control rather than the legitimate site you were expecting to go to. This allows them to show you information that further promotes the Anti-virus-1 program.
When the program is started it will automatically scan your computer and then display a list of infections that cannot be removed unless you first purchase the program. The infections that it will show include:
- Spyware.IEMonster.d
- Zlob.PornAdvertiser.ba
- Spyware.IMMonitor
- Infostealer.Banker.E
- Dialer.Xpehbam.biz_dialer
All of these infections do not actually exist on your computer, but are only being shown to scam you into thinking that you have infections on your computer.
While the program is running you will also see security alerts in the form of a balloon appearing from the Windows taskbar. An example message like:
Spyware activity alert!
Spyware.IEMonster activity detected. It is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox
As you remember Anti-virus-1 are modifying the HOSTS file, so it showing fake review pages from CNET, PC Magazine, Tech Radar, Reevo, ZDNet, etc in order to trick the infected user into thinking these sites are writing reviews about how excellent the Anti-virus-1 program is. An example is the fake review supposedly written by Neil Rubenking for the PC Magazine site as shown below:
In reality, though, these reviews were written by the developers of Anti-virus-1 instead and they are hosted on their servers.
Try to use Trojan Remover to start free scan and remove Anti-virus-1.
Anti-virus-1 automatical remover:
As you might have foreseen, “Anti-Virus Number-1″ is not a lonely walker in the empty space. In contrary, it has multiple ties with other rogues so that complex malware removal is the best way to get rid of “Anti-Virus Number-1″. In addition, if you remove “Anti-Virus Number-1″ automatically, you get life-time protection from malware aggression.
Anti-virus-1 manual removal guide:
Delete Anti-virus-1 files:
Application DataAV1AV1.cabApplication DataAV1AV1.exe
Application DataAV1AV1i.exe
Application DataAV1AV1i2.exe
Application DataAV1QWProtect.dll
Application DataAV1svchost.exe
Application DataN1N1.exe
Application DataN1N1i.exe
Application DataN1N1two.exe
Application DataN1QWProtect.dll
Application DataN1svchost.exe
Delete Anti-virus-1 registry entries:
HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionRun “Monitor calibration”HKEY_CURRENT_USERSoftwareAV1
You may also like to read
Did you enjoy this post? Why not leave a comment below and continue the conversation, or subscribe to my feed and get articles like this delivered automatically to your feed reader.
Comments
by default it is placed here: C:\Windows\System32\drivers\etc\hosts. to restore it you can use Loaris Trojan Remover. See Tools->Reset windows HOSTS file.
I have tried these and they are not working, everything i try wants me to try a new program…i just want it GONE
I downloaded this and ran a scan and I STILL have Anti-virus Number-1 on my computer? How do I get rid of this for good??
2 Amber: You need to remove detected files after scan via Trojan Remover. Or you can reboot to safe mode and remove those files manually
Hi, I keep seeing actskn43.ocx come up as the scan results and I cannot get rid of it. For some reason I do not have a write/delete permission for this file even as system admin. Any advice?
AS U SAID PRE YOUR REVIEW OF ANTI VIRUS #1 IT KEPT FLASHING ON MY PC SAYING IT WAS SERIOUSLY INFECTED I GOT WORRIED N PURCHASED IT HOW DO I GET A REFUND FROM THIS FAKE N FRAUD COMPANY
where is ‘hosts’ file placed and how to restore it? in any case thanx for detailed instructions.