Anti-virus-1 is a new rogue anti-spyware program from the same family as Antivirus 2010 and Antivirus 360. This program is promoted primarily through two methods. The first is through the use of advertisements that pretend to be online anti-malware scanners. These advertisements go through what appears to be a scan of your machine and then when finished, state that your computer is infected and that you should download Anti-virus-1 to protect yourself. Remember, though, that this is just an advertisement and it has no way of knowing what is running on your computer. The second method that is used to promote this rogue is through the use of Trojans. When certain Trojans are installed on your computer they will display security alerts stating that your computer is infected or that you have some other security risk. When you click on these alerts, it will download and install Anti-virus-1 onto your computer.































































When Anti-virus-1 is installed it will configure itself to start automatically when Windows starts. It will also modify your C:\Windows\System32\drivers\etc\hosts file so that when you visit certain sites you will be go to a site under the malware developer's control rather than the legitimate site you were expecting to go to. This allows them to show you information that further promotes the Anti-virus-1 program. When the program is started it will automatically scan your computer and then display a list of infections that cannot be removed unless you first purchase the program. The infections that it will show include Spyware.IEMonster.d, Zlob.PornAdvertiser.ba, Spyware.IMMonitor, Infostealer.Banker.E, and Dialer.Xpehbam.biz_dialer among many others. All of these infections do not actually exist on your computer, but are only being shown to scam you into thinking that you have infections on your computer.

While the program is running you will also see security alerts in the form of a balloon appearing from the Windows taskbar. These alerts will have messages like:

Spyware activity alert!

Spyware.IEMonster activity detected. It is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs, including logins and passwords from online banking sessions, eBay, PayPal. and svchost.exe

Internal conflict alert.

Anti-virus-1 detected internal software conflict. Some applicztion <sic> tries to get access to system kernel (such behavior is typical to Spyware/Malware). It may cause crash of your computer.

You may also encounter what appears to be a crash screen, or Blue Screen of Death, that states SPYWARE.MONSTER.FX_WILD has been detected. Your computer will then pretend to reboot and in the fake Windows boot screen you will see the following message under the Windows logo:

Your Anti-virus-1 copy is unregistered. Microsoft Security recommends you to activate your antivirus protection software.

When you see these fake taskbar alerts, blue screen crashes, and reboots, please do not be alarmed as they are all fake. In fact the blue screen crash, and the subsequent reboot, are just a screen saver run by the c:\Documents and Settings\All Users\Application Data\AV1\svchost.exe file. In reality your computer never crashed or rebooted.

Though Anti-virus-1 may look like a legitimate anti-malware program it is important to remember that these programs are scripted to always show that you have infections. This program, when run will always show you the same infections, the same alerts, and the same warnings. It does this for one reason and only one reason. To scare you into thinking you are infected and thus you purchase their software. Instead of doing so, please use the free removal guide outlined below to remove Anti-virus-1 and the malware that was installed with it.