How to manually remove Anti-virus 1 from system

This article provide information on how to manually remove Anti-virus 1 infection from the system.

Follow the steps below:

Step 1: End Processes

1. Click Start and then Run. (Search in Vista)
2. Type taskmgr.exe and click Ok.
3. Click on Processes tab and search and End following processes:
   • AV1i.exe
   • Stage2[1].exe
   • AV1i2.exe
   • StageThree[1].exe
   • svchost[1].exe
   • svchost.exe
   • av1.exe
   • install[1].exe
4. Close Task Manager.

Step 2: Delete files

1. Locate the following files listed and delete them:
   • %\Program Files%\AV2010\AV2010.exe

   • %\Program Files%\AV2010\svchost.exe

   • %\WINDOWS%\system32\IEDefender.dll

   • %\WINDOWS%\system32\wingamma.exe

   • %\Documents and Settings%\All Users\Desktop\AV2010.lnk

   • %\Documents and Settings%\All Users\Start Menu\Programs\AV2010\AV2010.lnk

   • %\Documents and Settings%\All Users\Start Menu\Programs\AV2010\Uninstall.lnk

2. Close Explorer.

Step 3: Remove Registry keys

1. Click Start and then Run. (Search in Vista)
2. Type regedit.exe and then click Ok.
3. Locate the following keys and delete:
   
   Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the iYogi Knowledge Base: How to back up and restore the registry in Windows
   
   
   • HKEY_CURRENT_USER\Software\AV2010
   • HKEY_CLASSES_ROOT\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}
   • HKEY_CLASSES_ROOT\AppID\IEDefender.DLL
   • HKEY_CLASSES_ROOT\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
   • HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO
   • HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO.1
   • HKEY_CLASSES_ROOT\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}
   • HKEY_CLASSES_ROOT\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 'Windows Gamma Display'

4. Close Registry Editor.
5. Reboot the computer.