Updated version of this article is available on this link

 Trojan Removers:  As you know, that this malware could be installed by a Trojan, therefore you will also need to search for remove the Trojans as well. Try these free tools. Click here to read more...

If you are unable to open Task Manager
Sometimes you are not able to open the task manager, the run command etc. The virus does this. There are free tools to solve this problem.  They are listed here. See which is helpful for you. Click here to read more...

Remove Processes from Task Manager
Press Ctrl Shift Esc to open Task Manager. See in the list of the processes
AV1.exe, AV1i.exe,
AV1i2.exe,
vmwaretray.exe

Select if found and press the End Process button. It will prompt you, say yes, and then close the Task Manager. There may be more processes belonging to this malicious software.

For Advanced Users : If you use a free software called "Zenturi program checker"  You may be able to see the location of a process in the task manager on the hard disk, and from the list of malicious files, differentiate the harmful processes from useful processes, like the svchost.exe created by this malware located at (C:\Documents and Settings\All Users\Application Data\AV1\svchost.exe)

After the system configuration utility window is open, Click on the Startup tab, that will list all the programs that are scheduled to start when you turn your computer On. Expand the middle column using your mouse pointer so that you can see the path of the program on the hard disk, that will give you a clear idea, what program that is. Locate and uncheck the entries if  found
"
C:\Documents and Settings\All Users\Application Data\AV1\AV1i.exe" AV2i.exe, AV1.exe,

This is additional/ precautionary: Also look for any other suspicious names. Random alphanumeric names or names containing only numbers,  Uncheck the boxes in front of these entries. Also look at other entries, if you find an entry of any of the malware files listed in this article, uncheck them too. 

Searching and Deleting the Folders / files on the hard disk 
The file/ folder names may differ with the variation of the malware installer
C:\Documents and Settings\All Users\Application Data\AV1
C:\Documents and Settings\All Users\Start Menu\Programs\Anti-virus-1
Search using windows search box for the above name and delete all the instances of the above folders if found.

C:\Documents and Settings\All Users\Application Data\AV1\AV1i.exe
C:\Documents and Settings\All Users\Application Data\AV1\AV1i2.exe
C:\Program Files\vmware\vmware tools\vmwaretray.exe

C:\Documents and Settings\All Users\Application Data\AV1\AV1.cab
C:\Documents and Settings\All Users\Application Data\AV1\av1.exe
C:\Documents and Settings\All Users\Application Data\AV1\QWProtect.dll
C:\Documents and Settings\All Users\Application Data\AV1\svchost.exe

Delete the above files if found.

Manually removing malware entries from  Registry 

You can edit the registry by using the windows built in registry editor. Click here to read more...

There are several variations of this malware installers are located, each differ slightly with each other. Variation1 see report. Variation2 see report ,Variation3 see report

These registry keys may be found on an infected computer. Delete them if found.

• The following Registry Keys were created:
  • HKEY_CURRENT_USER\Software\AV1
  • HKEY_CURRENT_USER\Software\AV1\AV1
  • HKEY_CURRENT_USER\Software\AV1\AV1\{F275E931-AFEC-4f70-B0D4-CC2731B945E0}

• The newly created Registry Values are:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    • Monitor calibration = "%CommonAppData%\AV1\AV1i.exe"
  
  so that AV1i.exe runs every time Windows starts
  
  • [HKEY_CURRENT_USER\Software\AV1\AV1\{F275E931-AFEC-4f70-B0D4-CC2731B945E0}]
    • id = "maf_413512031"

 Hosts file modification:  This malware adds entries in the Hosts file, adding URL to IP mapping which result into redirecting of those legitimate sites to a malicious ip address. You can see the actual Hosts files modification on this link. 

The easiest way to eliminate this problem, is to open the Hosts file from this location (
C:\Windows\System32\drivers\etc\hosts) . Open the file in Notepad. If you find the contents changed. Delete all the entries in it except "127.0.0.1  localhost" which is the default entry of this file, and save it and close it. 

Using CCleaner:  CCleaner is a freeware temp files and registry cleaner. We need to use this type of software because almost all the infection that occur through internet, come through the temp files, and unfortunately windows does not remove temp files automatically.

Using Antivirus Application: Follow this step, if even after applying all the above steps, the virus still shows its presence in the computer. Your best helper is the antivirus program on your computer. Keep it always updated. Click here to read more...

Using the system file checker: Follow this step if you notice trouble in the normal functioning of windows. Click here to read more...

If you are unable to access one or more sites during the repair process

- if possible use another computer to download the software needed for repairing your computer, and then copy and transfer it to the infected computer using any available means like a pen drive.
- if you are using only internet explorer, and if it is blocked from visiting some of the security related sites, try to download/ install Firefox browser, and see if you can use it for the same purpose. 

Using a Firewall : It is helpful to install a standalone firewall so that you can block any unsolicited communication done by the malware to and from your computer. This malware tries to connect to "70.38.11.165"  block these sites/hosts in your firewall.