The article intends to explain the procedure of removing Smart Internet Protection (SIP) 2011, a fake anti-spyware program that belongs to the family of a fake antivirus program called Personal Internet Security 2011. The methods compiled here are simple and correct until date. However, it is recommended that these should be followed with utmost care to avoid facing problems. This will help users save time as well as money that would otherwise be wasted looking for offline,
online virus removal support or spyware removal support alternatively.
The below mentioned guide will help you get rid of the beast spyware on your own and without searching for support options. Be patient as it will take time while removing certain infected files and registry entries. You can do it all by yourself or take help of a friend as you like to.
Instructions:
Close any SIP 2011 process that is currently running on your screen. Bring up Task Manager by clicking anywhere on the task bar or pressing the Ctrl, Alt, and Delete keys together on the keyboard. Highlight the Processes tab and locate SmartIP2011.exe process. Click to select it and then hit the End Process button. The process will be stopped.
If you are unable to use any utility like Task Manager or do anything on your computer, then reboot it in the Safe Mode with Networking. Restart your computer and start tapping the F8 key on the keyboard before the Windows logo appears. It will take you to the Advanced Boot menu. Use the Down arrow key to select the Safe Mode with Networking option. Hit Enter and you will be fine. Now repeat the first step and follow the below mentioned steps to completely remove the dangerous program from your system.
Try to connect to the internet. If it refuses to make connection, then refresh it using these instructions. Open your internet browser (Internet Explorer) and navigate to Tools> Connections> and LAN Settings. In the LAN Settings window, remove the checkmark from the box next to Use a proxy server for your LAN and click on the OK button to exit it. Click on the Apply button and then OK to exit the Internet Options window. Close web browser and retry to connect the internet connection. You should be successful now.
Update your existing virus protection program and run a full scan. Wait until the scan detects and automatically removes the infected files it finds. Now click on the Start menu and navigate to Control Panel and then Add or Remove Programs (Windows 7 or Vista users should type ‘programs and features’ without quotes and as is in the Start Search menu to bring up programs). Locate the Smart Internet Protection 2011 program, select it and click on the Change/Remove button (Windows 7/Vista users click on the Uninstall button). Follow the instructions and finish uninstallation. When prompted, reboot the computer.
Now you must locate and delete all the files belonging to SIP 2011 in all the files and folders and drives viz. C:\, D:\ etc. Use Windows Search utility (press Ctrl + F keys together) to look for these files viz.
[YBoom.exe], [WSZugo.exe], [wsynalib.exe], [vloadb5C.dll], [vfbu.exe], [svchost10.exe], [StarDefender4.exe],
[RogueKiller.exe], [powerrcfg.exe], [nsv19B.dll], [killexe.exe], [jjp154.exe], [sssd.exe],
[softupdate106_231.exe], [SIfce_289.exe], [SI6c2_289.exe], [SI646_289.exe], [SI306_231.exe], [FullEkran.exe],
[AdobeMngPlug.dll], [acleaner.exe], [979f8ea8.dll], [%commonprograms%\Smart Internet Protection 2011.lnk], [%startmenu%\Smart Internet Protection 2011.lnk], [%appdata%\Smart Internet Protection
2011\instructions.ini], [%appdata%\Smart Internet Protection 2011\cookies.sqlite], [%commonappdata%\smeyfe], [%commonappdata%\sqhdr5\35.mof], [%commonappdata%\sqhdr5\wksra_249.exe], [vloadb5C.dll], [nsv19B.dll],
[AdobeMngPlug.dll], [979f8ea8.dll], [c:\Documents and Settings\All Users\Application Data\e659\], [c:\Documents and Settings\All Users\Application Data\e659\7377.mof],
[c:\Documents and Settings\All Users\Application],
[Data\e659\80e9877130a15854a99bf6dd8d368239.ocx],
[c:\Documents and Settings\All Users\Application Data\e659\mozcrt19.dll], [c:\Documents and Settings\All Users\Application Data\e659\SmartIP2011.exe], [c:\Documents and Settings\All Users\Application Data\e659\PIS.ico],
[c:\Documents and Settings\All Users\Application Data\e659\sqlite3.dll], [c:\Documents and Settings\All Users\Application Data\e659\unins000.dat], [c:\Documents and Settings\All Users\Application Data\e659\PISSys\],
[c:\Documents and Settings\All Users\Application Data\e659\Quarantine Items\], [c:\Documents and Settings\All Users\Application Data\PIKKS\], [c:\Documents and Settings\All Users\Application Data\PIKKS\PIQBS.cfg], and [%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick].
Be careful while deleting these files. Do not accidently remove any genuine Windows file that may consequently result into severe problems in your computer.
When done, exit all the windows. Click on the Start menu and go to Run. Type ‘regedit’ (without quotes) in the blank box and hit Enter on the keyboard. The Registry Editor windows will open up. Search for these entries and remove them viz.
[HKEY\Classes Root\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}]
[HKEY\Classes Root\PersonalSS.DocHostUIHandler]
[HKEY_CLASSES_ROOT\SmartIP2011.DocHostUIHandlerrn[HKEY\Current User\Software\3]
[HKEY\Current User\Software\Microsoft\Windows\CurrentVersion\Run “Smart Internet Protection 2011]
[HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Download "RunInvalidSignatures" = "1"]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:25401"]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "UID" = "7"]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0User Agent\Post Platform "88780570603"]
[HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Download "CheckExeSignatures" = "no"]
When done removing all these entries, exit the Registry Editor window. Close all the windows and connect to the internet. Open your web browser and download any spyware removal tool like Malwarebytes’ anti malware, Spyware Doctor, SpyHunter scanner, or Spybot Search & Destroy etc. Save the downloaded file to your desktop and run it from there. When the installation has finished, open the program, update it, and run a full scan (no custom scan). Wait for the program to detect and automatically remove the traces of the SIP 2011 program. You can check the quarantine history to know about details.
When prompted, reboot the computer. If you were running all the steps in the Safe Mode, then you must reboot computer to come back into the normal mode. Your system has now become fake spyware program free. You must take care while browsing internet or downloading random files. These may contain malicious software like SIP 2011 or others.