Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Saturday, October 9, 2010

How to remove Smart Engine malware (Uninstall Guide)

Tell your friends:
Smart Engine is a rogue anti-virus program that deliberately reports false system security threats on the computer. It's a clone of My Security Shield. It masquerades as legitimate security software and claims that your computer is infected with malware. The rogue program only pretends to scan your computer for malicious software. Smart Engine is a scam, don't install/purchase it. This fake anti-virus program is promoted mostly through the use of Trojans, fake online anti-malware scanners and malicious websites. If your computer is infected with this virus, please follow the removal instructions below to remove Smart Engine from your computer for free using legitimate anti-malware software.

Once Smart Engine is installed, it will claim that your computer is heavily infected witl all sorts of malware. Furthermore, it will constantly display fake security warnings and pop ups that attempt to further scare you into thinking your PC is infected with Trojans, spyware, worms and other viruses. These warnings should be ignored as they are false as well. Here's how one of many fake Smart Engine alerts reads:
Windows Security Alert
To help ptotect your computer, Windows Firewall has blocked
some features of this program.

System Alert
malicious applications, which may contain Trojans, were found on your computer and are to be removed immediately. Click here to remove these potentially harmful items using Smart Engine.

The bad news is that Smart Engine blocks legitimate programs and system utilities. It modifies Windows hosts file and hijacker web browsers. You will have to use certain tools and methods to disable this virus and then download malware removal software.

It goes without saying that SmartEngine was created with only one purpose; to scare you into thinking that your computer is infected so that you will purchase Smart Engine. Please note that this fake program won't remove any infections from your computer. By no means should you purchase this program. And if you have already bought it then please contact your credit card company and dispute the charges. Then please follow the removal instructions below. Last, but not least, if you have any questions, please leave a comment. Good luck and be safe online!

Smart Engine removal instructions using HijackThis or Process Explorer (in Normal mode):

1. Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab. Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.

2. Download Process Explorer.
3. Rename procexp.exe to iexplore.exe and run it. Look for similar processes in the list and end it:
  • SM19b_3912.exe
  • SmartEngine.exe
OR download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it. Search for similar entries in the scan results:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
O4 - HKCU\..\Run: [Smart Engine] "C:\Documents and Settings\All Users\Application Data\19cdab\SM19b_3912.exe" /s /d
Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

4. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

5. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

Smart Engine removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here:

NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab.
Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.

3. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

Smart Engine associated files and registry values:

  • C:\Documents and Settings\All Users\Application Data\19cdab\
  • C:\Documents and Settings\All Users\Application Data\345d567\853.mof
  • C:\Documents and Settings\All Users\Application Data\345d567\SmartEngine.exe
  • C:\Documents and Settings\All Users\Application Data\345d567\SM19b_3912.exe
  • C:\Documents and Settings\All Users\Application Data\345d567\SME.ico
  • C:\Documents and Settings\All Users\Application Data\345d567\[SET OF RANDOM CHARACTERS].dll
  • C:\Documents and Settings\All Users\Application Data\345d567\[SET OF RANDOM CHARACTERS].ocx
  • C:\Documents and Settings\All Users\Application Data\19cdab\MSSSys\
  • C:\Documents and Settings\All Users\Application Data\SMEYFE
  • %UserProfile%\Application Data\Smart Engine\
  • %UserProfile%\Application Data\Smart Engine\cookies.sqlite
  • %UserProfile%\Application Data\Smart Engine\Instructions.ini

%UserProfile% refers to:
C:\Documents and Settings\ (for Windows 2000/XP)
C:\Users\[User Name]\AppData (for Windows Vista & Windows 7)

Registry values:
  • HKEY_CURRENT_USER\Software\3
  • HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
  • HKEY_CLASSES_ROOT\SMae0_2129.DocHostUIHandler
  • HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "{searchTerms}"
  • HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "{searchTerms}"
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" = ""
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures = "1"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http="
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "Version/10.02129"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "DisallowRun" = "1"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Smart Engine"
  • HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "{searchTerms}"
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
Share this information with other people:


Stuart said...

Hello, My girlfriends mum was just infected with this SmartEngine. I have previously been infected with something very similar which I successfuly removed with Malwarebytes' AntiMalware so I used Malwarebytes' Antimalware to remove it from her computer. Now I see this blog and I have not done the steps you list numbered 1 and 2. Are these steps required or am I alright only with running malwarebytes' ?

Admin said...

Hello, that's OK. You don't need to do the first two steps if you can download anti-malware software without any problems. Run Malwarebytes and if it fails to remove Smart Engine then try other software, i.e. SUPERAntispyware. Best of Luck!

Anonymous said...

Hola a mi lo que me pasa es que de tanto que toque lo quite pero no puedo quitarlo del centro de seguridad del panel de control, windows me lo reconoce como antivirus y no me deja instalar AVG porque antes me pide que lo quite? Que me recomiendas?? Saludos

Anonymous said...

Hi, I just wanted to say thank you sooo much!! to you. You saved me!
After 5 hours of fighting Trojan/Exploit, this Smart Engine kept appering and I didn't know how to remove...
Thank you again!

PS. I got the Trojan/Exploit by just clicking a CV sample on the 1st page of Google Image Search.(Even though two security softwares were running...)
Be careful everyone!

Anonymous said...

THANK YOU SO MUCH! I don't know a lot about computers and when I got this virus I didn't know what to do. I tried several other things to no avail and was about to think I'd have to take it to an expert. But this did the trick! I am very grateful!

Anonymous said...

I have a Mac and I don't have to worry about anything like this! Thank you Steve Jobs! ;)

Anonymous said...

only because no one bothers trying to infectt macs - why would you? four per cent of the market is nothing

Anonymous said...

Apple wants to avoid the word getting out that (MacIntels) are just PCs! ;)

JuanMarcoRodriguez said...

whoa..i gotta thank you for these tips...just a minute ago..i got this problem dealing with that SMART ENGINE....i just followed then voila! ..its gone...that does it!

Anonymous said...

Presto, it's magic!!! Back to FarmVille and CafeWorld...LOL. Thanks a lot.

Anonymous said...

I got infected with Smart Engine about last week. My mom didn't know what to do, so I used rkill and Malwarebytes to try to delete it. When I turned it back on, Smart Engine is STILL there, and my internet connection doesn't work. What should I do?

Nathan said...

Hello, what should I do if I have already used Malwarebytes and it has removed the virus, but I cannot get on the internet? I've tried restarting my computer several times, but i can't get online.

Anonymous said...

thank u sooooooooooooooooo much ... i finally removed that wretched smart engine after a long battle

Anonymous said...

I follwed your steps and an running the anti malware and during the setup wizzard its showing the Smart Engine as a problem but won't remove it. It's taking me to Add/Remove progams and SmartEngine isn't listed in their. I NEED HELP!!

Anonymous said...

I justed removed smart engine with MalwareBytes Anti-malware.

Thank you so much!

Anonymous said...

Yeah me too, got it from 1st page of Google Image Search (mountain bikes)

Anonymous said...

Hi, thanks a lot. I removed Smart Engine with your intructions just now.
Thanks again.

Anonymous said...

i saw this in the registry and deleted it as it was very similar to your list HKEY_CLASES_ROOT\SMc5e_179.DocHostUIHandler\Implements DocHostUIHandler.

Thanks for the write up!

Anonymous said...

I can't seem to find any of these files u have mentioned above after following your instructions. Smartengine has blocked my antivirus programs too.

Anonymous said...

Thank you, thank you, thank you

Eric said...

This removal instruction works. The renaming of the files is neccecary because 'Smart Engine' takes care of files other than 'iexplore.exe'. So renaming of items is needed. At my computer the directory and the file hosts the security was changed, the file was hidden, readonly and was a systemfile. So i had to change all back before i could do anything. The antivirusprogram 'McAfee' also stopped and couldn't be started. After the removalinstructions all worked again ... thanks ...

Anonymous said...

I have removed what appears to be all traces of this crap with SpyBot S&D, and no trace appears with Hijack This and all the registry entries have been removed, HOWEVER, my reinstalltion of McAfee continues to fail, and Windows Security Centre still reports Smart Engine as the antivirus of choice AND the task manager will not run. Any suggestions?

Admin said...

Run Hitman Pro and remove found infections.

Good luck!

RobinPanties said...

Those who said they used a program for removal and it worked, but no internet, use the tip above about unchecking proxy server in your Internet Options. Since, often IE is hijacked, i recommend going to Control Panel to get to the Internet Options, instead of opening IE to go to the tools, because, in theory, if your browser is hijakcked, just by opening it, could send you to a page that runs an unwanted activeX script, etc. and you may not ever get to the options. As for the proxy setting, that's actually a relatively tame way to "break" your connection, because lots of malware cripple or disable your connection through nastier, harder to remove techniques. However, browsers are designed to allow connections through proxy servers, if the system is connected to a server with a proxy, but by enabling proxy when your system is not connecting through a proxy, essentially, it is just not configured properly and therefore needs a setting changed. Also, it should be mentioned that, a good idea would be to run these programs "As Administrator" when available. In Windows Vista and 7, you can right-click the executable file [ie. "hijackthis.exe"] and select "Run as Administrator." This will allow the program to access the "Read Only" hosts file, etc. One other tip is, once you get your anti-malware program installed, download all updates, and then restart in safe mode. Sometimes, malware's presence in memory can prevent proper removal of bad files and by restarting in Safe Mode, proper removal is sometimes achieveable when it is not in Normal Mode and since it takes a long time to scan, why not do it the first time without a possible limitation. However, it's not a bad idea to run the scan again in Normal Mode once it's been completed in Safe Mode and the computer has been restarted again. Good Luck!

Anonymous said...


Anonymous said...

Help! I have the Smart Engine virus. I purchased Spyware Doctor which will not download and open. How do I rename the file to file or installer to iexplore.exe or winlogon.exe?? Thanks!

yossithamartinez said...

omg...i was going carzy with this smart engine!!!! i was going to purchase cuz se veia nice bu i never heard de el before so i searched on the internet ....i didnt sabia k era fake wow..i spend a week fighting this...thanks im so grateful omg now i can breath internet were so fast and when it got infected it was so its guys becarful..dont ever trust nothing en el internet ..thanks bye

Anonymous said...

Forget all the complicated stuff.
To keep it simple, all that needs to be done is download the process explorer tool. Go right to the bottom where the smart engine process is..

right click and Kill the process.
thats all folks.

barca96 said...

I already have Kaspersky Internet security.
I don't think I can install another anti virus software. I heard that it's going to crash my pc.
Is there another alternative to removing this virus?
Many thanks in advance

Admin said...


MalwareBytes Anti-malware
Spybot S&D
Hitman Pro 3.5

You can use these programs with Kaspersky Internet Security without any problems. Kaspersky Internet Security is antivirus software, Malwarebytes and other programs listed above are antimalware. Two different types. You can only run one antivirus program but you can run as many antispyware/antimalware programs as you like, just make sure they don't all have real time protection.

Good luck!

Anonymous said...

Help Its not possible to reach internet when starting up in safe mode with networking and boxes unchecked as discribed

barca96 said...

Thanks Admin,

I installed Malware and it deleted all the viruses.
BUT after restarting my desktop computer which was infected, I couldn't surf the internet anymore eventhough my computer is connected to the wireless modem. I tried to use both IE8 and Google Chrome, both gave me error messages.

I uninstalled both my Kaspersky and Malware bytes but the problem still persists.

However, I still can use the internet using my laptop(which isn't infected) to surf the net.

What should I do now?

Many thanks

Anonymous said...


Admin said...

No, unless you purchased it and now scammers have your credit card details.

Anonymous said...

Installed MAlware, and it removed the Smart Engine, but no internet! I also used the Process Explorer, but could not find the friggin virus. I'm getting email. I'll try the posting suggestions from Nov. 5

Anonymous said...

They need to prosecute these ass holes who come up with these scams! You NEVER hear that this or that scammer has gone to jail!

Tanor said...

I hate to bump an old topic, but if you are still watching this page, I would like you to help me if you can.

It seems that Smart Engine is not found on my computer, but it is claimed that it is there whenever I try to install my recently bought AVG 2012 Anti-Virus. Every time I try to install it, it says Smart Engine is blocking it.

I ran around to three different sites like Bleeping Computer, one other site and this one, and each method didn't work. Smart Engine is still there somewhere. Malwarebytes doesn't find it.

I tried to use Rkill to terminate the process, but Rkill didn't find it. When I use DDS to make a log of my processes, it says my Anti-Virus is Smart Engine. So by the methods I've tried, it still appears in the computer.

What should I do? Should I try this in safe-mode or still use other programs? Thank you for your reply and time.