First, stop the program by killing the cipinbs program running. Then delete the directory in the user’s local profile, %local profile%\local settings\application data\some random string. Inside that directory, should find the cipinbs.exe program. Lastly, search the registry and delete any entries with cipinbs. I think I found two in our infected computer.