Security Sphere 2012 Description

[+] Click Image to Enlarge

• 
• 
• 
• 
• 
• 
• 

Security Sphere 2012 – Just One More Clone of the Same Old Rogue Security Programs

Security Sphere 2012 is a rogue security application from an extensive family of rogue security programs. Some clones of Security Sphere 2012 include XP Anti-Spyware 2010, Win 7 Smart Security 2010, Desktop Defender 2010, Vista Guardian 2010, XP Internet Security 2011, and Vista Home Security 2011 – the list can go on forever, as there are many versions of these fake programs stretching back to at least 2009. Despite their different names and interface, they are, fundamentally, the same rogue security application, with a core that is reminiscent of older rogue security programs dating from as far back as 2005. According to ESG security researchers, there is no question that Security Sphere 2012 has absolutely no security components, existing mainly to scam computer users through deceptive tactics and alarming error messages. Security Sphere 2012 has been known to disable legitimate security programs and interact with known Trojans and rootkits. This is why ESG malware analysts recommend getting rid of Security Sphere 2012 immediately.

How Security Sphere 2012 Manifests Itself

Most rogue security programs cause the same symptoms on an infected computer: a large number of fake error messages, browser redirects and performance problems. Security Sphere 2012 uses a blue interface that is very similar to the interface for legitimate Windows security components. It also uses a colored shield logo that is meant to mimic the shield used in Microsoft Security Essentials and in Windows Security Center. However, these are only meant to fool inexperienced computer users into thinking that Security Sphere 2012 is actually a real anti-virus program approved by Microsoft. Security Sphere 2012 runs a fake scan automatically and then keeps showing alarming error messages until the victim gives up and decides to pay for a “full version” of Security Sphere 2012, in order to fix these fake problems. Security Sphere 2012 can show error messages as pop-up alerts, as well as notifications from the Windows Taskbar. Below is an example of a typical fake security alert from Security Sphere 2012:

Virus infection!
System security was found to be compromised. Your computer is now infected. Attention, irreversible changes may occur. Private data may be stolen.
Click here now for an instant anti-virus scan.
Taking Security Sphere 2012 to Task for Its Fake Security

Dealing with Security Sphere 2012

To stop most of Security Sphere 2012’s symptoms, you can use the registration code ‘2233-298080-3424.’ However, this will not remove Security Sphere 2012; it will only stop Security Sphere 2012 from displaying most of Security Sphere 2012’s most annoying features. To get rid of Security Sphere 2012, you will need to start up your computer in Safe Mode (so that Security Sphere 2012 will not block your anti-malware software) and then use a legitimate anti-malware utility to remove Security Sphere 2012 and all of its harmful components.

Type: Rogue AntiSpyware Programs

How Can You Detect Security Sphere 2012?

Security Sphere 2012 Technical Report

As new Security Sphere 2012 details are reported by our customers and findings from our Threat Research Center, we will update this section.

Fake message for Security Sphere 2012:

The following fake error message(s) appears for Security Sphere 2012:

Security Sphere 2012 Warning
Your computer is still infected with dangerous viruses. Activate antivirus protection to prevent data loss and avoid theft of your credit card details.
Click here to activate protection.

Warning message from Internet browser. This page under virus attack. This may crash your system.

This may be caused by:

- Virus content founded at this site trying to install its components.
- Malicious & unknown network processes are determined.
- Your system is under virus attack
- Negative references from other citizens concerning this web page.
- Your system ports and backdoors have been checked by visited page for external access.

Recommendations:

- Obtain a license of “Security Sphere 2012″ to protect your PC for the safest browsing Internet pages (desirable)
- Launch spyware, virus and malware scanning process.
- Keep browsing

Security Sphere 2012 Warning
Intercepting programs that may compromise your privacy and harm your system have been detected on your PC.
Click here to remove them immediately with Security Sphere 2012

Warning!
Application cannot be executed. The file notepad.exe is infected.
Please activate your antivirus software.

Warning: Your computer is infected
Detected spyware infection!
Click this message to install the last update of security software…

‘How Security Sphere 2012 Infects Your Computer’ Video

Security Sphere 2012 Removal Details

Security Sphere 2012 has typically the following processes in memory:

• %Documents and Settings%\[UserName]\Application Data\[RANDOM CHARACTERS].exe
• %Temp%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe

Security Sphere 2012 creates the following files in the system:

• %Documents and Settings%\[UserName]\Desktop\Security Sphere 2012.lnk
• %Documents and Settings%\[UserName]\Local Settings\Temp\[RANDOM CHARACTERS].tmp
• %Temp%\[RANDOM CHARACTERS]\

Security Sphere 2012 creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilte “Enabled” = “0″
• HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings “enablehttp1_1″ = ‘1′
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[RANDOM CHARACTERS].exe”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyEnable” = “1″
• HKEY_CURRENT_USER\Software\[RANDOM CHARACTERS]
• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION “svchost.exe”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “[RANDOM CHARACTERS]“

Important Article Disclaimer