System Protection 2012 Description

[+] Click Image to Enlarge

• 

System Protection 2012 is an iteration of the FakeScanti Trojan, a malware infection that is well known for involving a variety of fake security applications. Towards the end of 2011, the criminals behind the FakeScanti Trojan have started releasing versions of many clones of rogue anti-malware programs associated with this Trojan, adding the ‘2012′ suffix to the title. Do not believe System Protection 2012’s name, this application will not offer any kind of protection for your computer system. Furthermore, despite the 2012 in System Protection 2012’s name, this malware is no different from previous versions of this rogue anti-malware program, which have been released consistently since, at least, the year 2009. According to ESG security researchers, instead of protecting your system from malware, System Protection 2012 is a dangerous malware invader. The presence of System Protection 2012 on your computer system manifests itself in a variety of symptoms, which range from merely annoying to actively harmful to your computer system. Some examples of previous versions of System Protection 2012 include System Security 2011, Security Sphere 2012, OpenCloud Antivirus, Wolfram Antivirus, Internet Antivirus 2011, and Security Sphere 2011. While these programs (and their associated websites) may look fairly unique, the differences are only superficial. Under their interface, all of these are versions of System Protection 2012.

Recognizing a System Protection 2012 Infection in Your Computer System

Unlike other kinds of malware infections (such as spyware or Remote Access Tools) which work better if they remain hidden and undetected, rogue anti-malware programs like System Protection 2012 are designed to make their presence known as loudly and alarmingly as possible. This is why recognizing a System Protection 2012 infection on your computer system is not complicated at all; an infected computer system will display constant pop-up messages, fake scans and fake security alerts from System Protection 2012 (posing as a legitimate security program). The main difficulty in recognizing a System Protection 2012 infection is the fact that inexperienced computer users may fail to recognize System Protection 2012 for what System Protection 2012 is falling for the lie that System Protection 2012 is a legitimate security program which will help them. This is why ESG PC security researchers strongly recommend downloading security program only from reliable, well-reputed sources. Security programs that came seemingly out of nowhere or that was installed without the user’s consent, is usually a malware in disguise.

Type: Rogue AntiSpyware Programs

How Can You Detect System Protection 2012?

System Protection 2012 Technical Report

As new System Protection 2012 details are reported by our customers and findings from our Threat Research Center, we will update this section.

Fake message for System Protection 2012:

The following fake error message(s) appears for System Protection 2012:

Security Warning
Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer.
Click here to clean your PC immediately.

Warning infection found
Unwanted software (malware) or tracking cookies have been found during last scan. It is highly recommended to remove it from your computer.
Keylogger Zeus Keylogger Zeus is a very dangerous software used by criminals to steal personal data such as credit card information, access to banking accounts, passwords to social networks and e-mails.

System Protection 2012 Removal Details

System Protection 2012 has typically the following processes in memory:

• %AppData%\svhostu.exe
• %Temp%\svhostu.exe
• %System%\.exe
• %StartMenu%\Programs\Startup\crss.exe

System Protection 2012 creates the following files in the system:

• %AppData%\\System Protection 2012.ico
• %UserProfile%\Desktop\System Protection 2012.lnk
• %StartMenu%\Programs\System Protection 2012\System Protection 2012.lnk
• %AppData%\ldr.ini

System Protection 2012 creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “[RANDOM CHARACTERS]“
• HKEY_CURRENT_USER\Software\System Protection 2012

Important Article Disclaimer