Security Sphere 2012

Security Sphere 2012 Description

Screenshot

Security Sphere 2012 – Just One More Clone of the Same Old Rogue Security Programs

Security Sphere 2012 is a rogue security application from an extensive family of rogue security programs. Some clones of Security Sphere 2012 include XP Anti-Spyware 2010, Win 7 Smart Security 2010, Desktop Defender 2010, Vista Guardian 2010, XP Internet Security 2011, and Vista Home Security 2011 – the list can go on forever, as there are many versions of these fake programs stretching back to at least 2009. Despite their different names and interface, they are, fundamentally, the same rogue security application, with a core that is reminiscent of older rogue security programs dating from as far back as 2005. According to ESG security researchers, there is no question that Security Sphere 2012 has absolutely no security components, existing mainly to scam computer users through deceptive tactics and alarming error messages. Security Sphere 2012 has been known to disable legitimate security programs and interact with known Trojans and rootkits. This is why ESG malware analysts recommend getting rid of Security Sphere 2012 immediately.

How Security Sphere 2012 Manifests Itself

Most rogue security programs cause the same symptoms on an infected computer: a large number of fake error messages, browser redirects and performance problems. Security Sphere 2012 uses a blue interface that is very similar to the interface for legitimate Windows security components. It also uses a colored shield logo that is meant to mimic the shield used in Microsoft Security Essentials and in Windows Security Center. However, these are only meant to fool inexperienced computer users into thinking that Security Sphere 2012 is actually a real anti-virus program approved by Microsoft. Security Sphere 2012 runs a fake scan automatically and then keeps showing alarming error messages until the victim gives up and decides to pay for a "full version" of Security Sphere 2012, in order to fix these fake problems. Security Sphere 2012 can show error messages as pop-up alerts, as well as notifications from the Windows Taskbar. Below is an example of a typical fake security alert from Security Sphere 2012:

Virus infection!
System security was found to be compromised. Your computer is now infected. Attention, irreversible changes may occur. Private data may be stolen.
Click here now for an instant anti-virus scan.
Taking Security Sphere 2012 to Task for Its Fake Security

Dealing with Security Sphere 2012

To stop most of Security Sphere 2012's symptoms, you can use the registration code '2233-298080-3424.' However, this will not remove Security Sphere 2012; it will only stop Security Sphere 2012 from displaying most of Security Sphere 2012's most annoying features. To get rid of Security Sphere 2012, you will need to start up your computer in Safe Mode (so that Security Sphere 2012 will not block your anti-malware software) and then use a legitimate anti-malware utility to remove Security Sphere 2012 and all of its harmful components.

Technical Information

Screenshots & Other Imagery

Tip: Turn your sound ON and watch the video in Full Screen mode to fully experience how Security Sphere 2012 infects a computer.

Security Sphere 2012 Video

Security Sphere 2012 Image 1 Security Sphere 2012 Image 2 Security Sphere 2012 Image 3 Security Sphere 2012 Image 4 Security Sphere 2012 Image 5 Security Sphere 2012 Image 6 Security Sphere 2012 Image 7

File System Details

Security Sphere 2012 creates the following file(s):
# File Name Size MD5
1 %Documents and Settings%\[UserName]\Application Data\[RANDOM CHARACTERS].exe
2 %Temp%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe
3 %Documents and Settings%\[UserName]\Desktop\Security Sphere 2012.lnk
4 %Documents and Settings%\[UserName]\Local Settings\Temp\[RANDOM CHARACTERS].tmp
5 %Temp%\[RANDOM CHARACTERS]\
6 %ALLUSERSPROFILE%\Application Data\nN02901GfNiF02901\nN02901GfNiF02901.exe 376,832 d6365c3365a53b513780bda09c0ba7b2
7 %ALLUSERSPROFILE%\Application Data\Mn02901GfNiF02901\Mn02901GfNiF02901.exe 393,216 c5a3cf0e35d42ba557bd7bdbbb883409
8 %ALLUSERSPROFILE%\Application Data\Lo02901GfNiF02901\Lo02901GfNiF02901.exe 380,928 8ade31ea6af2a42c522696eb375e76eb
9 %ALLUSERSPROFILE%\Application Data\eE02901GfNiF02901\eE02901GfNiF02901.exe 385,024 8aa04ec92727f9c527bdab2e88ed5154
10 %ALLUSERSPROFILE%\Application Data\vL02901GfNiF02901\vL02901GfNiF02901.exe 385,024 88b31496141aede9c1b336a5e7ebe756

Registry Details

Security Sphere 2012 creates the following registry entry or registry entries:
Regexp file mask
%AllUsersProfile%\??????????\[RANDOM CHARACTERS][NUMBERS].exe
RegistryKey
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilte "Enabled" = "0"
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings "enablehttp1_1" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS].exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
HKEY_CURRENT_USER\Software\[RANDOM CHARACTERS]
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION "svchost.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "[RANDOM CHARACTERS]"

More Details on Security Sphere 2012

The following messages associated with Security Sphere 2012 were found:
Security Sphere 2012 Warning
Intercepting programs that may compromise your privacy and harm your system have been detected on your PC.
Click here to remove them immediately with Security Sphere 2012
Security Sphere 2012 Warning
Your computer is still infected with dangerous viruses. Activate antivirus protection to prevent data loss and avoid theft of your credit card details.
Click here to activate protection.
Warning message from Internet browser. This page under virus attack. This may crash your system.

This may be caused by:

- Virus content founded at this site trying to install its components.
- Malicious & unknown network processes are determined.
- Your system is under virus attack
- Negative references from other citizens concerning this web page.
- Your system ports and backdoors have been checked by visited page for external access.

Recommendations:

- Obtain a license of "Security Sphere 2012" to protect your PC for the safest browsing Internet pages (desirable)
- Launch spyware, virus and malware scanning process.
- Keep browsing
Warning!
Application cannot be executed. The file notepad.exe is infected.
Please activate your antivirus software.
Warning: Your computer is infected
Detected spyware infection!
Click this message to install the last update of security software...

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.


HTML is not allowed.

By Domesticus in Rogue Anti-Spyware Program
Translate To: Português
Threat Scorecard
?
The ESL Threat Scorecard is an assessment report that is given to every malware threat that has been collected and analyzed through our Malware Research Center. The ESL Threat Scorecard evaluates and ranks each threat by using several metrics such as trends, incidents and severity over time.

In addition to the effective scoring for each threat, we are able to interpret anonymous geographic data to list the top three countries infected with a particular threat. The data used for the ESL Threat Scorecard is updated daily and displayed based on trends for a 30-day period. The ESL Threat Scorecard is a useful tool for a wide array of computer users from end users seeking a solution to remove a particular threat or security experts pursuing analysis and research data on emerging threats.

Each of the fields listed on the ESL Threat Scorecard, containing a specific value, are as follows:

Ranking: The current ranking of a particular threat among all the other threats found on our malware research database.

Threat Level: The level of threat a particular computer threat could have on an infected computer. The threat level is based on a particular threat's behavior and other risk factors. We rate the threat level as low, medium or high. The different threat levels are discussed in the SpyHunter Risk Assessment Model.

Infected Computer: The number of confirmed and suspected cases of a particular threat detected on infected computers retrieved from diagnostic and scan log reports generated by SpyHunter's Spyware Scanner.

% Change: The daily percent change in the frequency of infected computers of a specific threat. The formula for percent changes results from current trends of a specific threat. An increase in the rankings of a specific threat yields a recalculation of the percentage of its recent gain. When a specific threat's ranking decreases, the percentage rate reflects its recent decline. For a specific threat remaining unchanged, the percent change remains in its current state. The % Change data is calculated and displayed in three different date ranges, in the last 24 hours, 7 days and 30 days. Next to the percentage change is the trend movement a specific malware threat does, either upward or downward, in the rankings. Each level of movement is color coded: a green up-arrow (∧) indicates a rise, a red down-arrow (∨) indicates a decline, and a brown equal symbol (=) indicates no change or plateaued.

Top 3 Countries Infected: Lists the top three countries a particular threat has targeted the most over the past month. This data allows computer users to track the geographic distribution of a particular threat throughout the world.
Ranking: N/A
Threat Level: 10
Infected Computers: 29