Security Sphere 2012

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 29
First Seen: September 29, 2011
Last Seen: September 9, 2019
OS(es) Affected: Windows

Security Sphere 2012 Image

Security Sphere 2012 – Just One More Clone of the Same Old Rogue Security Programs

Security Sphere 2012 is a rogue security application from an extensive family of rogue security programs. Some clones of Security Sphere 2012 include XP Anti-Spyware 2010, Win 7 Smart Security 2010, Desktop Defender 2010, Vista Guardian 2010, XP Internet Security 2011, and Vista Home Security 2011 – the list can go on forever, as there are many versions of these fake programs stretching back to at least 2009. Despite their different names and interface, they are, fundamentally, the same rogue security application, with a core that is reminiscent of older rogue security programs dating from as far back as 2005. According to ESG security researchers, there is no question that Security Sphere 2012 has absolutely no security components, existing mainly to scam computer users through deceptive tactics and alarming error messages. Security Sphere 2012 has been known to disable legitimate security programs and interact with known Trojans and rootkits. This is why ESG malware analysts recommend getting rid of Security Sphere 2012 immediately.

How Security Sphere 2012 Manifests Itself

Most rogue security programs cause the same symptoms on an infected computer: a large number of fake error messages, browser redirects and performance problems. Security Sphere 2012 uses a blue interface that is very similar to the interface for legitimate Windows security components. It also uses a colored shield logo that is meant to mimic the shield used in Microsoft Security Essentials and in Windows Security Center. However, these are only meant to fool inexperienced computer users into thinking that Security Sphere 2012 is actually a real anti-virus program approved by Microsoft. Security Sphere 2012 runs a fake scan automatically and then keeps showing alarming error messages until the victim gives up and decides to pay for a "full version" of Security Sphere 2012, in order to fix these fake problems. Security Sphere 2012 can show error messages as pop-up alerts, as well as notifications from the Windows Taskbar. Below is an example of a typical fake security alert from Security Sphere 2012:

Virus infection!
System security was found to be compromised. Your computer is now infected. Attention, irreversible changes may occur. Private data may be stolen.
Click here now for an instant anti-virus scan.
Taking Security Sphere 2012 to Task for Its Fake Security

Dealing with Security Sphere 2012

To stop most of Security Sphere 2012's symptoms, you can use the registration code '2233-298080-3424.' However, this will not remove Security Sphere 2012; it will only stop Security Sphere 2012 from displaying most of Security Sphere 2012's most annoying features. To get rid of Security Sphere 2012, you will need to start up your computer in Safe Mode (so that Security Sphere 2012 will not block your anti-malware software) and then use a legitimate anti-malware utility to remove Security Sphere 2012 and all of its harmful components.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

SpyHunter Detects & Remove Security Sphere 2012

Security Sphere 2012 Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Security Sphere 2012 may create the following file(s):
# File Name MD5 Detections
1. %Documents and Settings%\[UserName]\Application Data\[RANDOM CHARACTERS].exe
3. %Documents and Settings%\[UserName]\Desktop\Security Sphere 2012.lnk
4. %Documents and Settings%\[UserName]\Local Settings\Temp\[RANDOM CHARACTERS].tmp
6. nN02901GfNiF02901.exe d6365c3365a53b513780bda09c0ba7b2 0
7. Mn02901GfNiF02901.exe c5a3cf0e35d42ba557bd7bdbbb883409 0
8. Lo02901GfNiF02901.exe 8ade31ea6af2a42c522696eb375e76eb 0
9. eE02901GfNiF02901.exe 8aa04ec92727f9c527bdab2e88ed5154 0
10. vL02901GfNiF02901.exe 88b31496141aede9c1b336a5e7ebe756 0

Registry Details

Security Sphere 2012 may create the following registry entry or registry entries:
Regexp file mask
%AllUsersProfile%\??????????\[RANDOM CHARACTERS][NUMBERS].exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilte "Enabled" = "0"
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings "enablehttp1_1" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS].exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION "svchost.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "[RANDOM CHARACTERS]"


The following messages associated with Security Sphere 2012 were found:

Security Sphere 2012 Warning
Intercepting programs that may compromise your privacy and harm your system have been detected on your PC.
Click here to remove them immediately with Security Sphere 2012
Security Sphere 2012 Warning
Your computer is still infected with dangerous viruses. Activate antivirus protection to prevent data loss and avoid theft of your credit card details.
Click here to activate protection.
Warning message from Internet browser. This page under virus attack. This may crash your system.

This may be caused by:

- Virus content founded at this site trying to install its components.
- Malicious & unknown network processes are determined.
- Your system is under virus attack
- Negative references from other citizens concerning this web page.
- Your system ports and backdoors have been checked by visited page for external access.


- Obtain a license of "Security Sphere 2012" to protect your PC for the safest browsing Internet pages (desirable)
- Launch spyware, virus and malware scanning process.
- Keep browsing
Application cannot be executed. The file notepad.exe is infected.
Please activate your antivirus software.
Warning: Your computer is infected
Detected spyware infection!
Click this message to install the last update of security software...


Most Viewed