Remove Security Sphere 2012

Security Sphere 2012 is bogus computer security software provided by cyber criminals having the primary objective of stealing people’s money. A programmer behind Security Sphere 2012 uses a variety of techniques to intrude victim’s computer. Its entry is unnoticeable that even your installed antivirus application will not have a remark on its activities. In fact, first thing that Security Sphere 2012 will attack is your security protection. It makes your antivirus application unresponsive for risks and attacks. Security Sphere 2012 will start manipulating the computer once it sets inside. It begins with system files where it embeds own code. Next in line is your registry. Adding unnecessary values into it will launch Security Sphere 2012 every time a user has log-in to Windows system.

Security Sphere 2012 will report a number of threats identified on your computer. Don’t consider this report because it is a disposal coming from a program assuming as legitimate software. This promotional gimmick aims to persuade victims into purchasing the licensed version of Security Sphere 2012. The commercial product is highly recommended through falsified warnings and alerts issued on your desktop.

The right thing to do is to remove Security Sphere 2012 from your computer as soon as possible. This is achievable with the help of legitimate security product.

There are 3 steps to remove “Security Sphere 2012″ Virus:
1. Remove Rootkit Trojan.
2. Download Security Sphere 2012 Automatic Removal Tool below.
3. Manual Security Sphere 2012 Removal (Step-by-Step Procedure).

Recommended Program to Remove “Security Sphere 2012″:
- MalwareBytes Anti-Malware
- Norton Power Eraser

Remove Rootkit Trojan 

Rootkit Trojan is causing any anti-virus application to stop working. This Trojan is also responsible in bringing Security Sphere 2012 inside your computer. For us to be able to completely remove the fake software using the removal tool, we need to eliminate the Trojan first. Otherwise it will hamper the Security Sphere 2012 removal process by blocking execution of our removal tool.

1. Download Norton Power Eraser and save it to your desktop or any easy-to-access location on your hard drive.

2. Reboot your computer in Safe Mode with Networking. Internet connection is necessary at this point.
To reboot computer in Safe Mode with Networking:
- Turn on the computer, repeatedly press F8 on your keyboard until a black screen with Windows Advanced Options menu appears.
- Click on Safe Mode with Networking.
- If you have a dual boot system, select the version where you want to run Norton Power Eraser.
- A prompt will appear if you want to proceed to work in safe mode. Click Yes.

3. When Windows is already in Safe Mode. Locate the downloaded NPE.exe.

4. Double-click the file to run.

5. It will prompt for End User License Agreement. Click on Accept.

6. You will now see Norton Power Eraser main windows. Click Scan.

7. Next, it will give you an option wether you want to Include Rootkit Scan, please do so by clicking on Restart. Your computer will reboot. Please repeat the process above to reboot computer in Safe Mode with Networking.

8. After restarting the computer, NPE will prepare to scan for roortkit Trojan and Security Sphere 2012 related files.

9. Norton Power Eraser will begin the scan. This may take a while.

10. When completed scanning, it will show the Scan Complete window. It might contain threats detected on your machine.

11. Important! You must mark the Create System Restore Point before proceeding with fix. This is necessary just in case you accidentally deleted any legitimate file.

12. There are two categories, Detected and Suspicious. Be careful on deleting files that are in a suspicious category. Because of NPE’s aggressive technology, there are possibilities that even legitimate files can be labeled as suspicious.

13 Mark the file that you think is malicious. We cannot reveal the exact file name because Security Sphere 2012 is using random file name.

14. Click on Fix to remove.

15. Finally, it will advise to restart the computer.
 

“If you already bought Security Sphere 2012, immediately contact your credit card company to dispute the transaction.”

Automatic Security Sphere 2012 Removal:

1. Download MBAM and save it on a location on your PC. If unable to download from the contracted computer, use a clean one to download the file.

2. Using USB or Disc, transfer the downloaded file to infected computer. Just in case MBAM is blocked from installing, rename the installation files to ‘anything.exe’.

3. Install with the default settings. After installation, it should automatically download necessary database update.

4. If update is completed, reboot Windows in Safe Mode. Press F8 repeatedly before Windows starts to flash its logo. It will display the Windows Advanced Options menu, select Safe Mode.

5. When on Safe Mode of Windonws, locate the MalwareBytes’ Anti-Malware icon and double-click on it to start.

6. On main window, select Perform full scan and click on Scan to begin.

7. Once finished scanning, MBAM will display the result. Remove Security Sphere 2012 associated threats and repeat the process after restarting Windows in normal mode.

Security Sphere 2012 Manual Removal:

1. You need to stop Security Sphere 2012 process by pressing Ctrl+Alt+Del on the keyboard. Task Manager will open. Select Process tab to end the following:
- (random numbers).exe

2. If antivirus program is present, download necessary updates directly from the application. Never obtain software updates from unknown web sites. Updated database ensures that your security program will catch all the latest threats.

3. Perform full scan. The process may take a while. When finished, select all detected threats and remove. Items that cannot be removed should be place in quarantine instead.

4. Manually locate and delete following malicious files:
%AllUsersProfile%\(random two letters)(5 numbers)(random five letters)(5 numbers)
%AllUsersProfile%\(random two letters)(5 numbers)(random five letters)(5 numbers)\(random two letters)(5 numbers)(random five letters)(5 numbers)
%AllUsersProfile%\(random two letters)(5 numbers)(random five letters)(5 numbers)\(random two letters)(5 numbers)(random five letters)(5 numbers).exe

Note: File locations for versions of Windows may vary:
%AllUserProfile% for Windows XP user is located in C:\Documents and Settings\Current User, while for Windows Vista and 7 it is C:\Users\Current.

5. Open Windows registry editor by going to Start > Run or Search Program and Files and type regedit. Windows registry editor interface will show up. Find and delete the following entries/values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run “[(random two letters)(5 numbers)(random five letters)(5 numbers).exe]”

6. Remove Security Sphere 2012 from start-up entry of Windows by going to Start > Run and type msconfig. System Configuration Utility will open. Go to Startup tab and uncheck the following item:
- (random numbers).exe

Press Ok to save changes.

7. Restart the computer.