Friday 21 October 2011

Security Sphere 2012 Removal - How To Guide

Security Sphere 2012 is a polished version of System Tool and MS Removal Tool with same malicious features. All these rogue products are created by the same family and they are creating new products like a clockwork. Every few months, they create a new rogue software with different name to avoid detection from antivirus programs.

Security Sphere 2012 is the latest malicious creation of on-line crooks and this software is spreading very fast. This rogue blocks all the running programs in your computer and won't let you run any application. Whenever you'll try to run a software, It will automatically close it and tell you that this software is infected.

Security Sphere 2012 gets into your system via compromised downloads, fake flash updates and other similar methods. It actually enters in a disguised manner to your computer and you won't even suspect that It is a rogue software. Once you install this software, It will conduct a complete scan of your computer and report numerous fake infections. None of these infections are actually present on your computer but the report is fabricated by Security Sphere 2012.

To remove those infections, you'll be asked to buy full version of Security Sphere 2012 which is equally useless. Don't pay money to these scammers and remove security sphere 2012 from your computer as soon as possible. Here is a screen shot of Security Sphere 2012 doing fake scan :



Security Sphere 2012 will configure itself to run at startup so that you can not stop it anyhow. Once running in your computer, It won't let you run anything.

We have tested behavior of this rogue and found that It doesn't block files having "explorer.exe" name. For this reason, download Process Explorer and save it as "explorer.exe" to your computer. Now run explorer.exe (Process Explorer) and you can end active process of Security Sphere 2012. Process Explorer works exactly as Windows Task Manager.

After ending active process of Security Sphere 2012, now you can download Spyware Doctor to remove the infection completely from your computer. Click the button below to download Spyware Doctor.


Security Sphere 2012 blocks everything and makes its removal much harder. You can follow these steps to remove Security Sphere 2012 from your computer easily :


1. Automatic Removal

Automatic Removal is the fastest solution to get rid of Security Sphere 2012. Automatic Removal is based on using a genuine anti-spyware software to clear the infections. Follow these steps to remove security sphere 2012 :

1. Restart your computer and press "F8" key on your keyboard during startup.

2. When you see a menu, select "Safe Mode With Networking" and start your computer. Security Sphere 2012 will not be run itself Safe Mode. If it somehow manages to run in Safe Mode,  download Process Explorer and save it as "explorer.exe" to your computer.

Now run explorer.exe (Process Explorer) and you can end active process of Security Sphere 2012 easily. This way Security Sphere 2012 won't intervene during removal and you can do your job easily.

3. After ending active process of Security Sphere 2012, run Internet Explorer and Download Spyware Doctor .Spyware Doctor's malware database is huge and It can easily catch viruses like Security Sphere 2012. After downloading, please install Spyware Doctor, install it and update its virus database.

After that, conduct a "Full Scan" of your computer and remove all the infections. That's it! On next reboot, you can boot up your computer in safe mode and everything will be back to normal. 


2. Manual Removal

Manual Removal method is not suitable for most computer users as It is very hard to follow and a minor mistake can cause big problems to your computer. To remove Security Sphere 2012 manually, you need to find and delete culprit files yourself. It can be a tough task If you are not well versed with computers. On the other hand, If you delete a wrong file mistakenly, It can be fatal for your computer.

You can follow these steps to remove the rogue software manually :

1. Boot up your computer in "Safe Mode with Networking Mode".
2. Run registry editor by clicking on Start-->Run, type regedit and click OK. Delete this registry entry :

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION "svchost.exe"
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings "enablehttp1_1" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "<random>"

Keep in mind that registry is a core part of your computer and editing it incorrectly may cause further problems to your computer.
  
3. After deleting above registry entries, please find and delete these files from your computer :

%AllUsersProfile%\<random>\
%AllUsersProfile%\<random>\<random>
%AllUsersProfile%\<random>\<random>.exe
 %StartMenu%\Programs\Security Sphere 2012.lnk

Follow above steps carefully and you should be able to remove Security Sphere 2012. Keep in mind that manual removal steps don't guarantee results. If the virus has changed its way of operating, manual removal steps may no longer work. To avoid all the hassles ans risk, you can opt for automatic removal method instead.

1 comment:

  1. You are awesome thanks for the information. I was able to remove this virus no more than 10 minutes after I received it.

    ReplyDelete