Smart Protection 2012

Posted: January 19, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	89

First Seen:	January 19, 2012
Last Seen:	March 12, 2023
OS(es) Affected:	Windows

Smart Protection 2012 is a rogue antispyware program that, like most of its ilk, attempts to lure you into buying its full version by displaying inaccurate messages about PC threats on your hard drive. Since Smart Protection 2012 doesn't possess a real anti-malware database and is incapable of removing any of the viruses, Trojans and other types of malicious software that Smart Protection 2012 claims to thwart, SpywareRemove.com malware researchers recommend that you treat Smart Protection 2012 as a hostile entity and delete Smart Protection 2012 with real anti-malware software. However, since Smart Protection 2012 or related PC threats have been known to block security software to prevent Smart Protection 2012's removal, you should be prepared to use Safe Mode and other methods to disable Smart Protection 2012 before Smart Protection 2012 can be kicked out of your PC.

Why It's Not a Bright Idea to Trust Smart Protection 2012's PC Security

While Smart Protection 2012 looks like an anti-malware scanner in all external aspects, any attempt to use Smart Protection 2012 to remove PC threats will cause Smart Protection 2012 to ask you to purchase Smart Protection 2012, and even more damningly, the infections that Smart Protection 2012 says are on your PC aren't present at all. Consequently, you should never trust communications from Smart Protection 2012, especially regarding your computer's integrity, since following the advice of Smart Protection 2012's pop-ups may cause you to take self-destructive actions against your PC.

As a clone of previous types of scamware, Smart Internet Protection 2011, Smart Protection 2012 also exhibits other characteristics that are common to the WinWeb Security family of rogue anti-malware programs, such as:

Browser hijacks that redirect you to arbitrary websites – particularly hostile websites and sites that deal in pornographic content.
Program-blocking behavior that disables your ability to access unrelated software.

Since Smart Protection 2012 can be considered to be an active threat to your computer's security as well as a fraudulent nuisance, SpywareRemove.com malware experts recommend that you remove Smart Protection 2012 as soon as you find Smart Protection 2012 on your PC. Attempts to purchase or register Smart Protection 2012, even to ease the removal process, will only give your financial information into criminal possession, and exposure to sites that Smart Protection 2012 promotes may also result in other attacks against your PC (such as drive-by-downloads).

Using the Software That Smart Protection 2012 Doesn't Want You to Have

Although Smart Protection 2012 should be removed as soon as possible, SpywareRemove.com malware experts also caution that Smart Protection 2012 has a history of blocking anti-malware products that could remove Smart Protection 2012 or its clones that include Antivirus Security, System Security, AntiSpyware Pro 2009, Total Security, Total Security 2009, Security Tool, Trojan.RogueAV.a.gen, System Adware Scanner 2010, FakeAlert-KW.e, Advanced Security Tool 2010, System Tool 2011, MS Removal Tool, Antivirus Center, Security Shield, Personal Shield Pro, Advanced PC Shield 2012, Security Sphere 2012 and Futurro Antivirus.. In most cases, rebooting into Safe Mode is all that's necessary to disable this attack, although inadequately-updated anti-malware scanners may still be unable to detect Smart Protection 2012. Windows computers can access Safe Mode from the advanced startup options menu, which is opened after pressing F8 before Windows loads.

Besides blocking programs that could get rid of Smart Protection 2012, Smart Protection 2012 may also block other security-related applications, such as Windows Task Manager, the Command Prompt or the Registry Editor. Going without access to these applications for prolonged periods of time is strongly discouraged by SpywareRemove.com malware researchers, who note that they can play pivotal roles in identifying PC threats that should be removed by dedicated anti-malware applications.

Aliases

Suspicious file [Panda]TR/Dropper.Gen2 [AntiVir]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\ProgramData\529C5390000413CA0A1CB82DB4EB2367\529C5390000413CA0A1CB82DB4EB2367.exe

File name: 529C5390000413CA0A1CB82DB4EB2367.exe
Size: 315.39 KB (315392 bytes)
MD5: 092d1896584e15ae367a9a06a93a0ac8
Detection count: 74
File type: Executable File
Mime Type: unknown/exe
Path: C:\ProgramData\529C5390000413CA0A1CB82DB4EB2367
Group: Malware file
Last Updated: January 23, 2012

%ALLUSERSPROFILE%\B7E8586B0003F65D001EE87DB4EB2367\B7E8586B0003F65D001EE87DB4EB2367.exe

File name: B7E8586B0003F65D001EE87DB4EB2367.exe
Size: 315.39 KB (315392 bytes)
MD5: 5768fbcf56ee42e51697c9a65bc09259
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\B7E8586B0003F65D001EE87DB4EB2367
Group: Malware file
Last Updated: January 23, 2012

%UserProfile%\Desktop\Smart Protection 2012.lnk

File name: %UserProfile%\Desktop\Smart Protection 2012.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%AllUsersProfile%\[RANDOM CHARACTERS]\

File name: %AllUsersProfile%\[RANDOM CHARACTERS]\
Group: Malware file

%AppData%\Microsoft\Windows\Start Menu\Smart Protection 2012.lnk

File name: %AppData%\Microsoft\Windows\Start Menu\Smart Protection 2012.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%AppData%\Microsoft\Windows\Start Menu\Programs\Smart Protection 2012.lnk

File name: %AppData%\Microsoft\Windows\Start Menu\Programs\Smart Protection 2012.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

File name without pathSmart Protection 2012.lnkHKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[1 RANDOM]"HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Smart Protection 2012