ez2cy
join:2008-03-05
| reply to bcastner
Re: MonaRonaDona "virus"?
I truly have to apoligize as I'm computer illetrate.
As I mentioned in earlier post, I tried the "KillTrojan" thing (see, don't even know what to call things..LOL) and it appeared to have worked from I can gather. However, when I did a search for SRUSPOOL.EXE, it found a file, which I just deleted. Does this mean it's gone?
Also, as I said, IE is running real slow and not responding now. I know I read a post about it in this thread, but can not seem to find it. I've been sitting in front of the computer for hours and I'm brain dead.
Can someone point in the right direction to get IE working properly again?
Thank you for your help and patience with a computer moron...LOL |
|
La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
 ·Optimum Online
 ·Vonage
| reply to Glen M Borror
said by Glen M Borror :
Yeah, I just tried deleting it to, but it says access denied, and now I'm scared. I talked to my grandfather, who knows everything about computers and other stuff like that, says it's not a virus. Now I'm wondering, what does it really do then, if it is not a virus.
You need to read the entire thread.
Did you try the two fixes? If one doesn't work, try the other one. Using safe mode might be a good idea also.
»Re: MonaRonaDona "virus"?
»Re: MonaRonaDona "virus"?
--
10,675 DEADLY TERROR ATTACKS SINCE 9/11~~TEAM DISCOVERY
Can't feel you anymore, don't need you anymore, don't believe you anymore, I don't need you anymore
|
|
bcastner
Premium,VIP,MVM
join:2002-09-25
Chevy Chase, MD
clubs:
 ·Verizon Online DSL
1 edit | reply to ez2cy
MonaRonaDona is more annoyance than anything else. I cannot see how it would be related to any slowness in IE. One possibility that has surfaced in this long thread, is that it was not the only infection on the computer, just the most obvious.
Rather than spend hours in frustration, click on the "Security Cleanup" Forum, do the prerequisite steps bannered at the top of the Forum main page, and then submit a HijackThis log as a new reply. The folks there can use various utilities to ensure that there are no other problems, and if so, that they are competently removed.
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users
|
|
La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
·Optimum Online
·Vonage
1 edit | reply to ez2cy
said by ez2cy  :I truly have to apoligize as I'm computer illetrate. As I mentioned in earlier post, I tried the "KillTrojan" thing (see, don't even know what to call things..LOL) and it appeared to have worked from I can gather. However, when I did a search for SRUSPOOL.EXE, it found a file, which I just deleted. Does this mean it's gone? Also, as I said, IE is running real slow and not responding now. I know I read a post about it in this thread, but can not seem to find it. I've been sitting in front of the computer for hours and I'm brain dead. Can someone point in the right direction to get IE working properly again? Thank you for your help and patience with a computer moron...LOL You are not a moron! This is how you (all of us) learn, sometimes the hard way. 
Did you try rebooting after the fix? If so, and that didn't help, hang in there, someone will probably have another suggestion. Edit: like bcastner above. 
--
10,675 DEADLY TERROR ATTACKS SINCE 9/11~~TEAM DISCOVERY
Can't feel you anymore, don't need you anymore, don't believe you anymore, I don't need you anymore
|
|
Layman
|  reply to bcastner
Re MonaRonaDona.
What does a layman do to try and rid himself of Mona..etc?
I have reinistated Task Manger, got rid of the screen problem, and now find that every so often my keyboard stops responding, my computer restarts and IE OE get blocked off.
I was using AVG but it didn't stop this virus.
If I copy the above suggestions i.e. @echo off.. etc, what do I copy it into-just desktop?
Please advise.
Thanks  |
|
bcastner
Premium,VIP,MVM
join:2002-09-25
Chevy Chase, MD
clubs:
·Verizon Online DSL
| You open notepad and copy the contents of what you highlighted and Copy'ed with your mouse.
You save the file with a CMD extension. This tells XP or Vista that it is a batch file.
You double click the new file to execute the batch instructions it contains.
I do think in your case you would be better off with the second method provided: »Re: MonaRonaDona "virus"?
I note too, that MonaRonaDona does nothing to the keyboard. I strongly suspect you have other issues. Rather than do anything further at this point with MonaRonaDona, head to the "Security Cleanup" subForum, follow the instructins bannered in red at the top of the Main Page, and post a HijackThis log as a new topic.
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users
|
|
EGeezer
Go Bobcats
Premium
join:2002-08-04
Country!
·Callcentric
·RoadRunner Cable
·AT&T CallVantage
| reply to Glen M Borror
Take it from a fellow Appalachian-American - the folks in the cleanup forum are top-notch people, many of whom are industry-recognized experts. Take the issue over there, follow the bouncing ball and you'll get rid of MRD and any other malware that may be infesting your system
Of course you could pay some big box store tech a couple hundred smackers to borrow your files to their USB dongles, wipe your drive and reinstall Windows
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre |
|
Narcan1
@telus.net
| reply to bcastner
My brand new lap top became infected with this two days after start up. I was unable to clear it with Norton 2008, or anything else I could figure out. I took it to my tech guys, and they have been fighting with this extortion ware for three days. They were able to clear it up, without wiping the HD, and apparently Norton now has an update to kill it, or at least most of it. DO NOT USE the unigrey anti virus, as this will worsen the infection, also do not use REISTRY CLEANER 2008, this will also worsen the effects.
Good luck if you have this brand new bug, it can be killed but with a little work. |
|
jubal
@cox.net | reply to bcastner
How do I "download to desktop"? |
|
danny9
Go Ahead, Make My Day
Premium
join:2002-07-14
Clinton Township, MI
clubs:
·VoicePulse
·Comcast
| reply to bcastner
I don't have this virus but have been reading this thread with interest.
To me it's quite amazing the amount of knowledge the people here possess.
I've been around computers awhile now and have learned to do alot with them but reading some of the posts here I realize how much of a baby I am on the tech end. A long way to go.
But KUDOS to all of you with this knowledge and so willing to share it with us and help us.
Your time and efforts are truly appreciated. 
Thanks again,
Dan
--
VoicePulse 07/29/04 |
|
AB
Premium
join:2006-04-04
Leesburg, VA
| reply to jubal
said by jubal :
How do I "download to desktop"? You don't have to download it to there, any place you choose will be fine.
When downloading any file, the Desktop folder (or My Documents) is normally the default choice in the dialogue box as to where to save it, and makes it easy to find, as it's right there in front of you on your Desktop. |
|
bcastner
Premium,VIP,MVM
join:2002-09-25
Chevy Chase, MD
clubs:
·Verizon Online DSL
1 edit | reply to jubal
said by jubal :
How do I "download to desktop"?
To Windows, your Desktop is a folder like any other folder. Start the download, when it comes to the section asking for the filename to be used for the saved files, on the left will be icons for common folders. Such as Desktop. Choose this as the location to save the file. |
|
ME user
@charter.com
| reply to bcastner
After initially not having any luck with the removal, I tried again today. It worked, but what I did different is that I checked the 04 - SRVSSPOOL.exe (it didn't say 'Global Startup) when I didn't before for the reason in parentheses. I then did the MoveIt program. It froze after it moved the info to the right side. I had to do a hard boot but as of this writing everything seems back to normal. Thank you for your help.
As for how I got it: My 12 y/o was using this computer and either checked an email or got it from a game site called Marapets that she plays at all the time. I don't have an antivirus on this old computer but I guess I will need to now! |
|
Duckie
@aol.com | reply to bcastner
Cheers Bill you helped me get rid of mona for good i hope! Thanks mate |
|
ez2cy
join:2008-03-05 | reply to bcastner
As far as IE running slower and not responding. You were right, I followed your advise and did all the things in the security clean forum? and IE is back and running smoothly.
Thank you all so much for your help. |
|
jubal
@cox.net | reply to bcastner
Thanks for reply. When I try to download the OTMoveit2.exe page I get 404 Error |
|
bcastner
Premium,VIP,MVM
join:2002-09-25
Chevy Chase, MD
clubs: | It is a busy site.
I occasionally see the error as well due to this.
Wait a little while and try again. |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| reply to jubal
said by jubal :
Thanks for reply. When I try to download the OTMoveit2.exe page I get 404 Error
if it helps..
did you click on the place to copy it to your clipboard then immediately paste that in a new browser address bar and then go to that link ? I do not get an error.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
vredeling
| reply to bcastner
Re: MonaRonaDona revealed
Registry fix is the culprit in this social engineering scheme. The "testimonial" of Jim Brown on the website, is from the same (no doubt) alias that is in the postings pointing to the bogus virusscanner.
The program is featured on a sponsored link on Google »pc-tools-review.com/
It now becomes very tricky to distinguish legit reviews from illegit reviews. Also, on »pc-tools-review.com/ more products get reviewed. I am now not sure that the registry scanner is the only dowload that will infect the computer with the MonaRonaDona problem.
You have to hand it to these guys: they did come up with a pretty elaborate, clever scam.
Type in "registryfix.co"m" in the google search box and you'll understand how elaborate and potentially widespread and dangerous this scam is.
The trick is in the space between registry and fix. "Registry fix 2008" is a legitimate scanner by Registryfixer Inc. "Registryfix" is the scam (ww.registryfix.com) and gets featured on numerous "comparison" sites, some may be legit (editor error by leaving out the space) and some may be part of the scam (like the link »pc-tools-review.com/)
Hans Vredeling
New York, NY |
|
vredeling
| reply to Name Game
I almost fell victim to the "space issue". Here is my revised post.
Registryfix is the culprit in this social engineering scheme. The "testimonial" of Jim Brown on the website, is from the same (no doubt) alias that is in the postings pointing to the bogus virusscanner.
The program is featured on a sponsored link on Google »pc-tools-review.com/
It now becomes very tricky to distinguish legit reviews from illegit reviews. Also, on »pc-tools-review.com/ more products get reviewed. I am now not sure that the registry scanner is the only dowload that will infect the computer with the MonaRonaDona problem.
You have to hand it to these guys: they did come up with a pretty elaborate, clever scam.
Type in "registryfix.com" in the google search box and you'll understand how elaborate and potentially widespread and dangerous this scam is.
The trick is in the space between registry and fix. "Registry fix 2008" is a legitimate scanner by Registryfixer Inc. "Registryfix" is the scam (ww.registryfix.com) and gets featured on numerous "comparison" sites, some may be legit (editor error by leaving out the space) and some may be part of the scam (like the link »pc-tools-review.com/)
Hans Vredeling
New York, NY |
|
