bcastner MVM join:2002-09-25 Chevy Chase, MD 4 edits
4 recommendations |
Re: MonaRonaDona "virus"?I guess we should be nicer to our Vista users. The following MonaRonaDona removal will work for either Windows XP or Windows Vista, Windows 2003 and Windows 2008: 1. Download HijackThis: http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
Save HJTinstall.exe to your desktop. Double-click on the desktop icon for HJTinstall.exe. By default it will install to C:\Program Files\Trend Micro\HijackThis. It will also create a Desktop icon. Double click the HijackThis icon on your Desktop to start the Program. Select "System scan only".
Checkmark these items (if found):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MonaRonaDona O4 - HKLM\..\Run: [.NET.] \FUD.exe O4 - Global Startup: SRVSPOOL.exe O4 - HKCU\..\Run: [RegistryCleanFixMFC] C:\Program Files\RegistryCleanFix2008\RegistryCleaner2008.exe
Click "Fix checked", and when it finishes exit HijackThis.
2. Please download to your Desktop OT_MOVEIT2.exe:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
Please double-click OTMoveIt2.exe to run the utility. {Vista users -- right click and "Run as Administrator"} Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy); or click on the little highlighted text on the top right of the Code box that says "copy to clipboard":
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Window Title
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Window Title
HKEY_CURRENT_USER\Software\Microsoft\Outlook Express\\Window Title
C:\Program Files\RegistryCleanFix2008
C:\Program Files\UniGray Antivirus
C:\Documents and Settings\All Users\SRVSPOOL.EXE /S /D
C:\Users\SRVSPOOL.EXE /S /D
Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window. IMPORTANT -- Paste only into the bottom input panel (under the Yellow bar), The top panel will not help you. Right-click and choose Paste.
Click the red Moveit button. This will take several minutes as a guess, as I am scanning the user profile folder completely. When it has finished, look in the the large right-hand panel that shows Results. You should see at least the principal infector files are deleted, and whatever applicable registry changes were made. (Not all might apply in your case.) Close OTMoveIt2 when it has finished.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
Now, Double click to open OTMOVEIT2 again. Click the green button, "CleanupUp!" at the top. {Note: it will need to access the internet to download a small script file. Please allow your Firewall to do so.}
When it finishes it will have deleted all of its qauarantines, as well as the OTMOVEIT2 program and all created folders.
Reboot.
Best wishes, Bill Castner |
|
|
Conestogaman
Anon
2008-Mar-3 11:24 am
Thanks for the help!! I, too, woke up to this on my 'puter. I 'may' have used the registryfix2008, but don't know for sure. I was trying to clean out another problem. Your help and tutorials cured more than this one problem and my 'puter is running much bettr now! Thank you again (can I say it too much?) for your 'good fight'!!
Sincerely,
Conestogaman |
|
|
to bcastner
Thanks for this. I to found this when i turned my comp on. |
|
|
kf @iinet.net.au |
to bcastner
This was succesful in removing Monaronadona virus for me. Thankyou! |
|
|
dentalchick007 to bcastner
Anon
2008-Mar-3 9:57 pm
to bcastner
Hey I did this to fix the virus and it worked for me! Nothing else did. Thank you so much. |
|
|
|
to bcastner
Thanks so much for the help. It worked and thank goodness it is gone. |
|
|
Oricat to bcastner
Anon
2008-Mar-4 3:53 am
to bcastner
Hi... Thank-you for your help with this. I have followed you instructions and all has worked very well, until the last step! After clicking "MoveIt" all results were displayed in the right hand panel as "not found" I then exited and reopened OTMoveIt, when I clicked on CleanUp a message was displayed stating "Äccess Denied"??? I tried to repeat the second step, and each time I try to move the files; they move to the results screen then the programe stops responding??? Any ideas???? This is new Laptop, running Vista, Please Help!!! |
|
CudniLa Merma - Vigilado MVM join:2003-12-20 Someshire 1 edit
1 recommendation |
Cudni
MVM
2008-Mar-4 4:15 am
said by Oricat :
I try to move the files; they move to the results screen then the programe stops responding??? Any ideas???? This is new Laptop, running Vista, Please Help!!! try "... If you have any issues, run the steps in Safe Mode...." edit: safe mode howto link » www.bleepingcomputer.com ··· ml#vistaCudni |
|
|
Oricat to bcastner
Anon
2008-Mar-4 4:56 am
to bcastner
Fantastic... That seemed to work! Thank-you Cudni and Thanks again to Bill... Much appreciated! |
|
MS @tng.ac.za |
to bcastner
Thanks, It Helped |
|
|
to bcastner
you are the man. i am primadona free thanks to you. |
|
AB57 Premium Member join:2006-04-04 equatorial
1 recommendation |
AB57
Premium Member
2008-Mar-4 12:37 pm
All Hail bcastner , All Hail! Hopefully, this thread and this experience will cause a bit of a light bulb to come on for some of the less computer-literate. This infection is pure social engineering. Don't believe everything you see in a pop-up on your screen, in an e-mail, etc. In fact, don't even open unrecognized e-mails. Simply delete them. You have no unknown benefactor in Nigeria who has died and willed you a large amount of money, if only you could send the cash for the process to be transacted. You have no virus or other issue with your computer simply because some random and unrecognized pop-up says so, with the "guaranteed cure right here at this link". Etc. And when in doubt, don't do it. Learning from mistakes is a positive experience. Ignoring mistakes and continuing to make the same ones is strictly a dead-end street, and potentially a ticket to a financial nightmare or identity theft merry-go-round. It does keep folks busy in this forum, though. |
|
|
Mona Moaner to bcastner
Anon
2008-Mar-4 12:41 pm
to bcastner
Thanks for the info to get Mona off, but now I can't shutdown my comp. However, after reboot, my task manager was enabled. I have to pull the power to shut down. It hangs when I go to Start/Shutdown. How can I fix this? I hope they shoot the b___stards that did this.
MM |
|
|
qwerty714 to bcastner
Anon
2008-Mar-4 12:51 pm
to bcastner
it worked thank you so much you will be in my prayers tonight |
|
|
to AB57
well yeah i have learned a few things. but when i found errorsmart i was on the microsoft download site. what are they thinking? i mean its not very professional of them to go screwing people out of money. yay to corporate wool over my blind and unintelligent eyelids. it must have been an add or something that i assumed was from microsuck. |
|
omputeretard |
to AB57
well yeah i have learned a few things. but when i found errorsmart i was on the microsoft download site. what are they thinking? i mean its not very professinal of them to go screwing people out of money. yay to corperate wool over my blind and unintelligent eyelids. it must have been an add or something that i assumed was from microsuck. |
|
bcastner MVM join:2002-09-25 Chevy Chase, MD |
to Mona Moaner
MonaRonaDona (and its "fix") come nowhere near any setting that would effect your ability to do a shutdown normally.
I think it best you raise this as a new issue in the Security Cleanup Forum. Be sure to follow the prerquisite steps in large letters at the top of the Forum prior to posting.
We will run some diagnostic tests to see what is up.
Bill Castner |
|
|
Larry G to bcastner
Anon
2008-Mar-4 3:19 pm
to bcastner
Thanks Thanks Thanks Yes, this solution really does work.. Some of the virus software folks haven't even found it -- their software does not identify or do anything to help. Your article is the best solution.
Larry Gorin |
|
|
SingOlong to bcastner
Anon
2008-Mar-4 3:26 pm
to bcastner
Cool man You are the coolest person on earth. |
|
|
eosab to bcastner
Anon
2008-Mar-4 4:04 pm
to bcastner
THANK YOU!!!!! I could kiss you full on the lips for posting this cure. I would have been one of those people who bought the antivirus software... after searching and getting frustrated... I was willing to try anything. You saved me $40 and restored my faith in the kindness of total strangers. Today, you are my hero.
Thanks again, Elissa |
|
|
ME user to bcastner
Anon
2008-Mar-4 4:19 pm
to bcastner
I have an old laptop with Windows ME and got that blamed mona thing. Is there a fix for this OS? |
|
Name Game Premium Member join:2002-07-07 Grand Rapids, MI 2 edits
1 recommendation |
said by ME user :
I have an old laptop with Windows ME and got that blamed mona thing. Is there a fix for this OS? Bill Responded to you in the next post.. edit But it is still a good suggestion to head to this forum section and follow the instruction to then post a hijacthis log..someone will help you there. » Security Cleanupyou will be asked first to do these steps.. » Security Cleanup FAQ » Mandatory Steps Before Requesting AssistanceBut it will be worth it since those experts will then give you other suggestions on how to keep you system safe. And I suggested that to anyone else that got whacked with this monaronadona..since chances are you could have other bad boys on your PC and they will help you clean them off and get your system running smoother and faster in many cases. |
|
bcastner MVM join:2002-09-25 Chevy Chase, MD 1 edit |
to ME user
Either of the two fixes in this thread (first page) should work on Windows ME. The first method is likely a better choice for ME (only because I cannot test the second method under ME ahead of time for you.): See the two links here to access the choices directly: » Re: MonaRonaDona "virus"? |
|
|
Lisa71 to bcastner
Anon
2008-Mar-4 5:15 pm
to bcastner
IT WORKED!!! Thank You!!! |
|
|
Snowbunny85 to bcastner
Anon
2008-Mar-4 7:05 pm
to bcastner
My comp has this virus and it has gotten so bad that it has disabled EVERYTHING!! I can't even get online with it....is there any way to get rid of it without having to access the internet?? |
|
bcastner MVM join:2002-09-25 Chevy Chase, MD |
Use the script solution, as nothing needs to be downloaded: » Re: MonaRonaDona "virus"? |
|
jefe Premium Member join:2001-05-19 Northport, NY |
jefe
Premium Member
2008-Mar-4 7:32 pm
I've scanned through this thread and one thing that hasn't popped out is...how did those that got infected do so?
If I missed it...sorry. But it would be interesting to know how the bad guy wound up on infected machines so others won't make the same mistake. |
|
bcastner MVM join:2002-09-25 Chevy Chase, MD 1 edit |
|
|
bcastner
1 recommendation |
to jefe
quote: Well, as we research further into the so-called MonaRonaDona virus, Registry Cleaner 2008, and Unigray Antivirus, we find characteristics common to each executable binary, leading us to believe with a high level of confidence that not only are the binaries from the same group, but they were developed on the same machine.
We performed a forensic investigation of the binaries, and in the Sherlock Holmes style we can say that the author of these masterpieces is a male (possibly Pakistani), who lives in Netherlands and speaks Dutch, in his mid 30-ies, who is a freelance programmer in C++ (MFC/ATL), who is also a soccer fan, wants to study in the U.S. or Pakistan as a Fulbright scholar and likes looking at Maria Ford and Jordon Ladd. Our Mr. X has no permanent job, so he takes the projects from his bosses to build these rogue antivirus solutions and pay his rent. He wants better projects and wants to run his own business. It is his bosses who are the real masterminds behind Unigray Antivirus and MonaRonaDona - not this man himself.
Clues?
Well, the executable was compiled on a Windows box with the Netherlands regional settings using Microsoft Visual Studio 8 and MFC/ATL settings. MonaRonaDona is likely a word-play with Maradona - M(on)ar(on)adona, whose fans are likely to be in their mid 30-ies and older. An ELance trace leads us to the web portal where freelance programmers can be hired. Multiple others litter the files.
It's Elementary, My Dear Watson!
» blog.threatfire.com/ |
|
|
to Conestogaman
Yep, I think I got the monaronadona from the registrycleanfix2008! And you have to pay for it, which is really what sux! But the registry does have a MBG nd I deleted the srvspool.exe but still have the monaronadona on my internet explorer toolbar! UGG! |
|