dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
1009

bcastner
MVM
join:2002-09-25
Chevy Chase, MD

4 edits

4 recommendations

bcastner

MVM

Re: MonaRonaDona "virus"?

I guess we should be nicer to our Vista users. The following MonaRonaDona removal will work for either Windows XP or Windows Vista, Windows 2003 and Windows 2008:

1. Download HijackThis:
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
 

  • Save HJTinstall.exe to your desktop.
  • Double-click on the desktop icon for HJTinstall.exe.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis. It will also create a Desktop icon.
  • Double click the HijackThis icon on your Desktop to start the Program. Select "System scan only".

    Checkmark these items (if found):

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MonaRonaDona
    O4 - HKLM\..\Run: [.NET.] \FUD.exe
    O4 - Global Startup: SRVSPOOL.exe
    O4 - HKCU\..\Run: [RegistryCleanFixMFC] C:\Program Files\RegistryCleanFix2008\RegistryCleaner2008.exe


    Click "Fix checked", and when it finishes exit HijackThis.

    2. Please download to your Desktop OT_MOVEIT2.exe:
    http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
     
    

    Please double-click OTMoveIt2.exe to run the utility.
    {Vista users -- right click and "Run as Administrator"}
    Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy); or click on the little highlighted text on the top right of the Code box that says "copy to clipboard":

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Window Title
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Window Title
    HKEY_CURRENT_USER\Software\Microsoft\Outlook Express\\Window Title
    C:\Program Files\RegistryCleanFix2008
    C:\Program Files\UniGray Antivirus 
    C:\Documents and Settings\All Users\SRVSPOOL.EXE /S /D
    C:\Users\SRVSPOOL.EXE /S /D
     
     
    

    Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window.
    IMPORTANT -- Paste only into the bottom input panel (under the Yellow bar), The top panel will not help you.
    Right-click and choose Paste.

    Click the red Moveit button.
    This will take several minutes as a guess, as I am scanning the user profile folder completely.
    When it has finished, look in the the large right-hand panel that shows Results. You should see at least the principal infector files are deleted, and whatever applicable registry changes were made. (Not all might apply in your case.)
    Close OTMoveIt2 when it has finished.

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

    Now, Double click to open OTMOVEIT2 again.
    Click the green button, "CleanupUp!" at the top.
    {Note: it will need to access the internet to download a small script file. Please allow your Firewall to do so.}

    When it finishes it will have deleted all of its qauarantines, as well as the OTMOVEIT2 program and all created folders.

    Reboot.

    Best wishes,
    Bill Castner

  • Conestogaman
    @sbcglobal.net

    Conestogaman

    Anon

    Thanks for the help!! I, too, woke up to this on my 'puter. I 'may' have used the registryfix2008, but don't know for sure. I was trying to clean out another problem. Your help and tutorials cured more than this one problem and my 'puter is running much bettr now! Thank you again (can I say it too much?) for your 'good fight'!!

    Sincerely,

    Conestogaman
    BigMinge
    join:2008-03-03
    6109

    BigMinge to bcastner

    Member

    to bcastner
    Thanks for this. I to found this when i turned my comp on.

    kf
    @iinet.net.au

    kf to bcastner

    Anon

    to bcastner
    This was succesful in removing Monaronadona virus for me. Thankyou!

    dentalchick007
    @comcast.net

    dentalchick007 to bcastner

    Anon

    to bcastner
    Hey I did this to fix the virus and it worked for me! Nothing else did. Thank you so much.

    sc
    @rr.com

    sc to bcastner

    Anon

    to bcastner
    Thanks so much for the help. It worked and thank goodness it is gone.

    Oricat
    @optusnet.com.au

    Oricat to bcastner

    Anon

    to bcastner
    Hi... Thank-you for your help with this. I have followed you instructions and all has worked very well, until the last step! After clicking "MoveIt" all results were displayed in the right hand panel as "not found" I then exited and reopened OTMoveIt, when I clicked on CleanUp a message was displayed stating "Äccess Denied"??? I tried to repeat the second step, and each time I try to move the files; they move to the results screen then the programe stops responding??? Any ideas???? This is new Laptop, running Vista, Please Help!!!

    Cudni
    La Merma - Vigilado
    MVM
    join:2003-12-20
    Someshire

    1 edit

    1 recommendation

    Cudni

    MVM

    said by Oricat :

    I try to move the files; they move to the results screen then the programe stops responding??? Any ideas???? This is new Laptop, running Vista, Please Help!!!
    try
    "...
    If you have any issues, run the steps in Safe Mode...."

    edit: safe mode howto link
    »www.bleepingcomputer.com ··· ml#vista

    Cudni

    Oricat
    @dodo.com.au

    Oricat to bcastner

    Anon

    to bcastner
    Fantastic... That seemed to work! Thank-you Cudni and Thanks again to Bill... Much appreciated!

    MS
    @tng.ac.za

    MS to bcastner

    Anon

    to bcastner
    Thanks, It Helped
    omputeretard
    join:2008-03-04
    Decatur, IN

    omputeretard to bcastner

    Member

    to bcastner
    you are the man. i am primadona free thanks to you.

    AB57
    Premium Member
    join:2006-04-04
    equatorial

    1 recommendation

    AB57

    Premium Member

    All Hail bcastner See Profile, All Hail!

    Hopefully, this thread and this experience will cause a bit of a light bulb to come on for some of the less computer-literate.

    This infection is pure social engineering.

    Don't believe everything you see in a pop-up on your screen, in an e-mail, etc.
    In fact, don't even open unrecognized e-mails. Simply delete them.

    You have no unknown benefactor in Nigeria who has died and willed you a large amount of money, if only you could send the cash for the process to be transacted.

    You have no virus or other issue with your computer simply because some random and unrecognized pop-up says so, with the "guaranteed cure right here at this link".
    Etc.

    And when in doubt, don't do it.

    Learning from mistakes is a positive experience.
    Ignoring mistakes and continuing to make the same ones is strictly a dead-end street, and potentially a ticket to a financial nightmare or identity theft merry-go-round.

    It does keep folks busy in this forum, though.

    Mona Moaner to bcastner

    Anon

    to bcastner
    Thanks for the info to get Mona off, but now I can't shutdown my comp. However, after reboot, my task manager was enabled. I have to pull the power to shut down. It hangs when I go to Start/Shutdown. How can I fix this? I hope they shoot the b___stards that did this.

    MM

    qwerty714
    @verizon.net

    qwerty714 to bcastner

    Anon

    to bcastner
    it worked thank you so much you will be in my prayers tonight
    omputeretard
    join:2008-03-04
    Decatur, IN

    omputeretard to AB57

    Member

    to AB57
    well yeah i have learned a few things. but when i found errorsmart i was on the microsoft download site. what are they thinking? i mean its not very professional of them to go screwing people out of money. yay to corporate wool over my blind and unintelligent eyelids. it must have been an add or something that i assumed was from microsuck.
    omputeretard

    omputeretard to AB57

    Member

    to AB57
    well yeah i have learned a few things. but when i found errorsmart i was on the microsoft download site. what are they thinking? i mean its not very professinal of them to go screwing people out of money. yay to corperate wool over my blind and unintelligent eyelids. it must have been an add or something that i assumed was from microsuck.

    bcastner
    MVM
    join:2002-09-25
    Chevy Chase, MD

    bcastner to Mona Moaner

    MVM

    to Mona Moaner
    MonaRonaDona (and its "fix") come nowhere near any setting that would effect your ability to do a shutdown normally.

    I think it best you raise this as a new issue in the Security Cleanup Forum. Be sure to follow the prerquisite steps in large letters at the top of the Forum prior to posting.

    We will run some diagnostic tests to see what is up.

    Bill Castner

    Larry G
    @comcast.net

    Larry G to bcastner

    Anon

    to bcastner
    Thanks Thanks Thanks Yes, this solution really
    does work.. Some of the virus software folks haven't
    even found it -- their software does not identify or
    do anything to help. Your article is the best solution.

    Larry Gorin

    SingOlong
    @on.ca

    SingOlong to bcastner

    Anon

    to bcastner
    Cool man You are the coolest person on earth.

    eosab
    @wideopenwest.com

    eosab to bcastner

    Anon

    to bcastner
    THANK YOU!!!!! I could kiss you full on the lips for posting this cure. I would have been one of those people who bought the antivirus software... after searching and getting frustrated... I was willing to try anything. You saved me $40 and restored my faith in the kindness of total strangers. Today, you are my hero.

    Thanks again,
    Elissa

    ME user
    @charter.com

    ME user to bcastner

    Anon

    to bcastner
    I have an old laptop with Windows ME and got that blamed mona thing. Is there a fix for this OS?

    Name Game
    Premium Member
    join:2002-07-07
    Grand Rapids, MI

    2 edits

    1 recommendation

    Name Game

    Premium Member

    said by ME user :

    I have an old laptop with Windows ME and got that blamed mona thing. Is there a fix for this OS?
    Bill Responded to you in the next post.. edit

    But it is still a good suggestion to head to this forum section and follow the instruction to then post a hijacthis log..someone will help you there.

    »Security Cleanup

    you will be asked first to do these steps..
    »Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

    But it will be worth it since those experts will then give you other suggestions on how to keep you system safe.

    And I suggested that to anyone else that got whacked with this monaronadona..since chances are you could have other bad boys on your PC and they will help you clean them off and get your system running smoother and faster in many cases.

    bcastner
    MVM
    join:2002-09-25
    Chevy Chase, MD

    1 edit

    bcastner to ME user

    MVM

    to ME user
    Either of the two fixes in this thread (first page) should work on Windows ME. The first method is likely a better choice for ME (only because I cannot test the second method under ME ahead of time for you.):

    See the two links here to access the choices directly: »Re: MonaRonaDona "virus"?

    Lisa71
    @bellsouth.net

    Lisa71 to bcastner

    Anon

    to bcastner
    IT WORKED!!! Thank You!!!

    Snowbunny85
    @cox.net

    Snowbunny85 to bcastner

    Anon

    to bcastner
    My comp has this virus and it has gotten so bad that it has disabled EVERYTHING!! I can't even get online with it....is there any way to get rid of it without having to access the internet??

    bcastner
    MVM
    join:2002-09-25
    Chevy Chase, MD

    bcastner

    MVM

    Use the script solution, as nothing needs to be downloaded:
    »Re: MonaRonaDona "virus"?

    jefe
    Premium Member
    join:2001-05-19
    Northport, NY

    jefe

    Premium Member

    I've scanned through this thread and one thing that hasn't popped out is...how did those that got infected do so?

    If I missed it...sorry. But it would be interesting to know how the bad guy wound up on infected machines so others won't make the same mistake.

    bcastner
    MVM
    join:2002-09-25
    Chevy Chase, MD

    1 edit

    bcastner

    MVM

    jefe,

    See: »Re: MonaRonaDona "virus"?
    bcastner

    1 recommendation

    bcastner to jefe

    MVM

    to jefe
    quote:
    Well, as we research further into the so-called MonaRonaDona virus, Registry Cleaner 2008, and Unigray Antivirus, we find characteristics common to each executable binary, leading us to believe with a high level of confidence that not only are the binaries from the same group, but they were developed on the same machine.

    We performed a forensic investigation of the binaries, and in the Sherlock Holmes style we can say that the author of these masterpieces is a male (possibly Pakistani), who lives in Netherlands and speaks Dutch, in his mid 30-ies, who is a freelance programmer in C++ (MFC/ATL), who is also a soccer fan, wants to study in the U.S. or Pakistan as a Fulbright scholar and likes looking at Maria Ford and Jordon Ladd. Our Mr. X has no permanent job, so he takes the projects from his bosses to build these rogue antivirus solutions and pay his rent. He wants better projects and wants to run his own business. It is his bosses who are the real masterminds behind Unigray Antivirus and MonaRonaDona - not this man himself.

    Clues?

    Well, the executable was compiled on a Windows box with the Netherlands regional settings using Microsoft Visual Studio 8 and MFC/ATL settings.
    MonaRonaDona is likely a word-play with Maradona - M(on)ar(on)adona, whose fans are likely to be in their mid 30-ies and older.
    An ELance trace leads us to the web portal where freelance programmers can be hired.
    Multiple others litter the files.

    It's Elementary, My Dear Watson!

    »blog.threatfire.com/

    Sicilianshory
    @bresnan.net

    Sicilianshory to Conestogaman

    Anon

    to Conestogaman
    Yep, I think I got the monaronadona from the registrycleanfix2008! And you have to pay for it, which is really what sux! But the registry does have a MBG nd I deleted the srvspool.exe but still have the monaronadona on my internet explorer toolbar! UGG!