http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20082590 en Fri, 10 Feb 2012 06:42:48 EDT Fri, 10 Feb 2012 06:42:48 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20169344
Thanks for the help! It worked perfectly! ]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20169344 Sat, 15 Mar 2008 12:40:01 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20159960 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20159960 Thu, 13 Mar 2008 15:57:18 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20145135 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20145135 Tue, 11 Mar 2008 08:53:08 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20140774 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20140774 Mon, 10 Mar 2008 14:09:14 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20139192
Thanks for your earlier comments. I have now tried your "KillTrojan" prog., got the veryfast black-box happening, and then restarted my computer.
My OE andIE progs are running faster and I'm not "losing" keys on my keyboard, so I,m hopeful that all is well.(I replaced my Task manager using some previously gleaned information.)and it runs as normal, so I hope that all is well.
Thanks for your good help :) :)]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20139192 Mon, 10 Mar 2008 08:31:49 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20132629 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20132629 Sat, 08 Mar 2008 19:26:43 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20129310
Anyway to remove the name from your taskbar after you remove it out of windows:
Run Regedit.exe (in Windows XP or later) for your registry editor and look for string HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main (Then scroll down to window title and you will find the MonaRonaDona - DELETE IT!!!!!!!)
It should be gone next time you reboot your computer.]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20129310 Sat, 08 Mar 2008 00:34:34 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20128956 www.viruslist.com/en/weblog?done···07796935

According to the virus list it wounds as thought unigray anti-virus created this virus. Sounds like a good conclusion since they are the only program I can find that says they can remove it and according to the article this unigray has only been around 2 weeks (how convenient)!]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20128956 Fri, 07 Mar 2008 23:04:07 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20125318 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20125318 Fri, 07 Mar 2008 11:47:22 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20125173 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20125173 Fri, 07 Mar 2008 11:21:06 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20123305
The two "fixes" in this thread, only one of which need be done, are:

»Re: MonaRonaDona "virus"?
»Re: MonaRonaDona "virus"?
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users

]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20123305 Thu, 06 Mar 2008 23:14:42 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20123289 said by HOLLY3RN :

HI,
I AM SO LOST, MY COMPUTER HAS THIS MONARONADONA VIRUS, i THOUGHT I CLEANED IT OFF WITH MY AVG, BUT I DONT UNDERSTAND HOW TO GET THE MONA DONA RONA OFF OF MY HEADER AT THE TOP OF MY SCREEN, I TRIED TO READ ONE OF THE SITES YOU POSTED, BUT I AM LOST AND AM AFRAID I WILL REALLY SCREW UP MY COMPUTER, COULD YOU SUGGEST AN EASIER SITE FOR COMPUTER DUMMIES. THANKS HOLLYOne option would be to download and install Spywareblaster.

There's an option within that app to change IE's title bar, among other things.
An added benefit would be the additional anti-spyware protection that it offers.

»javacoolsoftware.com/spywareblaster.html

Though it's not going to remove any current or left-over MonaRonaDona crapola on your machine, beyond allowing you to make that one change.]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20123289 Thu, 06 Mar 2008 23:12:00 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20121359 I AM SO LOST, MY COMPUTER HAS THIS MONARONADONA VIRUS, i THOUGHT I CLEANED IT OFF WITH MY AVG, BUT I DONT UNDERSTAND HOW TO GET THE MONA DONA RONA OFF OF MY HEADER AT THE TOP OF MY SCREEN, I TRIED TO READ ONE OF THE SITES YOU POSTED, BUT I AM LOST AND AM AFRAID I WILL REALLY SCREW UP MY COMPUTER, COULD YOU SUGGEST AN EASIER SITE FOR COMPUTER DUMMIES. THANKS HOLLY]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20121359 Thu, 06 Mar 2008 17:24:18 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20120866 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20120866 Thu, 06 Mar 2008 16:05:05 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20120718
If you have issues with the first fix, then use the second. It has everything needed to remove the virus:
»Re: MonaRonaDona "virus"?]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20120718 Thu, 06 Mar 2008 15:41:07 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20119223 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20119223 Thu, 06 Mar 2008 12:10:21 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20119101 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20119101 Thu, 06 Mar 2008 11:54:28 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118673
»en.wikipedia.org/wiki/NoAdware

That is why this thread was begun.. you find the repairs that works at this link

»Re: MonaRonaDona "virus"?

and they are free. :D
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118673 Thu, 06 Mar 2008 10:39:40 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118610 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118610 Thu, 06 Mar 2008 10:31:49 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118124 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118124 Thu, 06 Mar 2008 08:51:37 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118055 »img69.imageshack.us/img69/4629/f···2dr6.jpg
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20118055 Thu, 06 Mar 2008 08:30:07 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20117601 www.prevx.com/blog/82/MonaRonaDo···PID.html]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20117601 Thu, 06 Mar 2008 04:12:44 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20117588 »graduates.com/ProfilePhotoView.a···e=Ashraf]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20117588 Thu, 06 Mar 2008 04:06:43 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20116888 MonaRonaDona ugly virus. Its box was on my screen for 2 days and I was trying for many hours a day to delete it. But only your help was excellent. Thank you very much! :) :D And yes, I was using Registryfix2008 the night before that virus appeared on my screen. So that was the way I got it....And by the way I was able to do just the first part, the second part with moving and cleaning did not work. But the virus was cleaned anyway with HijackThis. Thank you again. ]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20116888 Wed, 05 Mar 2008 23:26:22 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20116761 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20116761 Wed, 05 Mar 2008 23:00:29 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20116147
There are two fixes, different only in that on uses native batch scripting only; the other uses freeware utilities. Try them in the order given below. Using Safe Mode is a good idea for either:

»Re: MonaRonaDona "virus"?
»Re: MonaRonaDona "virus"?
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users

]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20116147 Wed, 05 Mar 2008 21:25:05 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115921 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115921 Wed, 05 Mar 2008 20:48:56 EDT http://www.dslreports.com/forum/MonaRonaDona-revealed-20115515
Registryfix is the culprit in this social engineering scheme. The "testimonial" of Jim Brown on the website, is from the same (no doubt) alias that is in the postings pointing to the bogus virusscanner.

The program is featured on a sponsored link on Google »pc-tools-review.com/

It now becomes very tricky to distinguish legit reviews from illegit reviews. Also, on »pc-tools-review.com/ more products get reviewed. I am now not sure that the registry scanner is the only dowload that will infect the computer with the MonaRonaDona problem.

You have to hand it to these guys: they did come up with a pretty elaborate, clever scam.

Type in "registryfix.com" in the google search box and you'll understand how elaborate and potentially widespread and dangerous this scam is.

The trick is in the space between registry and fix. "Registry fix 2008" is a legitimate scanner by Registryfixer Inc. "Registryfix" is the scam (ww.registryfix.com) and gets featured on numerous "comparison" sites, some may be legit (editor error by leaving out the space) and some may be part of the scam (like the link »pc-tools-review.com/)

Hans Vredeling
New York, NY]]> http://www.dslreports.com/forum/MonaRonaDona-revealed-20115515 Wed, 05 Mar 2008 19:42:52 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-revealed-20115459
The program is featured on a sponsored link on Google »pc-tools-review.com/

It now becomes very tricky to distinguish legit reviews from illegit reviews. Also, on »pc-tools-review.com/ more products get reviewed. I am now not sure that the registry scanner is the only dowload that will infect the computer with the MonaRonaDona problem.

You have to hand it to these guys: they did come up with a pretty elaborate, clever scam.

Type in "registryfix.co"m" in the google search box and you'll understand how elaborate and potentially widespread and dangerous this scam is.

The trick is in the space between registry and fix. "Registry fix 2008" is a legitimate scanner by Registryfixer Inc. "Registryfix" is the scam (ww.registryfix.com) and gets featured on numerous "comparison" sites, some may be legit (editor error by leaving out the space) and some may be part of the scam (like the link »pc-tools-review.com/)

Hans Vredeling
New York, NY]]> http://www.dslreports.com/forum/Re-MonaRonaDona-revealed-20115459 Wed, 05 Mar 2008 19:34:14 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115259 said by jubal :

Thanks for reply. When I try to download the OTMoveit2.exe page I get 404 Error
if it helps..
did you click on the place to copy it to your clipboard then immediately paste that in a new browser address bar and then go to that link ? I do not get an error.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115259 Wed, 05 Mar 2008 19:00:02 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115253 I occasionally see the error as well due to this.

Wait a little while and try again.]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115253 Wed, 05 Mar 2008 18:59:10 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115220 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115220 Wed, 05 Mar 2008 18:54:46 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115055
Thank you all so much for your help.]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20115055 Wed, 05 Mar 2008 18:27:52 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20114257 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20114257 Wed, 05 Mar 2008 16:12:43 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20114120
As for how I got it: My 12 y/o was using this computer and either checked an email or got it from a game site called Marapets that she plays at all the time. I don't have an antivirus on this old computer but I guess I will need to now!]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20114120 Wed, 05 Mar 2008 15:51:29 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20114068 said by jubal :

How do I "download to desktop"?
To Windows, your Desktop is a folder like any other folder. Start the download, when it comes to the section asking for the filename to be used for the saved files, on the left will be icons for common folders. Such as Desktop. Choose this as the location to save the file.]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20114068 Wed, 05 Mar 2008 15:44:33 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113722 said by jubal :

How do I "download to desktop"?You don't have to download it to there, any place you choose will be fine.
When downloading any file, the Desktop folder (or My Documents) is normally the default choice in the dialogue box as to where to save it, and makes it easy to find, as it's right there in front of you on your Desktop.]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113722 Wed, 05 Mar 2008 14:51:55 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113686 To me it's quite amazing the amount of knowledge the people here possess.
I've been around computers awhile now and have learned to do alot with them but reading some of the posts here I realize how much of a baby I am on the tech end. A long way to go.
But KUDOS to all of you with this knowledge and so willing to share it with us and help us.
Your time and efforts are truly appreciated. :)
Thanks again,
Dan
--
VoicePulse 07/29/04]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113686 Wed, 05 Mar 2008 14:45:45 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113679 http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113679 Wed, 05 Mar 2008 14:45:09 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113512 Good luck if you have this brand new bug, it can be killed but with a little work.]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113512 Wed, 05 Mar 2008 14:21:37 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113173
Of course you could pay some big box store tech a couple hundred smackers to borrow your files to their USB dongles, wipe your drive and reinstall Windows :D
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113173 Wed, 05 Mar 2008 13:31:01 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113033
You save the file with a CMD extension. This tells XP or Vista that it is a batch file.

You double click the new file to execute the batch instructions it contains.

I do think in your case you would be better off with the second method provided: »Re: MonaRonaDona "virus"?

I note too, that MonaRonaDona does nothing to the keyboard. I strongly suspect you have other issues. Rather than do anything further at this point with MonaRonaDona, head to the "Security Cleanup" subForum, follow the instructins bannered in red at the top of the Main Page, and post a HijackThis log as a new topic.
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users

]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113033 Wed, 05 Mar 2008 13:05:06 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113004 What does a layman do to try and rid himself of Mona..etc?
I have reinistated Task Manger, got rid of the screen problem, and now find that every so often my keyboard stops responding, my computer restarts and IE OE get blocked off.
I was using AVG but it didn't stop this virus.
If I copy the above suggestions i.e. @echo off.. etc, what do I copy it into-just desktop?
Please advise.

Thanks :(]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20113004 Wed, 05 Mar 2008 13:00:59 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112916 said by ez2cy:

I truly have to apoligize as I'm computer illetrate.

As I mentioned in earlier post, I tried the "KillTrojan" thing (see, don't even know what to call things..LOL) and it appeared to have worked from I can gather. However, when I did a search for SRUSPOOL.EXE, it found a file, which I just deleted. Does this mean it's gone?

Also, as I said, IE is running real slow and not responding now. I know I read a post about it in this thread, but can not seem to find it. I've been sitting in front of the computer for hours and I'm brain dead.

Can someone point in the right direction to get IE working properly again?

Thank you for your help and patience with a computer moron...LOL
You are not a moron! This is how you (all of us) learn, sometimes the hard way. :)

Did you try rebooting after the fix? If so, and that didn't help, hang in there, someone will probably have another suggestion. Edit: like bcastner above. :D
--
10,675 DEADLY TERROR ATTACKS SINCE 9/11~~TEAM DISCOVERY
Can't feel you anymore, don't need you anymore, don't believe you anymore, I don't need you anymore
]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112916 Wed, 05 Mar 2008 12:45:22 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112899
Rather than spend hours in frustration, click on the "Security Cleanup" Forum, do the prerequisite steps bannered at the top of the Forum main page, and then submit a HijackThis log as a new reply. The folks there can use various utilities to ensure that there are no other problems, and if so, that they are competently removed.
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users

]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112899 Wed, 05 Mar 2008 12:42:31 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112893 said by Glen M Borror :

Yeah, I just tried deleting it to, but it says access denied, and now I'm scared. I talked to my grandfather, who knows everything about computers and other stuff like that, says it's not a virus. Now I'm wondering, what does it really do then, if it is not a virus.
You need to read the entire thread.

Did you try the two fixes? If one doesn't work, try the other one. Using safe mode might be a good idea also.

»Re: MonaRonaDona "virus"?

»Re: MonaRonaDona "virus"?
--
10,675 DEADLY TERROR ATTACKS SINCE 9/11~~TEAM DISCOVERY
Can't feel you anymore, don't need you anymore, don't believe you anymore, I don't need you anymore
]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112893 Wed, 05 Mar 2008 12:41:31 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112803
As I mentioned in earlier post, I tried the "KillTrojan" thing (see, don't even know what to call things..LOL) and it appeared to have worked from I can gather. However, when I did a search for SRUSPOOL.EXE, it found a file, which I just deleted. Does this mean it's gone?

Also, as I said, IE is running real slow and not responding now. I know I read a post about it in this thread, but can not seem to find it. I've been sitting in front of the computer for hours and I'm brain dead.

Can someone point in the right direction to get IE working properly again?

Thank you for your help and patience with a computer moron...LOL]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112803 Wed, 05 Mar 2008 12:31:00 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112697
OTMOVEIT2 is not freezing (even if Explorer reports it not responding). In that particular fix I scan the entire user profile directory.

In the "Killtrojan.cmd" version, I target only specific files in specific folders, and do not comprehensively scan.

The second was written in anticipation of the MRD virus possibly morphing over time. (It has not to date done so.)

It is perfectly normal for either fix not to find all of the entries they look for. This is to be expected and should not be any cause for alarm. The fixes try to cover all bases. Your particular case surely will have pieces that are missing. This does not effect the fix.

Similarly, in the second fix you may not see with HijackThis all of the listed entries. This too is perfectly normal and should not be any cause for alarm.

If MonaRonaDona is there, either fix will remove it.
--
============
MS-MVP 2004 - -2008, ASAP Member
Users Helping Users

]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112697 Wed, 05 Mar 2008 12:14:58 EDT http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112669
Thank you]]> http://www.dslreports.com/forum/Re-MonaRonaDona-virus-20112669 Wed, 05 Mar 2008 12:10:56 EDT