Guest PA Bear [MS MVP] Posted February 29, 2008 Posted February 29, 2008 Re: MonaRonaDona X-post to IE General and Security newsgroups. It appears to be a harmless scam but you'll need expert assistance to remove it; cf. cf. http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus and http://forums.cnet.com/5208-6142_102-0.html?forumID=32&threadID=285491&messageID=2714709 cf. https://www.bullguard.com/forum/10/Redirecting-and-suspecting-tro_60005.html ("a window poped up saying 'hello - i am monaronadona and i am a virus. i have infected u and i will wreck your pc...'") QED: How does the machine get infected? ==================================== Unexplained computer behavior may be caused by deceptive software http://support.microsoft.com/kb/827315 Run a /thorough/ check for hijackware, including posting your hijackthis log to an appropriate forum. Checking for/Help with Hijackware http://aumha.org/a/parasite.htm http://aumha.org/a/quickfix.htm http://aumha.net/viewtopic.php?t=5878 http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction http://mvps.org/winhelp2002/unwanted.htm http://inetexplorer.mvps.org/data/prevention.htm http://inetexplorer.mvps.org/tshoot.html http://www.mvps.org/sramesh2k/Malware_Defence.htm http://defendingyourmachine2.blogspot.com/ http://www.elephantboycomputers.com/page2.html#Removing_Malware When all else fails, HijackThis v2.0.2 (http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use. It will help you to both identify and remove any hijackware/spyware with assistance from an expert. **Post your log to http://forums.spybot.info/forumdisplay.php?f=22, http://castlecops.com/forum67.html, http://forums.subratam.org/index.php?showforum=7, http://aumha.net/viewforum.php?f=30, or other appropriate forums for review by an expert in such matters, not here.** If the procedures look too complex - and there is no shame in admitting this isn't your cup of tea - take the machine to a local, reputable and independent (i.e., not BigBoxStoreUSA) computer repair shop. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Lou wrote: > Does anyone know what the above Subject phrase is all about? > It appears when I access the Internet at the end of the page name. > For instance: The top line of my home page reads "(My ISP) Start Page - > MonaRonaDona" > It continues to appear on all pages that I access. > ----- > Lou
Guest PA Bear [MS MVP] Posted February 29, 2008 Posted February 29, 2008 Re: MonaRonaDona hans@vredeling.net wrote: <snip> > Hope this info helps those who come across this virus. It seems to be > a brand new occurence given the lack of solutions found on the Internet. Barely 6-7 days old, in fact. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/
Guest JHilton Posted February 29, 2008 Posted February 29, 2008 Re: MonaRonaDona ========================================= I am a Software Developer. I confronted this MonaRonaDona virus & due to lack of information on internet about it, I have myself diagnosed & developed this simple application to remove the MonaRonaDona virus. Simply download the following exe & press the “Remove MonaRonaDona” button & It will clean your PC from MonaRonaDOna. If you manage to get your PC clean, please do remember me in your prayers :-) You can download the “free monaronadona remover” from: 'RapidShare: 1-Click Webhosting' (http://rapidshare.com/files/95966868/RemoveMonaRonaDona.exe) OR shrinked RAR version 'RapidShare: 1-Click Webhosting' (http://rapidshare.com/files/95964607/RemoveMonaRonaDona.rar) (small in size but you will need winrar to extract the exe) =========================================
Guest PA Bear [MS MVP] Posted March 1, 2008 Posted March 1, 2008 Re: MonaRonaDona Anyone who'd be foolish enough to risk downloading/running such anonymously posted files deserves what they get. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ JHilton wrote: > ========================================= > I am a Software Developer. I confronted this MonaRonaDona virus & due > to lack of information on internet about it, I have myself diagnosed & > developed this simple application to remove the MonaRonaDona virus. > Simply download the following exe & press the “Remove MonaRonaDona” > button & It will clean your PC from MonaRonaDOna. If you manage to get > your PC clean, please do remember me in your prayers :-) > > You can download the “free monaronadona remover” from: > > 'RapidShare: 1-Click Webhosting' > (http://rapidshare.com/files/95966868/RemoveMonaRonaDona.exe) > > OR shrinked RAR version > > 'RapidShare: 1-Click Webhosting' > (http://rapidshare.com/files/95964607/RemoveMonaRonaDona.rar) (small in > size but you will need winrar to extract the exe) > > =========================================
Guest Canuckluck Posted March 2, 2008 Posted March 2, 2008 Re: MonaRonaDona I woke up this morning and found this MonaRonaDona on my desktop ! I tried deleting it from Startup, but it wouldn't allow it. I then dragged it from Start-up to my Desktop but still can't delete it ! I am unable to do a "run" on my Registry, for some reason it won't let me on ??? MonaRonaDona also appears on the Titlebar, no matter where I go to. I have run Spybot, it didn't delete it (ugh). I ran Nortons, didn't delete it (ugh) ! I ran Ad-Aware SE , didn't delete it either ! I am at a loss right now. I have been searching all day for a solution from different forums, but apparently this is quite new and no one seems to have a plan that will rectify this problem ?? I also went to Rapidshare but there was no solution there. It asked me what file I wanted to DL, but where is the remover for this MonaRonaDona ? This is web server ??? or what ?? I saw nothing for the remover. Anyone that has a solution I would love to try it . Thank you in advance
Guest Canuckluck Posted March 2, 2008 Posted March 2, 2008 Re: MonaRonaDona I was finally able to delete MonaRonaDona from my Desktop ! I went to Run, typed in MSCONFIG, then to Startup. While in Startup, I unchecked the SRVSPOOL.exe file which was listed there. I re-started my computer and it was gone. I was then able to delete shortcuts to that exe. file also. Now the only problem I have, is it still on my blue titlebar. It is also still listed on the Startup but unchecked. How do I go about removing it from both those places permanently ?? I ran AML Registry Cleaner and was able to find and delete some entries but not all ?? I also ran Spybot, but it didn't come up with anything. I heard there is a way to remove it from the blue title bar, but don't know how to do it, any suggestions ? :o
Guest PD43 Posted March 2, 2008 Posted March 2, 2008 Re: MonaRonaDona Canuckluck <Canuckluck.35o417@no.email.invalid> wrote: >I heard there is a way to remove it from the blue title bar, but don't >know how to do it, any suggestions ? NOT AGAIN!! OK... check this out: http://preview.tinyurl.com/35r6p5
Guest PA Bear Posted March 2, 2008 Posted March 2, 2008 Re: MonaRonaDona There are 2 fixes/removal tools by MVP Bill Castner here that work: http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus ~~ ~Robear Dyer (PA Bear) [posted via Google Groups] MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ On Feb 25, 6:09 pm, "Lou" <lou...@toast.net> wrote: > Does anyone know what the above Subject phrase is all about? > It appears when I access the Internet at the end of the page name. > For instance: The top line of my home page reads "(My ISP) Start Page - > MonaRonaDona" > It continues to appear on all pages that I access.
Guest Canuckluck Posted March 3, 2008 Posted March 3, 2008 Re: MonaRonaDona After downloading Spywareblaster I was able to change the Blue Titlebar to Microsoft Internet Explorer instead of it saying MonaRonaDona !!! Hurrraaayyy !!!!! Thank you Spywareblaster ! My computer should be free of this virus, trojan, worm, whatever it was. I now have extra protection with Spywareblaster. It took alot of searching and thought but I am finally free of it, I hope ?? The steps I took were easy; Disable System Restore , restore later when done. Start in Safe mode if preferred, Run > Msconfig > Start-up ...uncheck SRVSPOOL.exe ...restart computer MonaRonaDona should be gone !!! To change blue title bar: Download Spywareblaster and follow directions, very easy ! Make sure you remove/delete any shortcuts it left on your computer also. Check your Startup menu on the Start/Programs and delete from there as well. Delete from your Recycle Bin as well. This should solve your problem with MonaRonaDona
Guest paul Posted March 3, 2008 Posted March 3, 2008 Re: MonaRonaDona On Feb 26, 4:09 am, "Lou" <lou...@toast.net> wrote: > Does anyone know what the above Subject phrase is all about? > It appears when I access the Internet at the end of the page name. > For instance: The top line of my home page reads "(My ISP) Start Page - > MonaRonaDona" > It continues to appear on all pages that I access. > ----- > Lou How to remove the monaronadona virus/spyware http://securitynewsfromthenet.blogspot.com/2008/03/how-to-remove-monaronadona-virusspyware.html click start>click Run >type in msconfig [press enter]>goto the Start- up tab ....uncheck SRVSPOOL.exe click ok ....restart computer
Guest PA Bear [MS MVP] Posted March 3, 2008 Posted March 3, 2008 Re: MonaRonaDona paul wrote: > On Feb 26, 4:09 am, "Lou" <lou...@toast.net> wrote: >> Does anyone know what the above Subject phrase is all about? >> It appears when I access the Internet at the end of the page name. >> For instance: The top line of my home page reads "(My ISP) Start Page - >> MonaRonaDona" >> It continues to appear on all pages that I access. >> ----- >> Lou > > How to remove the monaronadona virus/spyware > http://securitynewsfromthenet.blogspot.com/2008/03/how-to-remove-monaronadona-virusspyware.html > > click start>click Run >type in msconfig [press enter]>goto the Start- > up tab > > ...uncheck SRVSPOOL.exe click ok > ...restart computer You'll need to do more than that. See http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/
Guest PA Bear [MS MVP] Posted March 4, 2008 Posted March 4, 2008 Re: MonaRonaDona cf. http://blog.washingtonpost.com/securityfix/2008/03/the_411_on_the_monaronadona_ex.html PA Bear [MS MVP] wrote: > X-post to IE General and Security newsgroups. > > It appears to be a harmless scam but you'll need expert assistance to > remove > it; cf. cf. http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus > and > http://forums.cnet.com/5208-6142_102-0.html?forumID=32&threadID=285491&messageID=2714709 > cf. > https://www.bullguard.com/forum/10/Redirecting-and-suspecting-tro_60005.html > ("a window poped up saying 'hello - i am monaronadona and i am a virus. i > have infected u and i will wreck your pc...'") > > QED: How does the machine get infected? <snip> > Lou wrote: >> Does anyone know what the above Subject phrase is all about? >> It appears when I access the Internet at the end of the page name. >> For instance: The top line of my home page reads "(My ISP) Start Page - >> MonaRonaDona" >> It continues to appear on all pages that I access. >> ----- >> Lou
Guest PA Bear [MS MVP] Posted March 4, 2008 Posted March 4, 2008 Re: MonaRonaDona I very much doubt that enabling all SpywareBlaster protections and disabling SRVSPOOL.EXE from loading at boot has left the macine in a clean state. See http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Canuckluck wrote: > After downloading Spywareblaster I was able to change the Blue Titlebar > to Microsoft Internet Explorer instead of it saying MonaRonaDona !!! > Hurrraaayyy !!!!! > > Thank you Spywareblaster ! > > My computer should be free of this virus, trojan, worm, whatever it > was. > > I now have extra protection with Spywareblaster. > > It took alot of searching and thought but I am finally free of it, I > hope ?? > > The steps I took were easy; > > Disable System Restore , restore later when done. > > Start in Safe mode if preferred, > > Run > Msconfig > Start-up > > ..uncheck SRVSPOOL.exe > ..restart computer > > MonaRonaDona should be gone !!! > > To change blue title bar: > > Download Spywareblaster and follow directions, very easy ! > > Make sure you remove/delete any shortcuts it left on your computer > also. > Check your Startup menu on the Start/Programs and delete from there as > well. > Delete from your Recycle Bin as well. > > This should solve your problem with MonaRonaDona
Guest Canuckluck Posted March 4, 2008 Posted March 4, 2008 Re: MonaRonaDona Yes, it is true, I know the Srvspool is still there, but it is disabled. I cannot just delete it, only disable it from the Start-up. I have not seen the MonaRonaDona appear on any window since I did this. With all the tools I have, you would think I could, but, alas, I cannot completely get rid of it. I have read the articles from Castner, but, they are too technical for me. The only problem I have is the constant Malware that re-routes my Search pages, but only when I use Google on IE. , which is my home page. It doesn't happen on MSN search. Another annoying problem I have is other windows showing up with AVS System Scanners, etc. , wanting me to DL their programs. This happens only when I first click on one of my icons on the desktop, example: Hotmail I do spyware scans everyday , I have virus protection with Nortons, I do registry checks, the whole nine yards, but, they keep coming back ! I feel at this time the only option left for me is to reformat my computer! I have HijackThis, Spybot, Spywareblaster, Ad-Aware SE, AML Registry Cleaner & Nortons, how much more do I need to protect my computer ??? They all list the malware that I am having problems with, but none seem to remove it completely ! Very frustrating !
Guest PA Bear [MS MVP] Posted March 5, 2008 Posted March 5, 2008 Re: MonaRonaDona Removal Tool for MonaRonaDona Infection http://aumha.net/viewtopic.php?t=32239 -- ~PA Bear PA Bear [MS MVP] wrote: > cf. > http://blog.washingtonpost.com/securityfix/2008/03/the_411_on_the_monaronadona_ex.html > > PA Bear [MS MVP] wrote: >> X-post to IE General and Security newsgroups. >> >> It appears to be a harmless scam but you'll need expert assistance to >> remove >> it; cf. cf. http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus >> and >> http://forums.cnet.com/5208-6142_102-0.html?forumID=32&threadID=285491&messageID=2714709 >> cf. >> https://www.bullguard.com/forum/10/Redirecting-and-suspecting-tro_60005.html >> ("a window poped up saying 'hello - i am monaronadona and i am a virus. i >> have infected u and i will wreck your pc...'") >> >> QED: How does the machine get infected? > <snip> >> Lou wrote: >>> Does anyone know what the above Subject phrase is all about? >>> It appears when I access the Internet at the end of the page name. >>> For instance: The top line of my home page reads "(My ISP) Start Page - >>> MonaRonaDona" >>> It continues to appear on all pages that I access. >>> ----- >>> Lou
Recommended Posts