Re: MonaRonaDona

[PA Bear [MS MVP]]

X-post to IE General and Security newsgroups.

It appears to be a harmless scam but you'll need expert assistance to remove
it cf. cf. http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus and
http://forums.cnet.com/5208-6142_102-0.html?forumID=32&threadID=285491&messageID=2714709

cf.
https://www.bullguard.com/forum/10/Redirecting-and-suspecting-tro_60005.html
("a window poped up saying 'hello - i am monaronadona and i am a virus. i
have infected u and i will wreck your pc...'")

QED: How does the machine get infected?
====================================
Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Lou wrote:
> Does anyone know what the above Subject phrase is all about?
> It appears when I access the Internet at the end of the page name.
> For instance: The top line of my home page reads "(My ISP) Start Page -
> MonaRonaDona"
> It continues to appear on all pages that I access.
> -----
> Lou

 

[PA Bear [MS MVP]]

cf.
http://blog.washingtonpost.com/securityfix/2008/03/the_411_on_the_monaronadona_ex.html

PA Bear [MS MVP] wrote:
> X-post to IE General and Security newsgroups.
>
> It appears to be a harmless scam but you'll need expert assistance to
> remove
> it cf. cf. http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus
> and
> http://forums.cnet.com/5208-6142_102-0.html?forumID=32&threadID=285491&messageID=2714709
> cf.
> https://www.bullguard.com/forum/10/Redirecting-and-suspecting-tro_60005.html
> ("a window poped up saying 'hello - i am monaronadona and i am a virus. i
> have infected u and i will wreck your pc...'")
>
> QED: How does the machine get infected?
<snip>
> Lou wrote:
>> Does anyone know what the above Subject phrase is all about?
>> It appears when I access the Internet at the end of the page name.
>> For instance: The top line of my home page reads "(My ISP) Start Page -
>> MonaRonaDona"
>> It continues to appear on all pages that I access.
>> -----
>> Lou

 

[PA Bear [MS MVP]]

Removal Tool for MonaRonaDona Infection
http://aumha.net/viewtopic.php?t=32239
--
~PA Bear

PA Bear [MS MVP] wrote:
> cf.
> http://blog.washingtonpost.com/securityfix/2008/03/the_411_on_the_monaronadona_ex.html
>
> PA Bear [MS MVP] wrote:
>> X-post to IE General and Security newsgroups.
>>
>> It appears to be a harmless scam but you'll need expert assistance to
>> remove
>> it cf. cf. http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus
>> and
>> http://forums.cnet.com/5208-6142_102-0.html?forumID=32&threadID=285491&messageID=2714709
>> cf.
>> https://www.bullguard.com/forum/10/Redirecting-and-suspecting-tro_60005.html
>> ("a window poped up saying 'hello - i am monaronadona and i am a virus. i
>> have infected u and i will wreck your pc...'")
>>
>> QED: How does the machine get infected?
> <snip>
>> Lou wrote:
>>> Does anyone know what the above Subject phrase is all about?
>>> It appears when I access the Internet at the end of the page name.
>>> For instance: The top line of my home page reads "(My ISP) Start Page -
>>> MonaRonaDona"
>>> It continues to appear on all pages that I access.
>>> -----
>>> Lou