Tech Tips Home
The Best Tech Tips And Daily Deals
Newsletter On The Internet!

Shop online 24hrs a day or call us Mon-Fri
8:30AM-4:30PM EST - 1-800-915-2088
WorldStart Tech Tip And Store Search
Email: Password: Login Remember Me
looking for freeware

Like what you see here? Subscribe to the Tech Tips newsletter!   Email: Subscribe

MonaRonaDona

Friday, March 7th, 2008 by | Filed Under: Security Help
 
Loading...


MonaRonaDona – Another Security Tip

I have received a number of e-mails and calls about a new threat called MonaRonaDona, so instead of a download today, here’s another security tip for you! The MonaRonaDona is a virus that will stop certain programs from running correctly and it will put a message on your Internet Explorer screen that says “MonaRonaDona.” If you search on the Internet for a fix to this issue, you will most likely come across a program called Unigray Antivirus, which claims to be the best program to fix this issue.

All I have to say is, “Do not buy the Unigray Antivirus!

You see, the MonaRonaDona virus is not a virus at all. It’s actually just an elaborate scam. Unigray Antivirus will only fix MonaRonaDona and it will not protect your computer in any other way. It is speculated that the makers of MonaRonaDona are also the makers of Unigray Antivirus. This is a very clever way to make money from unknowing users.

So, now that you know about this scam, please don’t fall for it! If you become infected by MonaRonaDona, don’t panic. Just follow the steps below to get your system back to normal.

First, you will need two free programs from the Internet. One is called HijackThis and the other is called OTMoveIT2. Save both of these programs to your desktop or some place that’s easy to find. You can get HijackThis here and OTMoveIT2 here.

After saving them to your computer, follow these steps very carefully:

1.) Go to the location where you saved HijackThis. Double click on it and install it. After the installation is done, run the program (there should be a new icon on your desktop for it).

Next, select System Scan Only.

Place a checkmark next to these items (if found):

R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MonaRonaDona
O4 – HKLM\..\Run: [.NET.] \FUD.exe
O4 – Global Startup: SRVSPOOL.exe
O4 – HKCU\..\Run: [RegistryCleanFixMFC] C:\Program Files\RegistryCleanFix2008\RegistryCleaner2008.exe

Click Fix Checked and when it finishes, go ahead and exit HijackThis.

2.) Go to the location where you saved OTMoveIT2 and double click it. (If you’re using Vista, right click on it and choose Run as Administrator).

Copy all the information found below. Highlight all of it, right click it and choose Copy.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Window Title
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Window Title
HKEY_CURRENT_USER\Software\Microsoft\Outlook Express\\Window Title
C:\Program Files\RegistryCleanFix2008
C:\Program Files\UniGray Antivirus
C:\Documents and Settings\All Users\SRVSPOOL.EXE /S /D
C:\Users\SRVSPOOL.EXE /S /D

Next, return to OTMoveIt2 and right click in the “Paste List of Files/Patterns to Search For and Move” window.
Important: Paste only into the bottom input panel (under the yellow bar). The top panel will not help you. Then just right click and choose Paste.

Now, click the red MoveIt button and wait several minutes. When it’s finished, look in the large right hand panel that says Results. You should see that at least the principal infector files were deleted and whichever applicable registry changes were made. (They may not all apply in your case). Close OTMoveIt2 when it has finished.

Note: If a file or folder cannot be moved immediately, you may be asked to reboot your computer to finish the move process. If you’re asked to reboot, simply choose Yes.

Now, double click and open OTMoveIt2 again. Click the green Clean Up! button at the top. (Note: It will need to access the Internet to download a small script file, so please allow your firewall to do so).

When it finishes, it will have deleted all of its quarantines, as well as, the OTMoveIt2 program and all the folders it created. Then just reboot your computer to finish up.

These steps should remove any signs and symptoms of MonaRonaDona. Stay safe!

~ Gary

Leave a Reply


Like these tips? Get them for FREE in your email!

WorldStart's Tech Tips Newsletter

  • Tech Tips Daily - Become a tech pro! Get the very best tech and computer help sent directly to your email every weekday!

  • Tech Tips Weekly - If you don't want our Tech Tips newsletter every day, then sign up for this weekly newsletter to get the best information of the week. Sent on Fridays.

Other Newsletters

  • WorldStart's Daily Deals - Every week, we send out great deals in our Daily Deals newsletter. Many of these deals are exclusively for our Daily Deals newsletter subscribers and can't be found with our regular specials.

  • Just For Grins - Each issue includes a couple clean jokes, some funny quotes, and a hilarious reader's story. Newsletter is sent five days a week.


Enter Email Address:

Subscribe

Your e-mail address is safe with us!
We only use it to send you the newsletters you request. It is NEVER disclosed to a third party for any reason, ever! Plus, if you decided you don't like our newsletters (don't worry, you'll love them), unsubscribing is fast and easy.

Free Newsletter Signup



Tech Tips Daily

Become a tech pro! Get the very best tech and computer help sent directly to your email every weekday!

Tech Tips Weekly

The week's best in tech and computer help. Get your issue sent to your email every Friday!

WorldStart's Daily Deals

The very best deals on the Internet! Get a new set of incredible sales every day of the week!

Just For Grins

Clean jokes, funny quotes, and hilarious comics. Sent 5 times a week straight to your email.


Subscribe


Love Worldstart? Refer A Friend!

looking for freeware
WorldStart's Premium Membership

Tip Archive


Categories:
Archives: