- MonaRonaDona
-
MonaRonaDona Common name MonaRonaDona Technical name MonaRonaDona Aliases TROJ_MONAGRAY.A Family Vundo Trojan Classification Browser Hijacker Type Microsoft Windows Point of Origin Unknown MonaRonaDona is a browser hijacker that uses unique tactics through popups or alert messages stating that you are infected with a virus. It uses this sarcastic message to send users on a hunt for a MonaRonaDona remedy only to run into other malicious websites that may have been created by the designers of MonaRonaDona.
Contents
Vendor description
MonaRonaDona is known to come from various rogue programs such as Registry Clean Fix and Unigray Anti-Virus.
Infection
MonaRonaDona is usually downloaded through a the Unigray Anti-Virus program or certain ads for Registry Clean Fix. MonaRonaDona remains inactive at times and is left undiscoverable by anti-virus programs. MonaRonaDona uses stealth tactics only presenting itself with an infection message.
Symptoms
MonaRonaDona displays the following false warning message in an attempt to scare users into searching for a fix.
“Hi, My name is MonaRonaDona. I am a Virus & I am here to Wreck Your PC. If you observe strange behavior with your PC, like program windows disappearing etc, it’s me who is doing all this. I was created as a protest against the Human Rights Violation being observed throughout the world & the very purpose of my existence is to remind & stress the world to respect humanity.”
This message sends computer users searching the internet with the likelihood of them running into another malicious website spending their money on something bogus.
MonaRonaDona installs the following Windows registry keys:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MonaRonaDona
- HKEY_LOCAL_MACHINE\SOFTWARE\MonaRonaDona.com
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Window Title
- HKEY_CURRENT_USER\Software\Microsoft\Outlook Express\\Window Title
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Window Title
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
Known variants
MonaRonaDona behaves unlike other known Rogue software. MonaRonaDona has its own characteristics and may come from the rogue software Unigray Antivirus. MonaRonaDona was also identified as the TROJ_MONAGRAY.A trojan infection.
References
- TrendMicro Blog - The Art, Drama, and Sophistication of MonaRonaDona
- washingtonpost.com - The MonaRonaDona Extortion Scam
- MonaRonaDona - The Pure Social Engineering Scam - Symantec
See also
- Malware
- Spyware
- Adware
- Rogue software
- Wikipedia's Spyware removal category
External links
Categories:
Wikimedia Foundation. 2010.
