Anti-virus scam aimed at unsuspecting users

By Dave Nixon

A Trojan named ‘MonaRonaDona’ is being leveraged to trade fake anti-virus software, security company Kaspersky has warned.

In contrast to the majority of viruses and Trojans which try to go about their evil task as imperceptibly as possible, the MonaDonaRona Trojan displays a broadly visibly message in front of the prey, said Kaspersky Lab researcher Roel Schouwenberg.

Claiming to be an element of a human rights protest, the message says: “Welcome to MonaRonaDona. I am a Virus & I am here to wreck your PC. If you observe strange behaviour with your PC, like program Windows disappearing, etc., it’s me who’s doing this.”

But Schouwenberg said that MonaRonaDona was attempting to fright victims into a starting a web search. He said that they would soon find out stories and commentary on the supposed virus - all of them bogus - instructing victims to use fake anti-virus tools - the prominent one being called Unigray for about $39.00 (£20).

“There was a link at Digg and at YouTube promoting it,” said Schouwenberg, Kaspersky Lab blog posting.

While counterfeit anti-virus software scams have emerged in the past, the MonaRonaDona scam may be extraordinary in its dependence on social engineering to get victims to download software that removes the MonaRonaDona message but may itself be likewise as dangerous.

As to how the MonaRonaDona Trojan manages to propagate, Kaspersky Lab sees a link with another piece of “fake” software called RegistryCleaner 2008.

“We’re still researching this but it may be connected with this,” says Schouwenberg, who calls the MonaRonaDona Trojan of the past week to be among the most elaborately orchestrated scams he’s seen.