Anti-virus scam aimed at unwary users
MonaDonaRona elaborate con-trick warns Kaspersky.
By Ellen Messmer, Network World (US) | Published: 08:17, 04 March 2008
A Trojan called 'MonaRonaDona' is being used to sell fake anti-virus software, security company Kaspersky has warned.
Unlike most viruses and Trojans which try to go about their evil task as invisibly as possible, the MonaDonaRona Trojan displays a broadly visibly message in front of the victim, said Kaspersky Lab researcher Roel Schouwenberg.
Claiming to be part of a human rights protest, the message says: "Welcome to MonaRonaDona. I am a Virus & I am here to wreck your PC. If you observe strange behaviour with your PC, like program Windows disappearing, etc., it's me who's doing this."
But Schouwenberg said that MonaRonaDona was attempting to panic victims into a starting a web search. He said that they would soon discover stories and commentary on the supposed virus - all of them bogus - instructing victims to use fake anti-virus tools - the prominent one being called Unigray for about $39.00 (£20).
"There was a link at Digg and at YouTube promoting it," said Schouwenberg, Kaspersky Lab blog posting.
While fake anti-virus software scams have cropped up in the past, the MonaRonaDona scam may be unusual in its reliance on social engineering to get victims to download software that removes the MonaRonaDona message but may itself be equally as dangerous.
As to how the MonaRonaDona Trojan manages to propagate, Kaspersky Lab sees a link with another piece of "fake" software called RegistryCleaner 2008.
"We're still researching this but it may be connected with this," says Schouwenberg, who calls the MonaRonaDona Trojan of the past week to be among the most elaborately orchestrated scams he's seen.
