W32/Monagrey is a trojan. The trojan will infect Windows systems, terminate applications and modify IE start page.

Upon execution, the trojan is copies itself as:

SRVSPOOL.exe in %UserProfile%\Start Menu\Programs\Startup folder.

The trojan modifies registry at the following location to load itself during each startup;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Windows"

It also modifies registry at the following locations;

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Window Title" = "MonaRonaDona"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\"SD"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr"

The trojan ends applications that contain one of the following strings in the window title text:

Adobe
Winamp
Irfanview
Messenger
Macromedia
Google Talk
Registry Editor
Date And Time
Microsoft Excel
Microsoft Office
Microsoft Visual
Microsoft Word
Windows Media Player
Windows Task Manager

The trojan may display the following alert:

Welcome to MonaRonaDona Hi, My name is MonaRonaDona. I am a Virus & I am here to Wreck Your PC. If you observe strange behavior with your PC, like program windows disappearing etc, it's me who is doing all this. I was created as a protest against the Human Rights Violation being observed throughout the world & the very purpose of my existence is to remind && stress the world to respect humanity.

This trojan first appeared on March 06, 2008.

 Other names of W32/Monagrey Trojan:

This trojan is also known as Trojan.Monagrey, Trojan.Win32.Monagrey.a.