What is monnid32.exe, How to remove monnid32.exe


monnid32.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: monnid32
Filename: monnid32.exe
Command: %userProfile%\start menu\programs\startup\monnid32.exe
Startup Type: Startup Folder
HijackThis Category: O4
HijackThis Line:

O4 – S-1-5-18 Startup: monnid32.exe (User ‘SYSTEM’)
O4 – .DEFAULT Startup: monnid32.exe (User ‘Default user’)
O4 – Startup: monnid32.exe

DDS Line:

StartupFolder: c:\documents and settings\user\start menu\programs\startup\monnid32.exe

Combofix/RSIT Line:

C:\Documents and Settings\user\Start Menu\Programs\Startup
monnid32.exe

Description: Trojan.Bredolab

How to remove: use HijackThis + Malwarebytes` Anti-malware

This entry was posted on Sunday, February 21st, 2010 at 6:43 am and is filed under O4, Startup folder, Trojan. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

5 Responses to “What is monnid32.exe, How to remove monnid32.exe”

  1. wakey Says:
    February 22nd, 2010 at 5:34 am

    I had this baby last week. The monnid32.exe is locked by a svchost process, you can ID and kill this off using the windows process explorer and searching to the process attached to the monn0d32.exe, this puts the comp in to a shutdown in 60 seconds sequence, during this time you can get in a delete the monnid file, remove from start up and was ok after reboot.

    There was a few other files it had created by these had gone after i did the above.

  2. AlB Says:
    February 23rd, 2010 at 6:30 am

    This is a great idea, I tried it and it works. I believe that infections like this can be resolved by starting up holding the shift key down. This eliminates auto start files from executing.

  3. ARH Says:
    February 25th, 2010 at 11:09 am

    I did a search for the monnid32.exe file on my computer and came up blank, despite the fact that it is in my processes. The file that did come up is monnid32.exeStartup in the C:/windows/pss folder. I like both your ideas above, but where is the file located before i kill the svchost.exe file chewing up all my CPU and put the computer into shutdown?

  4. Wolf Says:
    February 26th, 2010 at 8:45 am

    to Wakey

    Can you please describe it much more detailed? I got this thing and I just can’t delete it. HijackThis can see it in one line “Startup: monnid32.exe” but it doesn’t deletes it. Malwarebytes` Anti-malware said it found and deleted it, but after reboot it’s back in full power. I’m by far not a pro in this, so a very detailed step by step explanation would be very much appreciated, thanks.

  5. Dragan Says:
    February 26th, 2010 at 5:31 pm

    Try this location : C:\Documents and Settings\dran\Start Menu\Programs\Startup\monnid32.exe.
    This pest was taking 50% of CPU power right after the start.

Leave a Reply