My office computer infected by CTFMON.EXE

[ahnajem]

Hi, I have my office laptop infected with CTFMON.EXE, my friend advised me to remove the hard disk and scan it with another computer using Malwarebytes Pro. and it will remove it. I have my personal computer but I have McAfee installed, should I remove it before installing the Malware Pro., or it doesn't conflict.. and SURE THE MALWARE PRO. Will remove the virus after scanning or I have to follow different step. Regards,

[ahnajem]

Hello... Anybody can?!!!.. Should I buy the Malware Pro, dose it conflict with McAfee?!!

[AdvancedSetup]

Please run Malwarebytes Anti-Malware and check for updates. Then do a Quick Scan and post back the log please.

Thanks

[ahnajem]

I ran the scan and below the log showing nothing detected, but the CTFMON.EXE file still there..Malwarebytes Anti-Malware (PRO) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.06.15.03

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16599

Ali :: NAJEM-PC [administrator]

Protection: Enabled

6/15/2013 3:57:35 PM

mbam-log-2013-06-15 (15-57-35).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 509635

Time elapsed: 1 hour(s), 13 minute(s), 26 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

[Maurice Naggar]

Hello ahnajem,

The MBAM log detected nothing malicious. as I'm sure you saw.

Where did you "notice / see" the CTFMON.exe ?

Please know that if you saw it at folder C:\Windows\system32 then that is legitimate & is from Microsoft.

see http://www.bleepingcomputer.com/filedb/ctfmon.exe-739.html

IF on the other hand it is in a different or non-familiar folder, then let me know.

Please also see "Frequently asked questions about Ctfmon.exe"

http://support.microsoft.com/kb/282599/de

[ahnajem]

Hello Maurice,

I detected the file on the C:\\Windows\system32; and my issue that its blocking my computer and giving a message that my computer is blocked by FBI due to piracy…. And I have to pay $300 to have it unlocked!!!

Regards,

ALY

[AdvancedSetup]

Ah... that is an infection. Please post a new post in this forum here with some type of title about having the FBI block

http://forums.malwarebytes.org/index.php?showforum=7

As soon as someone is available they will assist you with cleaning the computer.

Thanks