how to resolve ctfmon.exe trojan problem

Viruses and worms
1

I have the problem with ctfmon.exe and cmdagent.exe.

After scaning my computer Avast report this:
‘‘Process 516 [ctfmon.exe], memory block 0x0000000000400000, block size 24576 (ctfmon.exe) - High - Threat: Win32:Trojan-gen’’ and
‘‘Process 1388 [cmdagent.exe], memory block 0x0000000002260000, block size 471040 - High - Threat: Win32:FakeWimes-B [Trj]’’ and
the same problem was with some proces of panda clound antivirus.

I’m from Serbia.
ctfmon.exe is for Language Bar: I use English, Russian, Serbian Cyrilic and Serbian (Latin).
cmdagent.exe is for Comodo Firewall.
I use costume scan: all harddisks, operating memory of the computer, auto-start programs(all users), rootkits (full scan) - Scan PUP: on.
I use this settings a long time ago, and there no any problem. But from some of last updates of avast there was this problem.

When I disable ctfmon.exe to start and load in to memory
http://weyland.be/wrdprss/index.php/2006/01/13/disable-ctfmonexe-in-xp/
there no more in scan results ctfmon.exe and cmdagent.exe at all.
And now I can’t switch between languages through taskbar.

Best regards.

2

Hello Light45,

Have you seen this thread: http://forum.avast.com/index.php?topic=61493.15, where this issue has been discussed? Have you followed the suggestions offered in this thread? Thank you.

Edit: Another problem I see is that you are also using Comodo FW. Are you using this with antivirus on or off? You are also using Panda Cloud AV. These security software can scan things into memory, and because you are doing Avast Custom scans, this can be causing your problems. It is best to do Quick or Full Avast scans instead.

3

Hello, SefeSurf.

Thank you for post.

I use only ComodoFirewall, antivirus is not installed and defence+ is turned off.
I don’t use PandaCloudAV, I just tested PCAV for few days.

I know that custom scans can make problems,
but it will bi nice if AvastTeam made it impossible. ;D
I wish to scan with custom scans with no worry about that. :wink:

Have you seen this thread: http://forum.avast.com/index.php?topic=61493.15, where this issue has been discussed? Have you followed the suggestions offered in this thread? Thank you.

Yes, I seen.

4

Did you uninstall PandaCloudAV per the vendor’s uninstall instructions if you are not using it? Reboot.

Again I would suggest doing Quick first, or Full Scan with Avast instead. The Avast developers have made a set of default scanners with default settings to detect malware. I would not recommend playing around with the Custom settings, as it can cause problems especially if you select “scan memory” under the Custom scanning.