How To Remove cftmon.exe Virus From Windows

Trouble:

There are large number or viruses which spread by just visiting a web site while browsing Internet like “Antivirus 2008 Virus”, one such virus is cftmon.exe worm which may be dropped by some malware, or may be downloaded unknowingly by visiting malicious sites.

Cftmon.exe is can be misunderstood as Ctfmon.exe which is a windows process for alternate text services. The machine infected by the worm may pop up the following alert message, on windows reboot.

Let’s know more about the cftmon.exe worm activity, symptoms and method to fix it.

What does cftmon.exe virus do?

Cftmon.exe virus copy itself at %System%\cftmonn.exe, also creates the following registry key to enable automatic execution at windows startup.

At the following registry path:

Software\Microsoft\Windows\CurrentVersion\Run - “ctmonn”=%System%\cftmonn.exe

It also creates the autorun.inf files in the root directory of the drives with the following parameters.

shellexecute=cftmonn.exe
shell\setup=Ouvrir
shell\setup\command=cftmonn.exe
shell\setup=Explorer
shell\setup\command=cftmonn.exe

In this way the cftmon.exe virus launches automatically each time when you double click or explore a windows partition or removable disk.

How To Remove Cftmon.exe Virus

In order to remove cftmon.exe virus or worm from your system you will need to download the virus-patch and run it under Safe-Mode to remove the virus.

We would recommend to download the Kaspersky Virus Removal tool and run a full system scan with this tool.

• Remove the restrictions caused due to viruses by remove restrictions tool
• How to remove Newfolder.exe virus
• Free Downadup aka Conficker aka Kiddo Removal / Deletion Tool
• Remove MS32DLL.dll Virus

Author + Admin: Rohit Khurana
Software Engineer by profession. I am a part time tech blogger and believe in blogging because I enjoy writing on technology. I also write about Cars and Bikes at www.carblogindia.com. You can catch me on twitter @rohit_khurana. Get in touch with me at RohitKhurana.in.