Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Question

DOJ Virus

Jul 6, 2013 2:50PM PDT

I recently experienced the DOJ virus on my Dell XPS12 tablet/laptop running Win 8. I went through the online scans of pctuneup and malwarebytes and pcmatic and everything else. They all come up with no malware found. At first, I could not browse the internet with chrome or firefox, but iexplorer was working. Now, no browsers will work, UNLESS the machine boots in safe mode. I disabled 'unknown' processes and am not sure what I should try next.
Please help if you have any information on this.

Discussion is locked

- Collapse -
Answer
I know I've got rid of attacks
Jul 10, 2013 11:32PM PDT

by going to a restore point before the attack and do that restore. Then I ran Anti-Malwarebytes and did a scan with Norton 360. Other area's i look at are unknown toolbars and search engines.

- Collapse -
Answer
Department of Justice Virus
Jul 15, 2013 5:19AM PDT

01. "Department of Justice Virus" is a very updated infection and keeps
updating its locations and file names hence it might be a little bit
critical to remove the infection

02. Try to perform a System Restore by the following process -
Swipe in from the right edge of the screen, and then tap Search.
(If you're using a mouse, point to the upper-right corner of the screen,
move the mouse pointer down, and then click Search.) Enter Recovery in the
search box, tap or click Settings, and then tap or click Recovery.
Tap or click Open System Restore, and follow the prompts.

03. If System Restore fails or if the issue is not resolved then proceed to
the next steps

04. Open Windows Start Menu, enter %appdata% into the search field, click
Enter.

05. Go to: Microsoft\Windows\Start Menu\Programs\Startup.

06. Remove ctfmon (don't mix it with ctfmon.exe!).

07. Open Windows Start Menu, enter %userprofile% into the search field,
click Enter.

08. Go to Appdata\Local\Temp and remove rool0_pk.exeDelete [random
characters].mof file

09. Delete V.class

10. Restart the computer

11. The infection should have been removed

12. If the issue is not resolved then get back to us

- Collapse -
doj virus
Aug 21, 2013 10:31PM PDT

i tried your instructions but stuck at appdata step. i cannot proceed further since i cannot locate the directory you indicated in your post. any idea? thanks

- Collapse -
Another thing to try is to boot
Aug 22, 2013 12:19AM PDT

into safe mode. Some Virus are loaded at startup so Safe mode will not load then then go to the folder of your virus and run a scan which is usually scan.exe. If the viruses software is messed up i would download Antimalwarebytes on another machine and maybe avast (free version) and run those scans in safe mode and see if it removes stuff.

- Collapse -
ctfmon
Aug 22, 2013 1:01AM PDT

i found the ctfMon file under the user folder, that file was created yesterday and that is the time i got the virus too. it is shown as an app file, okay to remove it? i also saw 2 more files were created about the same time. should i delete them too? they are exe files but your previous instruction said dont delete them. i am not good at using pc.
thanks for your help.