Results 1 to 4 of 4

Thread: ctfmon.exe

  1. #1
    Junior Member
    Join Date
    Apr 2007
    Posts
    2

    Default ctfmon.exe

    I was looking through startup applications and one of them was ctfmon.exe because i'm an XP user and i never uninstalled it or anything like that. However, the Spybot S&D information bar on the side told me that ctfmon.exe was a virus or some other sort of hazardous entry. I was just letting you know that S&D thinks it's a hijacking program when it's really just a Windows process.

  2. #2
    Senior Member spybotsandra's Avatar
    Join Date
    Oct 2005
    Location
    Germany
    Posts
    5,269

    Default

    Hello,

    Ctfmon.exe is part of Microsoft Office XP. It monitors the active windows and provides text input service support for speech recognition,
    handwriting recognition, keyboard, translation, and other alternative user input technologies. It should be located here:

    * C:\Windows\System32

    If not it can be virus, spyware, trojan or worm! Examples:
    PWSteal.Raidys
    http://securityresponse.symantec.com...al.raidys.html
    http://securityresponse.symantec.com...al.raidys.html
    Trojan.Satiloler
    http://securityresponse.symantec.com...satiloler.html
    http://securityresponse.symantec.com...satiloler.html
    Spyware.FamilyKeylog
    http://securityresponse.symantec.com...ilykeylog.html
    http://securityresponse.symantec.com...ilykeylog.html
    Further you can see it on the filesize. The legal version is something like 10 to 15 KB.

    Best regards
    Sandra
    Team Spybot

  3. #3
    Junior Member
    Join Date
    Aug 2007
    Posts
    1

    Default

    I found the same thing and was curious as it did not show on a scan. If its the MS version here is the link for the steps needed to disable it:

    http://support.microsoft.com/kb/282599

    For some reason Spybot thought mine was the spyware version.
    Last edited by ls-21; 2007-08-12 at 22:06.

  4. #4
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,860

    Default

    Quote Originally Posted by ls-21 View Post
    I found the same thing and was curious as it did not show on a scan. …

    For some reason Spybot thought mine was the spyware version.
    If you are in Spybot-S&D > Tools > System Startup and looking at the comments about a startup entry with a name of "ctfmon.exe", are these the comments you are referring to?

    Code:
    Current filename: C:\WINDOWS\system32\ctfmon.exe
    
    Database status: Not required - virus, spyware, malware or other resource hog
    Value: ctfmon.exe
    Filename: ctfmon32.exe
    
    Description
    _CoolWebSearch_ parasite related - hijacking to Slawsearch.com
    
    Source: Paul Collins Startup list
    If so, they are just that, comments about possibilities for a startup entry with a name of "ctfmon.exe". They are comments, not detections picked up during a scan ("Check for problems").

    In other words Spybot didn't think anything, it is just presenting comments about possibilities for a startup entry by the name of "ctfmon.exe" and in this case those comments are from "Paul Collins Startup list".

    Getting an answer is one thing, learning is another.


    Microsoft Windows XP Home Edition running on a 2.40GHz Intel® Pentium® 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •