Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Submit a log and you will receive ALL the information we have in our DB's on everything on your system INSTANTLY!

ctfmon.exe


Click here to Run a Free Scan for ctfmon.exe Related Errors

What is it?
Language bar AKA Alternative User Input Services - ctfmon.exe

What does it do?
ctfmon.exe - it's an ever annoying helper tool that comes rather unexpectedly at times and liked by nearly nobody.

Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.

Loads of information can be found on microsoft's site here.

Unless you're using anything in that list above you'll want to stop this file from loading!

How do I get rid of it?
There's been a number of threads in our forum as well as others about this. A typical thread can be found here.

control panel --> regional and language options --> languages tab --> details button --> language bar button

Virus Precaution:
Just like so many of the other files I've written about so far, ctfmon.exe is located in the c:windowsSystem32ctfmon.exe. At the time of this writing there isn't any spyware, viruses or anything like that masking itself as this file. If you find any info on one then please let me know!

Fix ctfmon.exe Errors: Free Scan

Recommended: Run a Free Performance Scan to automatically optimize memory, CPU and Internet Settings




ctfmon.exe is a Windows System File and should be in a system directory. If it is then this application is safe.

Startup DB Entries:
[ctfmon]"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) oru
[ctfnnon]"Added by the TURKOJAN.IL BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%" b
[Microsoft CTF Loader]"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) oru
[Windows Live Messenger 8.12]"Added by the LIPARK-A WORM! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %UserProfile%" b

Service DB Entries:
Microsoft CTF Loader CTF Loader

Disclaimer

Every attempt has been made to ensure the information about ctfmon.exe is accurate but alot of malware applications try to pose as valid applications. If it is something other than what was posted above please leave some feedback in the forum.
Printer Friendly

User Comments
Bob StettinaI'm on XP/SP2+allcritupdates. My "kosher" CTFMON.EXE is 15,360 bytes long, and exists in both \WINDOWS\SYSTEM32 and \WINDOWS\SYSTEM32\DLLCACHE. I just (today) got nailed by a `bot-swarm. That'll teach me I wound up with (literally) hundreds of quite pernicious AdWare and `bots. 10 hours later, I think I finally nailed the last "varmint"... a CTFMON.EXE that was ~4MB long. Yep. 4MB. It was located in \WINDOWS\SYSTEM32\DLG. I was getting "rogue" instances of IE, trying to go to "strange places". That's gone now (along with the DLG directory, and its contents). We'll see if "it" is all finally dead. PS: I'm reluctant to just "disable" the "real" CTFMON.EXE, just because... I'm never sure when uSoft is telling the whole truth about anything... or, if they even know it!
Richard BurkhartThank you. Everytime I bootup from scratch an error comes up saying (ctfmon.exe) failed, so I guess that's good but now I kow it's not important, so that's even better. I'll just do a search and eliminate all copies of the thing.
William SeeIt was said in the article that ctfmon should only be found in c:\windows\system32. I have been experiencing problems with an error window popping up with this file being the error. After performing a search I have found this file in three directories. They are: C:i386: Ctfmon.exe C:\Windows\Prefetch:Ctfmon.exe-05E57A5E.pf C:\Windows\System32Ctfmon.exe Is there potential danger in having the file in the other two directories other than Windows\System32?
kurtWilliam see the same thing kept happening to me... the same file was found on my computer.. but i deleted it... because it was in windows/syestem32/prefetch. it was weird so i deleted it and nothing has happened since.. i dont think there is any harm in deleting it... but if something stuff up after it remember to do a system restore to about 3 days before u deleted it.... good luck
Windows Files
lsass.exe | csrss.exe | alg.exe | dwwin.exe | Svchost.exe | Spoolsv.exe | wowexec.exe | cidaemon.exe | wmiprvse.exe | ctfmon.exe | Winlogon.exe | wuauclt.exe | Smss.exe | msmsgs.exe | rundll32.exe | mdm.exe | ntvdm.exe | wscntfy.exe | explorer.exe | ntdll.dll | iexplore.exe | msdxm.ocx | wisptis.exe | wdfmgr.exe | MsiExec.exe | PDVDServ.exe | DLLhost.exe | gcasdtserv.exe | shdoclc.dll | Winmgmt.exe | cisvc.exe | oleaut32.dll | taskmgr.exe | inetinfo.exe | Shell32.dll | mspmspsv.exe | internat.exe | hal.dll | comctl32.dll | mstask.exe |