By papa_adam06 ยท 4 replies
Jun 17, 2007
  1. hello,

    I found that this files running during start up for my laptop. What does ctfmon.exe does? According to one article in this website, it's considered as dangerous program and should be removed. What should i do!
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    See HERE for info on ctfmon.exe. It is definitely not dangerous and is a Microsoft file. It is normally located in the C:\windows\system32 folder and prefetch folder. If it is found elsewhere then it`s possible for it to be a trojan.

    Regards Howard :)
  3. jobeard

    jobeard TS Ambassador Posts: 11,122   +982

    There are conflicting reports on cftmon.exe;

    The instance from Broadcom is a 'call home feedback tool' for advertizing
    and I disabled mine. This program came preinstalled on my Toshiba BEFORE
    my Office Suite was installed, so at least this version is not associated with
    MS Office.

    This post adds some background info.
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hi Jeff.

    The info in the link you gave is a little confusing and biased. Where it says
    , there isn`t actually a link to click lol. I believe the article in your link, gives totally the wrong impression of that file, as in most cases, the file is actually legit.

    It really does depend on where the file is running from as to whether it`s considered nasty or not. In fact, of all the HJT logs I`ve seen, I can`t remember many instances where ctfmon.exe was a trojan.

    See this Microsoft article on ctfmon.exe.

    I guess what I`m saying is, in the vast majority of cases, ctfmon.exe is a perfectly legit file, that normally runs from C:\windows\system32\ctfmon.exe.

    If you check your system, I`d be surprised if you didn`t find that file in that location, because as far as I`m aware, it comes with a clean install of Windows, regardless of whether the office programme is installed or not.

    I`ve certainly never had the Microsoft Office programme installed, yet I have the ctfmon.exe file in the specified location. Because I don`t actually use it, I usually have HJT fix any ctfmon,exe entries as a matter of course.

    Regards Howard :)
  5. jobeard

    jobeard TS Ambassador Posts: 11,122   +982

    oops; forgot to paste the URL to the KB article you sited :)

    There's certainly confusion on this question. Stating that ctfmon.exe is legit
    has the implication that it is needed, especially if you follow most MS recommendations.
    Heck, even the services comments are overly conservative,
    eg Alter:
    if this service is stopped, programs that use admin alters will not receive them.
    if disabled, services that depend on it will fail to start​
    just guess how many depend upon Alter? ZERO.

    Personally, I disable any/all processes that I can to reduce workload and improve
    responsiveness. CTMON.EXE was one of the first I dumped back in 2005 when
    I got the laptop and I've never had a problem from doing so. To be fair,
    I also do not have alterative input devices to be supported.

    My real point is that each user should be empowered to make the decision
    "What do I want running on MY system?"

    I think that healthy debate adds more to the background to reaching such an answer.

    You certainly have your opinions too :)
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...