ctfmon.exe

[papa_adam06]

hello,

I found that this files running during start up for my laptop. What does ctfmon.exe does? According to one article in this website, it's considered as dangerous program and should be removed. What should i do!

 

[howard_hopkinso]

See HERE for info on ctfmon.exe. It is definitely not dangerous and is a Microsoft file. It is normally located in the C:\windows\system32 folder and prefetch folder. If it is found elsewhere then it`s possible for it to be a trojan.

Regards Howard

 

[DelJo63]

There are conflicting reports on cftmon.exe;

The instance from Broadcom is a 'call home feedback tool' for advertizing
and I disabled mine. This program came preinstalled on my Toshiba BEFORE
my Office Suite was installed, so at least this version is not associated with
MS Office.

This post adds some background info.

 

[howard_hopkinso]

Hi Jeff.

The info in the link you gave is a little confusing and biased. Where it says

this should not be confused with the valid Office XP file, see here.

, there isn`t actually a link to click lol. I believe the article in your link, gives totally the wrong impression of that file, as in most cases, the file is actually legit.

It really does depend on where the file is running from as to whether it`s considered nasty or not. In fact, of all the HJT logs I`ve seen, I can`t remember many instances where ctfmon.exe was a trojan.

See this Microsoft article on ctfmon.exe.

I guess what I`m saying is, in the vast majority of cases, ctfmon.exe is a perfectly legit file, that normally runs from C:\windows\system32\ctfmon.exe.

If you check your system, I`d be surprised if you didn`t find that file in that location, because as far as I`m aware, it comes with a clean install of Windows, regardless of whether the office programme is installed or not.

I`ve certainly never had the Microsoft Office programme installed, yet I have the ctfmon.exe file in the specified location. Because I don`t actually use it, I usually have HJT fix any ctfmon,exe entries as a matter of course.

Regards Howard

 

[DelJo63]

oops; forgot to paste the URL to the KB article you sited

There's certainly confusion on this question. Stating that ctfmon.exe is legit
has the implication that it is needed, especially if you follow most MS recommendations.
Heck, even the services comments are overly conservative,
eg Alter:

if this service is stopped, programs that use admin alters will not receive them.
if disabled, services that depend on it will fail to start​

just guess how many depend upon Alter? ZERO.

Personally, I disable any/all processes that I can to reduce workload and improve
responsiveness. CTMON.EXE was one of the first I dumped back in 2005 when
I got the laptop and I've never had a problem from doing so. To be fair,
I also do not have alterative input devices to be supported.

My real point is that each user should be empowered to make the decision
"What do I want running on MY system?"

I think that healthy debate adds more to the background to reaching such an answer.

You certainly have your opinions too