[ulrichburke]

Dear Anyone.

Did a Google about CTFMON.exe, because I thought it was a virus, and fell over this website which I hadn't previously heard of.

Found the page about it, but the message displayed there left me even more confused than I had been when I started! Here it is in all its glory - I promise you I haven't edited a thing:-

When you run a Microsoft Office XP or Microsoft Office 2003 program, the file Ctfmon.exe (Ctfmon) runs in the background, even after you quit all Office programs.
"Ctfmon.exe activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office Language Bar. Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies."
ctfmon.exe is located in "C:\WINDOWS\System32\" when running Windows XP.

IMPORTANT: do not mix CTFMON.EXE file with the CTFMON32.EXE file.
CTFMON32.EXE file is related to such parasites as the CoolWebSearch hijacker, Raidys, and Family Key Logger. Its primary purpose is to start a parasite or launch some of its components. Once executed, the ctfmon.exe file runs a process that is responsible for the parasite's payload. ctfmon.exe is a significant part of a dangerous threat, but it can also work on its own. DO NOT execute it!

ctfmon.exe file is also installed and used by parasites Satiloler, Satiloler.d, Satiloler.c, Satiloler.e, Snow. You are highly advised to scan the system, delete executable ctfmon.exe and terminate all the processes it started.


As you'll notice, it starts off by saying 'CTFMON.exe is a GOOD piece of software. That's in the first paragraph. In the first TWO sentences of the second para - this is where it starts getting dangerous! - it says 'Don't mix CTFMON.exe with the file CTFMON32.exe'. That's clear enough. It goes on to say, my capitals, once executed, the CTFMON.EXE file runs a process that is responsible for the parasite's payload.

The THIRD para says I am highly advised to scan the system and delete executable CTFMON.EXE and terminate the processes it started.

Now come on, guys, you can't have it both ways. You can't start off by saying CTFMON.exe is a good guy, running things like TIP, speech and handwriting recognition, then end up by saying I should delete executable CTFMON.EXE!

I think you've confused yourselves here and you mean the CTFMON32.EXE file. But I'm not sure. You abruptly change from CTFMON32.exe to CTFMON.exe halfway through Paragraph Two, leaving me in limbo, not knowing which of the two I should be deleting.

Any chance of a bit of clarification here?

Yours puzzledly

ulrichburke

[Bobby]

hello there,
i must admit this description is confusing. the thing is that ctfmon.exe can be both legitimate and malicious file. just look at the description once again: