Is Window's ctfmon.exe a kind of keylogger ?

[true north]

Hi there,

I am wondering why ctfmon.exe allways try to run but when I block it everything is working fine without it. I understand that this "exe" is involved in many applications but for what I am suspicious whether this "exe" is calling back home to Microsoft all the time like a keylogger.
Thanks for your opinion.

true north

[greencoconut]

my firewall has never prompted me about ctfmon trying to make outbound connection.. i usually prevent ctfmon from running by modiying acl

[steve161]

Ctfom.exe is part of the microsoft offfice language options. Most people do not need it. It is not a keylogger but very hard to rid your comp of. I believe if you punch it in to the search function of this forum, you will get some advice to rid your comp of it. By the way, I ditched office for openoffice and still had to jump through hoops to delete ctfmon. Honestly, I forget what actually worked.

[Seer]

Hey there, true north

Calling home? If you right-click on your taskbar and point to 'toolbars' menu, you will see a 'language bar'. This is ctfmon.exe, it is used to select keyboard inputs for various different languages. If you are using other languages to type (in MS Word ie.) you are using ctfmon.exe. If not using other language than default english US, turn off ctfmon.exe in: Control Panel -> Regional and language options -> Languages tab -> Details button -> Advanced tab and there tick 'Turn off advanced text services' box. There you go, no ctfmon.exe loading when you start your system, no instance in task manager, no language bar on taskbar options . But I really don't think ctf is doing any harm even if calls home, which is very very unlikely. Trust me, MS really don't care about your keyboard logs.

Moderator should be moving this thread to 'software & services'.

Cheers.

[steve161]

I did try that but it only worked for a while. One day I boot up, and tah-dah, ctfmon. I followed a post that suggested changing the security policy for ctfmon, and that finally worked. And no, I can't remember what i did exactly. Honestly, I am not sure what I did when I was doing it, but it worked. Thank god for forums.

[Seer]

Hello benny bronx

Well, on my 3 rigs, that works fine, although I am using serbian language on one, so I find ctfmon useful on it. Just before my previous post I disabled advanced text services, and ctfmon disappeared from task mgr. Maybe I'm wrong, and this little problem needs some deep digging for a solution for every system setup, but ctfmon is definitely NOT a malware and is very unlikely used to send your keyboard input to MS. Anyway, I will remember your post and watch if something similar happens with my ctfmon. In the meanwhile, maybe some elder geek around here will clear this up for us.

Regards.

EDIT: benny, perhaps you installed some app which automaticaly turned on adv text services without your consent?

[steve161]

Hey Seer:

Possibly, I heard that an upgrade to IE7 would do that. But I did check numerous times to see if the advanced test services was turned off, and it was, yet ctfmon would return. Only after I changed the security settings for it did it dissapear from taskmanager. You are not the first person to find this unusual. Anyway, I don't remember it calling home.

[argus tuft]

yep, IE7 is to blame
after installation of IE7 I found ctfmon.exe trying to run when there shouldn't have been any need for it to, and each time it ran, it tried to add itself to startup. I mean, what on earth are advanced text services needed for when opening SUPERanti-spyware? its not even as if you can input text in sas... It happened with many other apps also

[Seer]

Hello friends.

Take a quick look at this link:

http://support.microsoft.com/?kbid=282599

Well, I have IE7 installed, and I had no trouble disabling ATS via Control Panel forever. But, according to MS, if you have Office installed, additional steps may be required regarding Alternative User Input (you should exclude it from Office installation if I understood properly) in order to disable ctfmon. I don't use Office, so maybe that's why I didn't have same problems as benny. benny and argus do you have Office installed maybe? Yes, I found here http://blogs.msdn.com/ie/archive/2006/06/29/650098.aspx that IE7 turns ATS on, but why would IE7 use such feature is beyond me also.

[steve161]

That is the strange thing here. I deleted office in its entirety and replaced it with openoffice and ctfmon was still present.

[true north]

Hi there,

thanks all for your input. I unchecked cftmon.exe as advised.
No problems using WIN Office so far.

Thanks again

[argus tuft]

@ The Seer, no, I don't have office installed, the most advanced word processing sw on my pc is wordpad lol

[Rilla927]

I followed Seer instructions in post #4 and I have Office 2003 installed and it worked perfectly fine for me. This process drove me crazy, thanks Seer. I have not d/l IE 7 yet though.

[Seer]

Hello, argus tuft.

originally posted by argus tuft:

the most advanced word processing sw on my pc is wordpad

(same here)

What about your association with IE7? Seems I remember that it indroduces some new spell checking thing. If it does check spelling for diffferent languages, it may have something to benefit from ctfmon.exe. But I also use IE7 (well, occasionally) and I don't see ctfmon in tasks.

To true north and Rilla927: , and Rilla927, you don't need to bother with IE7.

EDIT: to benny bronx
Well, I don't use OpenOffice either, but ctfmon.exe is a part of Windows, not MS Office, and still could be used by OpenOffice somehow. Try digging through the Options in OO?

[Rilla927]

Originally Posted by The Seer

To true north and Rilla927: , and Rilla927, you don't need to bother with IE7.

To tell you the truth I don't think I'm going to bother with it period because I don't use IE except for windows updates.




*

[Seer]

To Rilla927:

You don't need to bother with wupd either. Use AutoPatcher XP. You d/l a package of XP updates (20-30 Mb) monthly, not just the critical ones, but suggested, optional and administrative, and then you choose which ones you want to install on a rig. You can completely stop and disable Windows Update service and ditch IE6 aswell. Very convenient stuff.

[Rilla927]

Originally Posted by The Seer

To Rilla927:

You don't need to bother with wupd either. Use AutoPatcher XP. You d/l a package of XP updates (20-30 Mb) monthly, not just the critical ones, but suggested, optional and administrative, and then you choose which ones you want to install on a rig. You can completely stop and disable Windows Update service and ditch IE6 aswell. Very convenient stuff.

Hi Seer,

I assume you use this as well! Have you had any problems getting updates?

Believe me, I would love to ditch IE but some sites require IE in order to do certain things, so how do you get around that? I use Opera 9.1 and I still have to investigate how to make Real Player open Opera and not IE. I have come across certain courses I would sign up for and it says at the site IE required. Will not work with any other browsers.

[Seer]

Hi Rillla927.

originally poste by Rilla927:

I assume you use this as well!

Well, I have a bought copy of XP Pro, and I don't find AutoPatcher as a necessity on my machines really. But I live in a third-world country callled Serbia and all of my n00b friends are using a pirated XP, almost without exception. Since the last WGA check tool MS published in the middle of last month really filled my cup, as my girlfriend accidentally installed it and she seemed to have that nagware message about counterfeited Windows, I decided to advise her of completely disabling wupd and using AutoPatcher from now on. The really nice thing about it is that you don't have to delve through that MS update site if you want to install other than critical updates, you have everything in one place, and you can easily choose your preferences from the installation options. And, of course, it's free, and thus far no problems with it whatsoever. The other positive aspect of disabling wupd is that you don't have to be online with MS all the time, automatically checking for updates.

originallly posted by Rilla927:

I would love to ditch IE but some sites require IE

Yes, I am aware of that also. I believe it's my fault as I haven't been very specific. I didn't advise you to ditch IE completely, I was merely stating that it can be done. Now, don't get me wrong, I am not a MS hater, and I don't find IE to be such a bad piece of sw as many here at Wilders do. By all means keep your IE6, but you don't really need to bother with v7 as it introduces nothing new compared to other browsers. I use Opera 9.10 also, and I believe it has a reputation as a king of innovations. Sorry, I can't help you with that issue of Real player requiring IE only, and as far as I understand, there is no definite workaround on this.

My regards.

[Rilla927]

Originally Posted by The Seer

Hi Rillla927.



Well, I have a bought copy of XP Pro, and I don't find AutoPatcher as a necessity on my machines really. But I live in a third-world country callled Serbia and all of my n00b friends are using a pirated XP, almost without exception. Since the last WGA check tool MS published in the middle of last month really filled my cup, as my girlfriend accidentally installed it and she seemed to have that nagware message about counterfeited Windows, I decided to advise her of completely disabling wupd and using AutoPatcher from now on. The really nice thing about it is that you don't have to delve through that MS update site if you want to install other than critical updates, you have everything in one place, and you can easily choose your preferences from the installation options. And, of course, it's free, and thus far no problems with it whatsoever. The other positive aspect of disabling wupd is that you don't have to be online with MS all the time, automatically checking for updates.

I checked the link out you gave me and it sounds like it would be worthy, especially when MS doesnt support a specific OS anymore this would be real handy.

Yes, I am aware of that also. I believe it's my fault as I haven't been very specific. I didn't advise you to ditch IE completely, I was merely stating that it can be done. Now, don't get me wrong, I am not a MS hater, and I don't find IE to be such a bad piece of sw as many here at Wilders do. By all means keep your IE6, but you don't really need to bother with v7 as it introduces nothing new compared to other browsers. I use Opera 9.10 also, and I believe it has a reputation as a king of innovations. Sorry, I can't help you with that issue of Real player requiring IE only, and as far as I understand, there is no definite workaround on this.

My regards.

I'm sorry, I misunderstood! It's no fault of yours. I'm not a MS Hater*either, there are certain aspects of the OS I don't like and I never liked IE from day one because it's so unsafe to use.

Thanks for the valuable information Seer you are a good ole chap

[Seer]

Hey.

originally posted by Rilla927:

Thanks for the valuable information Seer you are a good ole chap

You're very welcome.

Cheers brother.