Viruslike behaviour of ctfmon.exe

I have a suspicious ctfmon.exe process running:


filename: ctfmon.exe
location: c:\windows\system32


After ending the process from Task Manager it keeps coming back in the process list. Ending the process and deleting the file from the filesystem won't help either: the file is remade within seconds, and restarted within minutes...

A search within c:\windows for filenames containing "ctfmon" found also the following file:


filename: CTFMON.EXE-0E17969B.pf
location: c:\windows\prefetch


I can delete this file too, but after a restart it is back again.
I found also a registry entry for ctfmon.exe in the infamous "run" section:


location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run


I deleted this entry, and it didn't return. But still ctfmon.exe keeps popping up after reboots and so forth.

To me these characteristics are typical for viruses, but both Symantec and McAfee don't recognizes this one.

---------------------------
The BIG question(s):
Is this normal behaviour for the standard MS program?
Or is it really a virus?
And subsequently how to get rid of it!
---------------------------

Thanks for any help given.

 

Hi, I have moved your thread to here as it was not a direct ProcessGuard support question.
Try Jotti's scans found here for a more thorough check.
http://virusscan.jotti.org/ Use the browse and submit buttons at the top of the page.

HTH Pilli

 

There are lots of candidates for this:-

http://castlecops.com/s795-ctfmon_exe.html

http://castlecops.com/s797-ctfmon32_exe.html

http://castlecops.com/s9205-ctfmon_exe.html

http://castlecops.com/s9624-ctfmon_exe.html

http://castlecops.com/s11474-ctfmon.html

But since it is in your System32 folder it could be genuine.

Even if it is genuine you don't want it as an autorun, it is best to turn it off:-

http://support.microsoft.com/default.aspx?scid=kb;[LN];326526

 

ctfmon.exe is a voice recognition component if i remeber correctly.
It sometimes launches even if you remove it from startup because some other software (like MS Office) triggers it.

 

Hi TopperID, yes you are right, there are plenty:

http://castlecops.com/modules.php?name=StartupList&query=ctfmon

Per request, I have a query line available now.

 

That's the way to do it!