ctfmon.exe is it spyware?

[nanna]

So I am running spybot SD and spywareblaster on my laptop, and I recently found a new startup process that Spybot claims is spyware associated with Coolwebsearch. I looked it up on an online process library and found out that it could either be associated with microsoft word's language bar, or it could be spyware. How can I tell?

When the process (ctfmon.exe) is running, I can't complete a spybot scan, but when I kill the process, the spyware scan runs just fine, but doesn't find anything (it usually finds tracking cookies, but I think I have been using Ccleaner pretty recently before each scan, so that could account for that).

does anyone else have this process running on their computer, or have you heard of it?

process name: ctfmon.exe

Location: C:\WINDOWS\system32

process type: application

other locations a random search of my computer found that seemed like they related to the process:

C:\i386

EX_File

CTFMON.EX_

C:\WINDOWS\Prefetch

CTFMON.EXE-05E57A5E.pf

PF File

Any info would be much appreciated

-Nanna

[-pops-]

There is some malware that masquerades as this file but before you do anything drastic, have a look at what Microsoft say about the genuine article http://support.microsoft.com/kb/282599

I have the file running on one of my machines as it is a part of MS Office. It doesn't interfere with anything and I wouldn't have known it was there unless I had looked for it to respond to your thread.

It does seem, then, that you do have something you might be better off without so, why not do a HiJackThis scan following this and post for one of our experts to have a look at it.

[andsome]

Here is a result of a searh on my computer.

[Thos]

Except that I don't have the pre-fetch file my results are exactly the same as andsome above, including the date and time to the minute.

Thos.

[Boris]

WinPatrol Plus says :-

Alternative User Input Text Input Processor - CTFMON.EXE

CTFMON.EXE activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office Language Bar.

CTFMON monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.

When you run a Microsoft Office XP program, the file Ctfmon.exe (Ctfmon) runs in the background. It remains in memory even after you quit all Office programs.

CTFMON was first included with Office 2002. More detail on what the program does can be found at http://support.microsoft.com/default.aspx?...b;EN-US;q282599.

[jason.b.c]

Coolwebsearch.

Get rid of it..! Get rid of it..!

VIRUS - SPYWARE - ADWARE..!

Trust me..

[nanna]

So now the question is, how do I get rid of it?

It doesn't get picked up on a scan by ad-aware, spybot, or AVG free.

I have already posted the files that are found when I search for it on my hard drive, so should I just delete them all? I don't feel good about randomly deleting things from my computer without knowing ahead of time what the effect will be, especially from system related locations.

I tried using spybot's startup process killermabob to both keep it from running, and to delete it, but neither worked. So I tried startup inspector and tried to do the same thing: either keep it from running, or kill it altogether. No luck there either.

Any ideas?

[jason.b.c]

So now the question is, how do I get rid of it?

It doesn't get picked up on a scan by ad-aware, spybot, or AVG free.

I have already posted the files that are found when I search for it on my hard drive, so should I just delete them all? I don't feel good about randomly deleting things from my computer without knowing ahead of time what the effect will be, especially from system related locations.

I tried using spybot's startup process killermabob to both keep it from running, and to delete it, but neither worked. So I tried startup inspector and tried to do the same thing: either keep it from running, or kill it altogether. No luck there either.

Any ideas?

( 1 ) Control Panel - Add & Remove Programs - UNINSTALL anything that say's "CoolWebSearch"

( 2 ) Then go to Start Menu - Run - type: "msconfig" , Go to the tab all the way to the right ( should say startup or something like that ) and check through that for anything related , Disable ( if possible remove ) anything for "CoolWebSearch"

( 3 ) Any toolbar you've installed related to CoolWebSearch for your browser(s) uninstall as well..

( 4 ) Make sure your security stuff is up to date ( spybot - AVG - ad aware ) and scan your system again..

( 5 ) Can you post a report file here for what else is left..??? Scan results and such.? I'll be able to tell you better after i see something like that..

[jason.b.c]

CoolWebSearch is adware..

Official Description: One of the most infamous highjackers known to date. Comes in a variety of versions, all using different techniques.

Handle with extreme care!

CoolWebSearch is a name given to a wide range of different browser hijackers. Though the code is very different between variants, they are all used to redirect users to coolwebsearch.com and other sites affiliated with its operators.

Google Search :D

[nanna]

( 5 ) Can you post a report file here for what else is left..??? Scan results and such.? I'll be able to tell you better after i see something like that..

Sure, but AVG, spybot and ad-aware have not found anything at all. the only reason I found it was that I religiously check my number of startup processes (something to do I guess). I also just posted a hijackthis log file, but I can put it here too if you think it would help.

Also, nothing coolwebsearch related, or even unrecognized in programs, and msconfig just has the one process that seems sketchy, and that I have been having trouble with. Everything else is squeeky clean.

Let me know what kind of result you are looking for, I might just run another (my ninth today) AVG scan and post any results here.

[-pops-]

nanna, I would wait for the experts to look at your HJT post before you proceed.

[jason.b.c]

nanna, I would wait for the experts to look at your HJT post before you proceed.

Yea that might be best for now..

[nellie2]

ctfmon32 is related to Coolwebsearch. See here for more information. Panicking and deleting everything in sight is not recommended. You could delete critical system files and render your computer unusable, which is slightly worse than having a coolweb infection which is fixable.