Share via

CTF Loader (32 bit) (ctfmon.exe) What is this? Is it a virus or malware? (Windows 8.1)

Anonymous
2014-04-23T08:54:07+00:00

There is a process I found in my Task Manager named CTF Loader (32 bit) (ctfmon.exe) and I have just noticed it now, although in the properties of the file it says it was created last year. It's size is 10.5kb and size on disc is 12.0kb. The file is located in C:\Windows\SysWOW64. Is this supposed to be on my computer or is it a virus or some sort of malware? It says in properties that it was created on the same date and around the same time as a lot of other files in C:\Windows\SysWOW64. It's product name is Microsoft Windows Operating System. File Version: 6.3.9600.16384. Original finename: CTFMON.EXE. I have run scans with both Malwarebytes Anti-Malware and AVG AntiVirus Free Edition 2014 and both said it was safe with no threat found.

I am running Windows 8.1 on my PC.

I might add the icon for the process is a pen with a pad.

If this is a legitimate process what does it do?

Sorry if most of that information was not needed but I'm just trying to give as much information as possible. Also if anymore information is needed in order for you to help me just comment and tell me what you need!

Should I be worried about this process?

Thanks a heap for any help, it is much appreciated! 

SamoPepsi.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

31 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rob Koch 25,875 Reputation points Volunteer Moderator
    2014-04-23T10:56:42+00:00

    Hi Stephen Boots,

    Two reasons I am questioning this process.

    One is because I have never seen this running before, and I check my task manager regularly to check to mysterious processes running.

    Second reason is I did do Google searches and the websites I checked said that it should be located in Windows\System32 but mine is located in C:\Windows\SysWOW64.

    My computer seems to be running fine though, but once again Google searches have told me that a lot of Malware does not affect a PC's Performance because the Malware tries to stay hidden and also disguise themselves as legitimate programs. 

    I just like to make sure.

    Processes will appear in Task Manager only when they are operating, which in many cases is only when they are needed so they can quickly appear and disappear or only appear while running and/or remain in memory after an application has been closed.

    As for the SysWOW64 folder structure, this is where 32-bit applications are supported on a system running a 64-bit version of Windows, per the following.

    http://en.wikipedia.org/wiki/WoW64

    The problem with digging around in these things is that without years of experience with Windows, most people will simply end up confused and concerned about completely normal things, since Windows is a highly complex combination of many different modules and sub-systems.

    Rob

    30+ people found this answer helpful.
    0 comments
  2. Anonymous
    2014-04-23T10:22:00+00:00

    Why are you poking around at processes? Is the PC experiencing issues?

    ctfmon is part of the Alternative User Input components for Windows. In the location you see it, the file is for 32 bit programs that need it on your 64 bit Windows.

    http://forum.avast.com/index.php?topic=79649.0

    http://support.microsoft.com/kb/282599

    http://www.howtogeek.com/howto/windows-vista/what-is-ctfmonexe-and-why-is-it-running/

    Bing/Google is your friend.

    http://www.bing.com/search?q=ctfmon.exe&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox

    20+ people found this answer helpful.
    0 comments
  3. Anonymous
    2014-04-23T11:09:25+00:00

    Thanks Rob!

    I just don't understand why it would be needed now? I've had this PC for years now and have never seen it come up. So we have established it is not a threat. All I'm wondering now is what is cftmon.exe does? Is it useful or just a waste of memory?

    20+ people found this answer helpful.
    0 comments
  4. Rob Koch 25,875 Reputation points Volunteer Moderator
    2014-04-23T17:01:49+00:00

    It's likely that either the upgrade to Windows 8.1 or something you did personally has enabled some sort of alternate input device, which is what Ctfmon.exe supports.

    The following Microsoft Knowledgebase article, though old and so designed for older versions of Windows, provides the answers to all of your questions.  Just be aware that the controls for disabling it may have changed in later versions, so the instructions may not work.

    http://support.microsoft.com/kb/282599/en-us

    Rob

    10+ people found this answer helpful.
    0 comments