What is ctfmon.exe? Why is it Running?

Computers slows down in time. And if that happens, the first thing we do is look for the background processes on the task managers of our respective operating systems. Should we see any unfamiliar tasks or processes, our final diagnoses would always be “malware”. Most especially for Windows users.

Unlike macOS, Windows OS is prone to many infections. So, it comes as no surprise that most users may mistakenly diagnose simple task as virus which is not always the case. Today, we dig to one of the most common background processes that most of us are confused by.

This article is a part of our Windows explanatory series which explains different process found in Windows like msvcp140.dll, msvbvm50.dll, CompatTelRunner.exe, dllhost.exe and many more.

What is ctfmon.exe?

The ctfmon.exe is a software component of Microsoft Office. It usually runs in background, and monitors active windows. Its main purpose is to activate Microsoft Office Language Bar and Alternative User Input Text Input Processor.

That means, it provides support for alternative data input methods such as text-to-speech, voice recognition, handwriting, some language inputs (e.g. Korean, or Chinese), and others. Hence, ending the task will result to abnormal behavior in some features of the Microsoft Office programs.

Ctfmon stands for Clear Type Font Loader Monitor, whilst the .exe filename extension indicates that it is an executable file. While some malware disguises with an .exe extension at the end, not all .exe files are considered malware. In fact, .exe is the standard file extension used by all Windows programs. This is similar to the .dmg file extension found on any macOS installer.

How to Check if ctfmon.exe is a Virus?

You can find the ctfmon.exe via Windows Task Manager. The main process is listed as CTF Loader, CTF means Collaborative Translation Framework, an authentication service that delivers text support from alternative users input application such as keyboard translation, speech recognition, and handwriting. It also houses the ctfmon.exe process inside.

While it is not essentially a core part of the Windows OS, Microsoft Word still relies on CTF Loader to carry out some tasks.

A right-click (or two-finger tap for laptop) on the CTF Loader will bring out some options. Clicking on “Go to details” will show more processes. While scrolling through these processes, you will see the ctfmon.exe file running our target task.

To verify if the ctfmon.exe running on your computer is a legitimate Windows process, we will have to check its location.

1. To do this, right-click (or two-finger tap for laptop) to the ctmon.exe to bring up some options. Click “Open file location.”
2. The ctfmon.exe should be located in the C:\Windows\System32 folder or C:\Windows\SysWOW64.
3. Now, if the ctfmon.exe is simply located on the C:\Windows folder, then there is a high chance that your computer has been compromised.

How To Remove ctfmon.exe Virus?

While ctfmon.exe is a legitimate process, malware like the Trojan horse is also using this name to disguise itself. The ctfmon.exe Trojan is a very dangerous virus as it creates backdoor to your computer to make it accessible for hackers.

Also Read: What Is IDP.Alexa.51 And Is It A Virus?

They can enable control to it by remote access, or turn your computer to a botnet to perform distributed denial-of-service attack (DDoS Attack), steal data, or send spam without you knowing it.

While we can scan this using a free anti-virus tools, some programs offer virus removal only if you pay a dime. And we won’t be doing that today. We will help you remove the ctfmon.exe Trojan manually.

Steps To Remove ctfmon.exe

Step 1. Launch your Task Manager by pressing CTRL+SHIFT+ESC keys in order.

Step 2. Once you are on the Task Manager, click on the “Details” or “Processes” tab. This should allow us to see the ctfmon.exe process without us having to open the CTF Loader.

Step 3. Review all the processes related to ctfmon.exe and note the suspicious ones. Keep an eye on the “Description” column. Look for the ones that has the words Trojan- ransom, or anything related.

Step 4. Right-click (or two-finger tap for laptop) on the suspected process, then Open File Location. Note of the location.

Step 5. Go back to the Task Manager and right-click again. Click “End Process Tree”. This should close all the related processes and services of the suspected task.

Step 6. Open the folder which is the location of the suspected process. Click on “Organize” button, choose “Folder and Search Options.” Select the “View” tab, then “Show hidden files and folders” option. Uncheck “Hide protected operating system files”. Click “Apply”, then “OK”.

Step 7. Open Windows Registry by pressing the Windows Logo Button, and the R key simultaneously. There will be a small window that will appear on the bottom of the display. On the dialogue box, type “Regedit”.

Step 9. Depending on your OS (x86 or x64) navigate to:

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] (x64)
• [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

Step 10. And delete the display Name: [RANDOM]

Step 11. Now, launch File Explorer and navigate to %appdata% then delete the malicious executable file we have found out earlier.

Cleaning Hosts File To Avoid Unwanted Redirection

Now that we have removed the malware, it is time to make sure you never cross path with it again online. We will be wiping your HOSTS file, and salvage the Ctfmon.exe on your computer.

Step 1. Launch File Explorer again, and navigate to %windir%. Look for “System32”, and then “drivers”.

Step 2. Look for the folder “etc”. Inside, you should be able to find “hosts” file. Double click on that.

Step 3. If ask which program are you using to open the file, choose “Notepad”.

Step 4. If you were hacked, there should be unfamiliar and foreign IP addresses on the list. For example, [IP ADDRESS] www.google.com.au, or [IP ADDRESS] www.google.com.jp. Usually, Google addresses with foreign domain at the end. Delete those. Otherwise, don’t change anything.

FAQ’s

If you don’t pretty much care about the text-to-speech feature and any features that needs Ctfmon.exe, then you can remove the process from your computer. We won’t advise you doing it though, it may cause abnormal behavior to the Microsoft Word. You can, however, always stop it on the Task Manager.

No, unless it is being used by Trojan to disguise itself.