Windows Explorer search and ctfmon.exe

Collarspace Discussion Forums

Home Login Search

Windows Explorer search and ctfmon.exe

View related threads: (in this forum | in all forums)

Logged in as: Guest

All Forums >> [Casual Banter] >> Off the Grid >> Windows Explorer search and ctfmon.exe

Page: [1]

Message

<< Older Topic Newer Topic >>

Windows Explorer search and ctfmon.exe - 3/20/2007 10:59:02 AM

iwannapullurhair

Posts: 283
Joined: 10/11/2005
Status: offline

I found out something new about the windows explorer and the search program(not internet search, the one under your control panel near the run command and under control panel if you have windows XP. Just hit the green start button in the lower left corner, you will see it). I believed this program called ctfmon.exe had allowed outside access with windows explorer to get into my computer.

So I had spotted this program in the taskmanager. I thought it was suspicious. So I did a search. It showed up in a couple places-Windows 32 and The windows service pack files. I'm still a little worried about it. As I was paranoid about security on my computer, the windows explorer kept asking for outside access, which I allowed several times, then decided to deny it-thinking it was allowing hacker access.

I found out today while reading about Explorer(not Internet Explorer-your windows shell-Explorer-it controls the file systems and desktop, etc). When you do a search with the cute little animated doggie, each time, Explorer tries to contact Microsoft to keep it up to date with its file names and other info. So Each time I did a search to check the progress of the ctfmon.exe, it would activate explorer and try to access the outside, which would freak me out, since I didn't know it would try to do that-to me it was confirmation that a hacker was using explorer to get in.

I would still like anyone here with Windows XP with Service Pack 2 or just Windows XP to do a search for ctfmon.exe in all files and folders and see what you get, if you would. Mine shows in two prefetch files, Windows system 32, and Windows\ ServicePackFiles\i386. It is the Service pack one I'm most concerned about. I want to see if anyone else has it. It keeps showing as modified, but I don't know if a search itself will cause any change.

To do the search-Hit the Green Start button(lower left corner), the box for all programs and recent used programs, Run, Search, My documents,etc will pop up. Hit search. Then Hit all files and folders for your search area and type in ctfmon.exe and search. There should be a cute animated puppy below the search options on the left. You should definitely see the file in Windows\system32. I want to know if you find it anywhere else.

Profile

Post #: 1

RE: Windows Explorer search and ctfmon.exe - 3/20/2007 4:02:52 PM

proudsub

Posts: 6142
Joined: 1/31/2004
From: Washington
Status: offline

I did a search and didn't find ctfmon.exe. But i do have a file called ctfmon in the system 32 directory. It's an application and the description says CTF loader, whatever that means. Hope you get this figured out.

_____________________________

proudsub

"Without goals you become what you were. With goals you become what you wish." .

"You are entitled to your own opinions but not your own facts"--Alan Greenspan

(in reply to iwannapullurhair)

Profile

Post #: 2

RE: Windows Explorer search and ctfmon.exe - 3/20/2007 5:01:20 PM

Termyn8or

Posts: 18681
Joined: 11/12/2005
Status: offline

Found this in a Google search :

When you run a Microsoft Office XP program, the file Ctfmon.exe (Ctfmon) runs in the background, even after you quit all Office programs.
Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.
See How to uninstall CTFMON.EXE
Note: The ctfmon.exe file is located in the folder C:\Windows\System32. In other cases, ctfmon.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
__________________________________________________________________

So that means for one, if you don't have office you shouldn't have it. If you do have, the way I read it is that it belongs in one of the system directories, but apoparently hackers or whoever decided to name their file the same.

When you get into windows explorer, here are a few tips. View>Details. Then go to file types and untick the box that says "Hide registered file types". That is why the other poster found ctfmon, but not ctfmon.exe. Somehow I got Win98SE ton hold those setting for all directories, and start in roo C:\ instead of startmenu.

If you set it to show hidden and system files, you can also put almost anything you want into the Sento menu, when you right click. Don't copy exes, create a shortcut in Dektop and then oyu have to move it in explorer.

In 98SE it is simple, but in XP you'll find it under Documents and setting and under whatever username you are using. Yes, different users get different sendto menus as well.

You can also rename a javascript to HTM and it will execute, that's how I get on IRC with no banners or anything, without having IRC. There are many files tyou can name HTM if you want to force IE to open it. But then you can also put a shortcut to IE in the Sendto making this unnecessary.

In my Sendto I have a couple of image editors, they have different function so for any given task I can choose. I also have the old and new media players. The advantage to that is in the old player I can have multiple files playing at once. The combination of the two also lets me play a video and substitute the sound from another file.

T

(in reply to proudsub)

Profile

Post #: 3

RE: Windows Explorer search and ctfmon.exe - 3/21/2007 10:58:32 AM

iwannapullurhair

Posts: 283
Joined: 10/11/2005
Status: offline

Well, System 32 is supposed to have it(windowsXP). You should also find it in a Windows Prefetch-(pf file). I checked with a friend that has XP, but he didn't even know what Service Pack 2 was and he had it in System32 and one prefetch. I need to know from someone who definitely has WindowsXP Service Pack 2, if they have a ctfmon.exe file in:
C:\Windows\ServicePackFiles\i386
That is where the second, questionable file appears, Another prefetch also appeared, but it may have appeared after I shutdown the language bar function in Regional and Language settings in Control panel. ctfmon.exe no longer appears in Taskmanager when I bring it up since I shutdown the language bar in Control Panel.

(in reply to Termyn8or)

Profile

Post #: 4

RE: Windows Explorer search and ctfmon.exe - 3/21/2007 11:04:51 AM

iwannapullurhair

Posts: 283
Joined: 10/11/2005
Status: offline

Terminator, I have already been to that one page you referenced and a few like it. People make many comments on it. Some mention the prefetch and others mention shutting down the langage bar in control panel. Some think it is harmless, others think it is a threat.

I need to speak to someone that really knows their system and knows if the program in question can be in the Windows Service Pack 2.

The instructions on Microsoft's page say how to deactivate functions from ctfmon.exe using Add/Remove programs and you need to know the Office program it is in.

(in reply to iwannapullurhair)

Profile

Post #: 5

RE: Windows Explorer search and ctfmon.exe - 3/21/2007 11:37:39 AM

iwannapullurhair

Posts: 283
Joined: 10/11/2005
Status: offline

Yes, both of mine are loaders, I started with the ctfmon.exe on my search. The other two are prefetch. A basic user should have at least the loader in Windows\system32 and a prefetch. I just need to know if ServicePackFiles can legitimately have a ctfmon. I shutdown my language bar-does prefetch create another prefetch to account for that action?

(in reply to proudsub)

Profile

Post #: 6