Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: stitt on June 09, 2011, 03:00:34 PM

Title: what is ctfmon.exe*32?
Post by: stitt on June 09, 2011, 03:00:34 PM

hi all, I cannot find the answer to this anywhere. I have a week old install of 64 bit 7 home premium. It's a games pc with a 400 gig steam folder, WoW, Rift, etc.

I run nothing from strat up except windows services, avast and creative drivers.

I have never had any microsoft office gear installed, I do however run libreoffice.

Occassionally, maybe once a day I notice ctfmon.exe*32 running in avasts auto sandbox and in task manager, tracing the file C:Windows\syswow64\ctfmon.exe.



what is it?



I run hitman pro and malwarebytes as scanners they cant find anything?

thanks in advance.

Title: Re: what is ctfmon.exe*32?
Post by: CraigB on June 09, 2011, 03:24:16 PM

Dont know how you cant find any info on ctfmon as a simple google brings up an abundant amount of information about the subject
http://www.bleepingcomputer.com/startups/ctfmon.exe-1121.html

Title: Re: what is ctfmon.exe*32?
Post by: spg SCOTT on June 09, 2011, 03:34:48 PM

It is related to SafeZone, which is why it will be sandboxed:

Quote from: Vlk

ctfmon.exe is a helper process used in Windows to support input in multiple languages. Your observation is right, Windows injects it into the SafeZone as soon as an interactive process is started there, but I don't think it's a problem.

Call it a feature. ;)

http://forum.avast.com/index.php?topic=71652.msg598771#msg598771

Title: Re: what is ctfmon.exe*32?
Post by: stitt on June 09, 2011, 03:51:08 PM

Ah yes that would make sense, never noticed it before, probably wouldnt have now if i had not seen it in the sandbox.
thanks for the replies.

Title: Re: what is ctfmon.exe*32?
Post by: DavidR on June 09, 2011, 04:18:41 PM

I also think I have seen something like this before (not necessarily relating to the safezone) and that it has something to do with the fact that it is running as the 32 bit version of ctfmon.exe on a 64bit OS.

Title: Re: what is ctfmon.exe*32?
Post by: stitt on June 09, 2011, 04:21:19 PM

hmm, I have had a look and the only program i have installed is libreoffice (that is multiligual) that is 32 bit program, i used it before when it was called open office.
I am fairly sure this is not malware as it's pretty much a clean install, it is just a process i am not familiar with.

Title: Re: what is ctfmon.exe*32?
Post by: DavidR on June 09, 2011, 04:53:11 PM

The ctfmon.exe file is an OS file (given your previous path C:Windows\syswow64\ctfmon.exe), whilst 32bit version LibreOffice is likely to use it, it is unlikely it would have its own version. So it is likely to be using the 32 bit version (in a 64bit OS), hence the *32 suffix after the file name, at least that is what I believe happens.

Title: Re: what is ctfmon.exe*32?
Post by: stitt on June 09, 2011, 05:14:12 PM

so it shouldn't be there? eeek! if i have picked up my first infection in 8 years and within a week of using avast im proper annoyed!

Title: Re: what is ctfmon.exe*32?
Post by: DavidR on June 09, 2011, 05:17:06 PM

No that isn't what I'm saying, in a 64bit OS if a program requires a 32bit version of a system file than that suffix normally indicates that it is running the 32bit version of the file.

Title: Re: what is ctfmon.exe*32?
Post by: stitt on June 09, 2011, 05:40:04 PM

right! I will keep my eyes on it then, thanks for the advice.

Title: Re: what is ctfmon.exe*32?
Post by: DavidR on June 09, 2011, 06:08:00 PM

You're welcome.