I generally run Process Explorer at every boot, just to see what's running on my Win 8 Pro x64 system. Yesterday, I noticed for the first time that AvastUI had spawned a version of CTFMON.EXE as a child task. I killed the CTFMON task, scheduled a boot time scan with Avast and rebooted. No malware was found, but after that reboot, AvastUI has not spawned CTFMON.EXE again. I understand that CTFMON is a legitimate language services component of MS Office, but I don't have any settings in MS Office 2013 that would cause it to load. I did not check the registry settings, but I will do so as soon as possible, since most security websites suggest looking at all the registry "run" and settings and MSConfig. I am using the free version of Avast and it is up to date.
Has anyone seen this behavior before?
