ctfmon

ctfmon (ctfmon.exe) is a process used by Microsoft Office to activate the Alternative User Input Text Input Processor (TIP) and also the Microsoft Language Bar. Ctfmon is also a component of Windows XP Tablet PC Edition and Windows Vista which enables advanced user input services in applications (pen and ink, speech etc.).^[1]

Disabling

In Windows XP, this component loads automatically if certain applications (including Microsoft Office) are installed, and runs as a background process even when not in use. If you do not use alternative input services or language/keyboard layouts, the component can be disabled as follows: click Start Menu > Run; type "intl.cpl" and click OK; (Depending on your XP setup, instead you may need to go to your Control panel, click Regional and language options then continue as follows) select the Languages tab and click Details; select the Advanced tab; check "Turn off advanced text services" and click OK.

It may be necessary to turn off the Language Bar also. As above, run "intl.cpl". Under the Languages tab, click Details; click the button at the bottom called Language Bar (if it is not greyed out); disable the Language Bar.

You may need to reboot and you may find that it reinstalls itself. To prevent this you may need to go Run, msconfig, select the Startup tab and make sure that all references to ctfmon.exe are unticked, click Close and the next time the computer starts, it should not load the file. However, it is hard to keep down and you may need to do this all again after you install or update some programs.

The Microsoft knowledgebase article referred to in the reference section has some further advice, but again is limited.

Virus Warning

There is also a common trojan disguising as cftmon.exe, known as Troj/VB-CSA, or FakeRecycled. The virus was written in Visual Basic and infects USB flash drives, by creating an autorun.inf, a Recycled directory and itself, similar to an old style boot floppy virus. The virus does not hide itself. The md5sum is :

• 6c4b9b79650d57008e04cfe167219b47 Recycled/ctfmon.exe

References

1. ^ Ctfmon.exe FAQ in Microsoft Knowledge Base