ctfmon.exe - Client / Server Runtime Sub-System
If you have Microsoft Office installed, you may see a copy of ctfmon.exe running on your system. This process is responsible for activating the Microsoft Office Language Bar and the Alternative User Input Text Input Processor (TIP), so it's a legitimate Windows process. This process monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.While you may not need these capabilities, the process is very lightweight (1.5MB in memory on an XP SP2 machine running Office 2007) and uses extremely little CPU time under normal circumstances. If you do decide to remove it, instructions can be found on Microsoft's site. It is suggested that simply deleting the file may cause unpredictable behavior, so you should follow the steps outlined in Article 282599 on Microsoft's Support site to remove this utility.
As is the case with many other legitimate Windows components, the only valid copy of ctfmon.exe is to be found in c:\windows\system32. If you find a copy in any other directory or note more than one running ctfmon.exe process on your PC, it could be a virus. Malware authors frequently hijack the names of authentic Windows binaries in order to escape detection and make identification more difficult. Thus, rogue copies of this file in other locations should be treated with extreme caution.
Note that ctfmon.exe will continue to run on a PC even when Office programs are inactive. Thus, there's no cause for alarm if an instance of this process is active in Task Manager even when you're not running Word, Excel, or other Office applications.
As usual, scanning with a good spyware tool is likely to detect known malware that impersonates this binary. Be sure to download the latest malware signatures prior to scanning. Otherwise newly written viruses or spyware applications may not be detected.
windowshelp.net