Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

About 100 Ctfmon.exe Processes Please Help


  • This topic is locked This topic is locked
8 replies to this topic

#1 mofinatar

mofinatar

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 18 November 2007 - 08:35 AM

i dont no why but when my comp start up ctfmon.exe processes start appearing taking up all my memory there's about 100 now as i type this, anybody have a clue why this is happening?

Edit: Theres over 150 now still rising :thumbsup:

Edited by mofinatar, 18 November 2007 - 08:47 AM.


BC AdBot (Login to Remove)

 


m

#2 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:54 PM

Posted 18 November 2007 - 09:36 AM

Did you by chance try disabling it with MSCONFIG? That won't work. First you need to understand what it is and what it does before you can troubleshoot the issue. Ctfmon.exe activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office Language Bar. Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies."
Have a look here to help you to determine what to change in you Office setup
http://support.microsoft.com/kb/282599
Mark
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 hamluis

hamluis

    Moderator


  • Moderator
  • 54,859 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:54 PM

Posted 18 November 2007 - 10:46 AM

Followup to Mark's comments, http://www.howtogeek.com/howto/windows-vis...-is-it-running/

Louis

#4 mofinatar

mofinatar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 18 November 2007 - 03:14 PM

right now its getting seriously annoying its up to 200+ Ctfmon.exe Processes, thanks for the reply guys but i think this is a virus or something along the lines of that, the links you sent are for people wanting to delete one off this process, ive system restored and no result, ive deleted each process then when finally i got to the last one and the computer just restarted over and over, now for some reason the pc has recovered from its little restarting spasm and started to work again..........5 minutes later guess what...ctfmon.exe's start off again at the moment there are 264 using 4.8 gb of my page file usage on task manager.

please let me pick your brains and get this sorted. thanks ;)

#5 mofinatar

mofinatar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 18 November 2007 - 04:04 PM

sorry to double post but i just restarted again and heres something that might help you guys see what im saying theres about 100 on this

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:01:24, on 18/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\WINDOWS\system32\cftmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ldr.exe
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\cftmon.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{12F62808-5EC5-4D6F-BD6C-0740F93C4717}: NameServer = 85.255.116.86,85.255.112.82
O17 - HKLM\System\CCS\Services\Tcpip\..\{9FDB03DD-C0E4-4F34-97FC-E4AA3A42ADFB}: NameServer = 85.255.116.86,85.255.112.82
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.86 85.255.112.82
O17 - HKLM\System\CS1\Services\Tcpip\..\{12F62808-5EC5-4D6F-BD6C-0740F93C4717}: NameServer = 85.255.116.86,85.255.112.82
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.86 85.255.112.82
O17 - HKLM\System\CS2\Services\Tcpip\..\{12F62808-5EC5-4D6F-BD6C-0740F93C4717}: NameServer = 85.255.116.86,85.255.112.82
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.86 85.255.112.82
O20 - AppInit_DLLs: C:\WINDOWS\system32\svchj.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6368 bytes

if anyone has any sort of opinion please voice it !!Help!!

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 54,859 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:54 PM

Posted 18 November 2007 - 04:26 PM

If you think you have a malware problem, you need to post in the Hijack This Forum.

Louis

#7 CTH_Tom

CTH_Tom

  • Members
  • 295 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 18 November 2007 - 04:29 PM

Looks like malware,
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ldr.exe
http://www.prevx.com/filenames/21118635231...X1/LDR.EXE.html

Edited by CTH_Tom, 18 November 2007 - 04:29 PM.

X

#8 mofinatar

mofinatar
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:54 PM

Posted 18 November 2007 - 08:12 PM

well thanks guys but i had to surrender, formatted and all is well, thanks for your time

Danny

#9 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 34,286 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:10:54 AM

Posted 18 November 2007 - 08:33 PM

Since the member has reformatted and everything is fine, this topic is now closed.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users