PC Pitstop is the undisputed leader in PC diagnostics. Our running process library is culled from our database of over 100 million PC diagnostics and scans.

Tip from the PitCrew

Every process running on your computer takes up CPU cycles and valuable memory. For optimal PC performance and resource utilization, you should be aware of every process on your computer. PC Pitstop designed this process library to help you know which processes are worthwhile and others that slow system performance.

Furthermore, perhaps the quickest and most straight forward method to detect malware is through a running process analysis.

Process Library

  

More than one possible match was found; all matches are listed below in order of their prevalence. This only tells you what the file and the correct action might be.

To understand which possibility is actually running on your own system, perform an Overdrive test and then look at the Software|Processes tab.


Match #1

ctfmon.exe (Speech)

Percentage of recently scanned PC's with this process running: 34.57%
Average CPU use for this program: 0%
Average RAM for this program: 2 MB


PC Pitstop Analysis

ctfmon.exe supports speech input in Windows/Office.
In Office this process has been known to consume significant resources, especially processor time, if it is not configured correctly or is turned on by accident.
If you are not using this, is safe to disable it.


Recommendation

Win Patrol

ctfmon.exe is a user invoked program and a normal part of PC operations. No action required.

PC Pitstop recommends WinPatrol Plus for monitoring all of the background activity on your PC. WinPatrol Plus provides a easy to understand descriptions of over 15,000 processes and programs.



Identification

In addition to the file name, ctfmon.exe, the following version information is used to identify the file. If the file does not match this information, it may be a different file. To ensure the file is absolutely correct, run a free and comprehensive scan.

Vendor contains:Microsoft
Product contains:Windows

To view version information with Windows Explorer, right-click the file and click Properties, Version.


MD5 Hashes

MD5 hashes is the way that computers can define the uniqueness of a file. Anti malware vendors frequently use this technique to detect and clean malware. It is common for a program to have multiple MD5 hashes as the developers create newer versions of the program. For the program called ctfmon.exe, we have detected more than 20 different MD5 hashes. Click on a hash to research the hash in Google.
MD5 Report Summary
Program NameMD5 Count
ctfmon.exe> 20
#MD5Size
10x7d518719f842d719a245dd13d92a9a8f13312 bytes
20xa120326ef2fa58111e25a3c4d9b302bd20992 bytes
30xa9b2e0da627ec2124e1b54f78fcd87f720480 bytes
40x4168617b0c25faeb05f1435eaf8f046a30208 bytes
50x4d38dd99fd6cf8e1d696e02e18e7469b356352 bytes
60x4127c782c2749d41e12ac02fe47ae948356352 bytes
70x6c4b9b79650d57008e04cfe167219b4720480 bytes
80xfb998be9a46c81797cf66878e9c283dd14336 bytes
90xd99b412832932069f074277062c7b6ab15360 bytes
100xd61126cacc45620e144e08a55421569d95744 bytes
110xbc1140ba0c0eac6d3e1505e9b5d48b6613312 bytes
120x21a39ea1d956a04b1faeff85abc0f84225088 bytes
130x495c15483ba05672a8d4b190a00f718d40448 bytes
140x8a8d59918cbfa19e5856e0f0ee4fa42d40960 bytes
150xab268fb9ab5054732c8b6fe599eda8ae15360 bytes
160x669f80a199c2ea470f9321453542416315360 bytes
170xcbfa30492d70ce3938d8a7783d0c043615360 bytes
180x6c76c526236fda39c4f43490508ab559192988 bytes
190x24afd422c737d934051a567c3a58f28313312 bytes
200xe79e6375fb43a77f31ab3c04dba16a4b359424 bytes

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. ctfmon.exe (Speech) has been seen on 34.57% of systems tested at PC Pitstop. As a point of comparison, it is rare for a particular malicious program (virus or spyware) to be seen on more than one or two percent of all systems tested. The average RAM memory usage for this process was 2 MB. The average CPU load for this program was 0%.


Detailed Description and/or Removal Instructions

http://support.microsoft.com/kb/282599


Match #2

ctfmon.exe (** Read !!! ** Keylog-Family)

Percentage of recently scanned PC's with this process running: 0.00%
Average CPU use for this program: 0%
Average RAM for this program: 3 MB


PC Pitstop Analysis

ctfmon.exe file name has been used by some malware.
You can get more information from Mcafee

http://vil.nai.com/vil/content/v_131046.htm

According to CA

"Key Logger: (Keystroke Logger). A program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or be used in a social engineering attack. For example, a key logger will reveal the contents of all e-mail composed by the user. Keylog programs are commonly included in rootkits and RATs (remote administration trojans)."


Recommendation

Win Patrol

ctfmon.exe uses excessive system and memory resources with no corresponding benefit. Applications such as these should be disabled to improve overall system performance.

PC Pitstop recommends WinPatrol Plus for monitoring all of the background activity on your PC. WinPatrol Plus provides a easy to understand descriptions of over 15,000 processes and programs.



Identification

In addition to the file name, ctfmon.exe, the following version information is used to identify the file. If the file does not match this information, it may be a different file. To ensure the file is absolutely correct, run a free and comprehensive scan.

File name contains:\system32\ctf

To view version information with Windows Explorer, right-click the file and click Properties, Version.


MD5 Hashes

MD5 hashes is the way that computers can define the uniqueness of a file. Anti malware vendors frequently use this technique to detect and clean malware. It is common for a program to have multiple MD5 hashes as the developers create newer versions of the program. For the program called ctfmon.exe, we have detected 11 different MD5 hashes. Click on a hash to research the hash in Google.
MD5 Report Summary
Program NameMD5 Count
ctfmon.exe11
#MD5Size
10xd3aa69fe0e7fd72099d10506e926817d291908 bytes
20x55542636067648989a2ea344f9984e3d76800 bytes
30x5efeee9b4f1cbf0e8dfd45b5e14344bb69120 bytes
40x07690ab3349fbd983bb5b801a7f6ebd814348 bytes
50x5f500ec0d022c211a42597fb44fc8a1380384 bytes
60x183efd535acba851dac1948f6f81bb7615360 bytes
70xfef735ae6aea49d78db88e19303d6e7f1376256 bytes
80x7e9778e1038e31086300b8fca3ea6d9115360 bytes
90x25d4f293e6d56a25cca817b97871823e15360 bytes
100x0334b4eb4fbfb33c0f821d94bd30c7fa30720 bytes
110x6a8795c1c6df10119b157ccbc2e15d0d69840 bytes

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. ctfmon.exe (** Read !!! ** Keylog-Family) has been seen on 0.00% of systems tested at PC Pitstop. As a point of comparison, it is rare for a particular malicious program (virus or spyware) to be seen on more than one or two percent of all systems tested. The average RAM memory usage for this process was 3 MB. The average CPU load for this program was 0%.


Vendor or Distributor's Web Site

http://www.kmint21.com/

Detailed Description and/or Removal Instructions

http://ca.com/us/securityadvisor/pest/pest.aspx?id=453090753


Match #3

ctfmon.exe (ctfmon.exe - threat)

This program has not been seen on any systems tested at PC Pitstop in the past week.


PC Pitstop Analysis

ctfmon.exe is the name of a regular process from Windows. It has Vendor and Product information.
However this is not the case. We have detected that this process has no Vendor or Product information. Check the Information URL and see the list of threat that uses this same name.


Recommendation

CA AntiVirus

ctfmon.exe is a VIRUS. Stop all work until the virus is removed or you run the risk of spreading the virus to other people. Worse yet, the virus may be doing harm to your computer and your information.

ctfmon.exe is a virus and should be removed immediately to avoid doing further harm. PC Pitstop recommends CA Antivirus in these types of situations.



Identification

The file name alone identifies this program.


MD5 Hashes

MD5 hashes is the way that computers can define the uniqueness of a file. Anti malware vendors frequently use this technique to detect and clean malware. It is common for a program to have multiple MD5 hashes as the developers create newer versions of the program. For the program called ctfmon.exe, we have detected more than 20 different MD5 hashes. Click on a hash to research the hash in Google.
MD5 Report Summary
Program NameMD5 Count
ctfmon.exe> 20
#MD5Size
10xf730069b43394772aa3b3a0ebfb818e920524 bytes
20x5d7496c8993f8600c0d2e6328b22c1ee77824 bytes
30xe95bf9e21260cc389505376b8bfb056720480 bytes
40xf63d205141e4a71b4fc26340b6e8114873728 bytes
50xba7c580a41ddd2561048226bc4fbbc6520480 bytes
60xe29a3fcebe404d7869b7724fdc08dc8c24398 bytes
70x886c83dcab48395d55e835be56f5a3cb376320 bytes
80x66cff2f9976f90ff04073c780c4d1826107008 bytes
90xda01ef32fbc9e8c5985aed8e01fff2ab154624 bytes
100xa695bced2951365f2b4eeb1b67eccbbf34213 bytes
110x62808316ca925f8ac9ce08e39214285f30037 bytes
120xa4e0df8e8d36fe9be01a74be807c681f29906 bytes
130xd0f65f3358d8b51cdd5fd19824f9c6c655296 bytes
140x50f135d0f8612f4ed3afe776fc32fae625189 bytes
150x1daffee68595d46e862dffc5da008d00280576 bytes
160xce6ecacd9a95c53399d7d481ef8617cc463872 bytes
170x85e3a2912eb7f72d5b3f0c2a31c6324e280576 bytes
180xc72a75bd71f02a6dfa8dfc3d9dafeadc280064 bytes
190x8a1bc3d8405b429896012de36a70fe5734304 bytes
200xc94a85fedbba5bec9723a9925e48bbf2279552 bytes

PC Pitstop Database Comparisons

Every week, we update our information about the running programs identified during the previous week's testing. This program has not been seen on any systems tested at PC Pitstop in the past week.


Detailed Description and/or Removal Instructions

http://search.ca.com/search/ca?style=en&qt=ctfmon.exe&col=

Important note: A file name alone may not be enough for positive identification. PC Pitstop's Overdrive tests and spyware scan use information such as the company name, product name, or install directory. If you are unable to identify a file, ask about it in our forums after running our full tests.