1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

ctfmon.exe needed?

Discussion in 'Malware and Virus Removal Archive' started by Rackster, 2007/12/18.

  1. 2007/12/18
    Rackster

    Rackster Inactive Thread Starter

    Joined:
    2002/01/11
    Messages:
    138
    Likes Received:
    0
    The last week or so everytime I boot up my hp pc running xp a pop up window from my Ad-Aware program tells me:
    An attempt to alter a protected object has been detected.
    (Attempt to add a registry value.)
    Root:HKEY_CURRENT_USER
    Key:Software\Microsoft\Windows\Current Version\Run
    Value:ctfmon.exe
    Data:
    New Data:C\WINDOWS\system32\ctfmon.exe

    Then it asks me to accept or block.I have blocked everytime but my question is what is ctfmon.exe and why is this popping up now and not before.No new programs have been installed.Will it do any harm to allow it to add the registry value?

    Thanks in advance for any info you can supply me on this.

    Just looked at my event log on Ad-Watch and see that despite my blocking it,this registry value has been added!!!

    I run Ad-Aware,Spyware Doctor and avast! Antivirus on this machine and all scans come out clean.
     
  2. 2007/12/18
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    http://support.microsoft.com/kb/282599
     

  3. to hide this advert.

  4. 2007/12/18
    Rackster

    Rackster Inactive Thread Starter

    Joined:
    2002/01/11
    Messages:
    138
    Likes Received:
    0
    I did see that article when I did a search on ctfmon.exe but I don't run any Microsoft Office programs.Why would this all of a sudden start popping up?

    Is the changed or added value showing the right path?

    I do recall seeing this in the startup menu before,just wondering if the added registry value is legit.
     
    Last edited: 2007/12/18
  5. 2007/12/18
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Yes, that is the legitimate filepath. Won't hurt anything to just allow the change.
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.