I have 2 extra files/programs/processes that are titled "ctfmon.exe", in addition to the legitimate one that is located in C:Windows\System32 and that is 15.0 kb. in size. These other 2 "ctfmon.exe" instances are NOT located in the System 32 folder, but are close: the first one is titled: "CTFMIN.EXE-1686EF20.pf" - It is located in C:\WINNT\Prefetch and it is 14.8 kb. in size the second one is titled: "ctfmon.exe" - It is located in C:\WINNT/ServicePackFiles\i386 and it is 15.- kb. in size My main questions are: 1) Is this spyware? 2) Or are these 2 instances of "ctfmon.exe" part of or related to the legitimate program/process? 3) If they are spyware, trojans, trying to pretend to be a legitimate program (which would explain why Spybot, for example, does not identify it as a threat or virus), how can I remove them? How can we know that they are not part of the system, and not a virus? 4) How can I remove them without doing damage to my system/registry, etc.?
hi, to your questions; 1)probably not 2)there are all kinds of much used apps kept in the windows prefetch folder Cab files can be service packs or install cd files found in the i386 dir 3) to satisfy yourself you can go to the website below, browse for the files and upload them to be checked out. http://www.virustotal.com/ ctfmon: http://support.microsoft.com/kb/282599
