If you open the Windows Task Manager or use Hijackthis to track down a problem, you may see a file called CTFMON.EXE. Disabling it from MSCONFIG does not make it go away and it makes it easy for people to feel that it is a virus, so what exactly is it?
Actually CTFMON.EXE is a file that is installed with Office XP. It activates the Alternative User Input and Language Bar. This program monitors active windows and provides text input services that support voice, handwriting, keyboard, translation, and other input techniques. It also boots the language bar, which appears under the system tray as shown below.
A Hijackthis log file will show CTFMON as shown below:
O4 – HKCU..Run: [ctfmon.exe] C:Windowssystem32ctfmon.exe
The steps below will disable the Advanced Text service to remove the Language Bar:
1. Open Control Panel
2. Select Regional and Language Options (in Classic View)
Or choose Date, Time, Language, and Regional Options in the Category view.
3. Select the Languages tab, click the Details button
4. Select the Advanced tab
5. Click on the “Turn off advanced text services” box and select OK
The language bar will no longer be visible in the System Tray, and CTFMON.EXE will not be loaded during subsequent boot times.