Organized Crazy Addicts

roba · Posted: Sat Mar 27, 2004 2:48 am Post subject: ctfmon.exe problem

I have strange problem with ctfmon.exe process. I always had it running, and it was never doing anything strange, but today since morning, ZoneAlarm log is full of hundrets of attemts to connect to the Internet thru other apps (OpenProcess), its 10s of attempts using all runnings apps per minute... it always says something like:

CTF Loader not allowed to call OpenProcess on HomeSite.

Windows Explorer not allowed to call OpenProcess on Total Commander 32 bit international version, file manager rep.

Total Commander 32 bit international version, file manager rep not allowed to call OpenProcess on CTF Loader.

Internet Explorer not allowed to call OpenProcess on CTF Loader.

CTF Loader not allowed to call OpenProcess on Internet Explorer.

CTF Loader not allowed to call OpenProcess on Mozilla.

etc etc, I have hundrets of them in logs!!! Shocked

Anyone has idea whats going on? I already did virus and spyware checks- nothing, checked registry, running process, services - nothing special. ctfmon.exe files seems to be original too (has same date/time as other win sys files, dunno about lenght tho...)

Its very strange, coz I have no idea why ctfmon.exe should want to connect to the internet....

LeeBe · Posted: Sat Mar 27, 2004 8:20 pm Post subject:

never did trust that app... vbbs

not-zed · Guest

CTFMON.EXE is the ‘Alternative User Input Service’, and is actually an auxiliary system process. Basically, what it does is, it sorts out all the text input support for handwriting and speech recognition, multi-language keyboards, translation, and other alternative user input sources. If you’re running any non-English language support on your machine, then this file will automatically activate itself,

who knows why it's trying to access the net though. That is strange

you can remove it:
http://support.microsoft.com/?kbid=282599

roba · Posted: Sun Mar 28, 2004 7:35 pm Post subject:

thx for info... dunno I always had this process running and it never did anything strange... I think ZoneAlarm somehow messed its own settings and started to report things which it ignored before... anyway I killed ctfmon so no more 100 miles long logs Smile

roba · Posted: Fri Apr 02, 2004 9:09 pm Post subject:

Lol i am starting to be scared, now I have new strange log items, process called Windows NT Logon (winlogon.exe) is trying to access Internet, always same IP range, and this IP range belongs to MediaDefender (anti P2P piracy company), strange huh?

roba · Posted: Sat Apr 03, 2004 1:48 pm Post subject:

It was becouse of eMule, when I turned it off, winlogon was nice again. Looks like they wanted to put me in jail for sharing illegal songs hehe.... bad bad bad mediadefender

not-zed · Guest

omg bad proggies

LeeBe · Posted: Sat Apr 03, 2004 4:32 pm Post subject:

hmm thats weird Confused

emule shouldnt be trying to connect to MediaDefender Confused

roba · Posted: Sat Apr 03, 2004 4:44 pm Post subject:

Yeah I thought that maybe their robot tried to get some of my files, or join my queue, coz at the same time when these messagesd were appeatring in logs, my uploads were almost empty (its always at max, 5 ppl dling from me), full queue but not one was downloading, so probably eMule was tring to connect MediaDefender robot and my firewall kept blocking it? Dunno...