Results 1 to 4 of 4

Thread: WINDOWS LIVE MESSENGER, WINDOWS MEDIA PLAYER 11, IE7 and CTFMON (SUSPICIOUS BEHAVIOR)

Hybrid View

  1. #1
    cinolandia Guest

    Default WINDOWS LIVE MESSENGER, WINDOWS MEDIA PLAYER 11, IE7 and CTFMON (SUSPICIOUS BEHAVIOR)

    I just updated ZoneAlarm this morning to version 6.5.737.000. Now, I'm getting an alert that MESSENGER (Windows Live Messenger), WINDOWS MEDIA PLAYER (vers. 11), INTERNET EXPLORER (IE7)and CTFMON is attempting to monitor user activities on this computer. If allowed it may try to track or log keystrokes (user input). Mouse movements/clcks web sites visited and other user behaviors
    I've denied all.

    Ex.(http://osalerts.zonelabs.com/osanaly...info&CL=en).
    Ex.(http://osalerts.zonelabs.com/osanaly...info&CL=en)

    Question is: Why Messenger or Windows Media player want open CTFMON process?

    PS. I am running Office 2003 and it is patched, Win XP SP2 with all current patches applied. Spybot S&D, Windows Defender, Ad-Aware SE and Keylogger Killer can't find anything wrong with the system. I think that the "probable" cause is in the WINDOWS Registry because i've monitored the modules of MESSENGER, WINDOWS MEDIA PLAYER and CTFMON and the modules of "mother process" EXPLORER.EXE and i think that's OK. Thanks in advance.

    Message Edited by Cinolandia on 11-29-200606:16 AM

  2. #2
    wyzzardusa Guest

    Default Re: WINDOWS LIVE MESSENGER, WINDOWS MEDIA PLAYER 11, IE7 and CTFMON (SUSPICIOUS BEHAVIOR)

    Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.
    It's common for MSN/Windows Messenger and Windows Media Player to activate this process. Also, ctfmon.exe is used by Office, and will run in the bacjground even when Office apps are closed.
    Nothing to worry about, from what I can see, as long as ctfmon is located in %systemroot%\Windows\System 32. If found in a different location, it could be malware, run a scan.

  3. #3
    cinolandia Guest

    Default Re: WINDOWS LIVE MESSENGER, WINDOWS MEDIA PLAYER 11, IE7 and CTFMON (SUSPICIOUS BEHAVIOR)

    Very thanks for your help...

    I have just a doubt that crossed my mind...Why this message of ZONE ALARM (...is attempting to monitor user activities on this computer. If allowed it may try to track or log keystrokes. Mouse movements/clcks web sites visited and other user behaviors) is not common ?

  4. #4
    Join Date
    Jun 2004
    Posts
    320

    Default Re: WINDOWS LIVE MESSENGER, WINDOWS MEDIA PLAYER 11, IE7 and CTFMON (SUSPICIOUS BEHAVIOR)

    Zone Alarm cannot distinguish between harmless apps (such as you mention) that need to monitor your key strokes to function and malicious keystroke loggers that might have infected your PC. So it gives the same alarm for all apps monitoring keystroke activities. Perhaps the alarm is couched in rather frightening terms, but it is a useful one nevertheless, in case the app that causes it is malicious you would want to know you've been infected. It is up to the user to be able to distinguish between keystroke monitoring apps that they know are trustworthy and ones that are not.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •