AvastUI spawns CTFMON.EXE

Viruses and worms
1

I generally run Process Explorer at every boot, just to see what’s running on my Win 8 Pro x64 system. Yesterday, I noticed for the first time that AvastUI had spawned a version of CTFMON.EXE as a child task. I killed the CTFMON task, scheduled a boot time scan with Avast and rebooted. No malware was found, but after that reboot, AvastUI has not spawned CTFMON.EXE again. I understand that CTFMON is a legitimate language services component of MS Office, but I don’t have any settings in MS Office 2013 that would cause it to load. I did not check the registry settings, but I will do so as soon as possible, since most security websites suggest looking at all the registry “run” and settings and MSConfig. I am using the free version of Avast and it is up to date.

Has anyone seen this behavior before?

2

Now I may be wrong, but isn’t ctfmon the thing responsible for switching input languages, showing the language indicator next to system tray etc.?
So couldn’t it be started simply by switching the keyboard while in the program maybe?

3

I’m beginning to think that you are correct and CTFMON.EXE is a normal task called by Avast that must handle additional languages. Why it just started showing up, I have no idea.