Multiple explorer.exe in task manager hogging most of ram help please?

lehnerus2000 said:

That thing (ctfmon.exe) is a nuisance.
It is like malware.

It will use any random event as an opportunity to run.
On my PC, if I disable Avast (temporarily) ctfmon.exe starts!

It is supposed to provide "language support".
Are you using multiple languages on your PC?

No, just default english

wordstl said:

UsernameIssues said:

1) If you are using Paint to save your screenshots, grab the lower right corner of the whiteboard area and drag it to the upper left corner. Leave a square that is less than an inch in size. Close Paint while the whiteboard is that size. Then you screenshots should not have all of that white area around them.

Screenshots and Files - Upload and Post in Seven Forums

2) Are any of the Explorer instances communicating with the internet?
Resource Monitor > Network tab > Network Activity area.

Here is the network page

It is easier to look at the Network Activity area, but your screenshot of the TCP Connections area shows Explorer making a lot of connects to the internet. That volume of internet traffic by Explorer, coupled with the large amount of RAM (1.8GB) taken up by that one Explorer instance, looks like an infection - perhaps, one in the Alureon family.

You can block Explorer from making internet connections with a firewall rule in you want and/or await input from Jacee.

whs said:

wordstl said:

whs said:

You don't really need the ctfmon. If you want to kill it, run these 2 commands in a Run box

Regsvr32.exe /u msimtf.dll

Regsvr32.exe /u msctf.dll

when I attempt this I get this message

The module "msimtf.dll" was loaded but
the call to DllUnregisterServer failed with the error code
0x80004005

Looks like you have more problems in your system. Maybe a startup/repair is in order before we get back to the ctfmon

Startup Repair

ran startup repair, it finished and there's no change

Layback Bear said:

What operating system are you using?
Do you have a Office or Word program that you use?
Something is telling ctfmom to activate. (startup).

ctfmon.exe - ctfmon.exe - Program Information

It may or may not be a infection.

Is ctfmon.exe safe? How to remove a ctfmon error?

I am using Windows 7 home premium 64 bit and do have microsoft office installed.

UsernameIssues said:

wordstl said:

UsernameIssues said:

1) If you are using Paint to save your screenshots, grab the lower right corner of the whiteboard area and drag it to the upper left corner. Leave a square that is less than an inch in size. Close Paint while the whiteboard is that size. Then you screenshots should not have all of that white area around them.

Screenshots and Files - Upload and Post in Seven Forums

2) Are any of the Explorer instances communicating with the internet?
Resource Monitor > Network tab > Network Activity area.

Here is the network page

It is easier to look at the Network Activity area, but your screenshot of the TCP Connections area shows Explorer making a lot of connects to the internet. That volume of internet traffic by Explorer, coupled with the large amount of RAM (1.8GB) taken up by that one Explorer instance, looks like an infection - perhaps, one in the Alureon family.

You can block Explorer from making internet connections with a firewall rule in you want and/or await input from Jacee.

I will try to block it with the firewall but here is the network activity area

Layback Bear said:

Have you checked for infection? If so what security scans have you used?
I believe that a infection is using ctfmom and it's loader to try and call home.

Did you read the sites I post in #22
What Microsoft Office are you using and where did you get it from?

I scanned with malwarebytes and avg free with full scans since my first thought was that is was a virus but nothing came up so I was confused. It is microsoft office 2007 and I got this computer from a friend a while ago so I have no idea where he got it from.