# ctfmon.exe

Windows Process: Microsoft Corporation

Also called ctfmon, ctf loader, alternative input text input

Windows, System Component

CTF Loader. It starts the Text Services Framework that language bars, handwriting, and some alternative input use.

## What you need to know

This is the language-bar loader. The same filename is a favorite malware costume.

ctfmon.exe is CTF Loader for the Text Services Framework. It belongs in System32. A ctfmon.exe in AppData is the classic fake. It is not TextInputHost.

- **Safe?**: Yes, in System32

  **Do I need it?**: Yes if you use an IME or the language bar

  **Malware name?**: The filename is also abused

Feex says

I never trust ctfmon by the name alone. I open the path. System32 plus a Microsoft signature is the language bar. AppData is a different story.

## What is ctfmon.exe?

ctfmon.exe is CTF Loader. It initializes the Text Services Framework so IMEs, handwriting, and the language bar can attach to apps.

## What does it do?

It stays resident so the language bar can switch keyboards. It does not host the Windows 11 emoji panel. That is TextInputHost.exe.

## Why is it running?

You have more than one input language, an IME, or an accessibility input service. A US-only PC can still start it because Windows leaves TSF available.

## Is it safe?

Check the path

System32 and a Microsoft signature are the real loader. The filename is widely reused. Path first, then publisher. The name is not a verdict.

A legitimate copy normally runs from:

`C:\Windows\System32\ctfmon.exe`

- Expected publisher: Microsoft Corporation
- AppData copies are a common fake
- Related to language bar, not emoji GIFs

## Can I end it?

The language bar may vanish

Ending the System32 copy hides the language bar until it starts again. Ending an AppData copy is a malware step after you confirm the path.

## Can I remove it?

Only a fake copy

Do not delete System32\ctfmon.exe. Remove extra keyboards in Settings if you want a quieter bar. Quarantine only a copy that failed the path check.

## Should it start with Windows?

Windows can start CTF Loader with the user session. That is expected for TSF. It is not Steam.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Low. A broken IME can spin it

  **Memory**: Small

  **Disk**: Low

  **Network**: None for the Microsoft file

## File information

| Executable name        | ctfmon.exe                     |
| ---------------------- | ------------------------------ |
| Common legitimate path | C:\Windows\System32\ctfmon.exe |
| Publisher              | Microsoft Corporation          |
| Signature expectation  | Signed by Microsoft Windows    |

## Common problems

### Two ctfmon.exe rows

One in System32 and one elsewhere is a path investigation, not a "Windows needs two" story.

### Language bar will not hide

Remove extra languages in Settings. Deleting ctfmon is the wrong hide button.

## Troubleshooting

Diagnose before you change anything destructive.

### Always open the folder

Task Manager > Open file location. System32 is the expected answer.

### Repair TSF after a bad IME uninstall

A leftover IME can keep CTF busy. Remove the IME package, then reboot.

## Technical details

Technical details

| Image name | ctfmon.exe                           |
| ---------- | ------------------------------------ |
| Role       | CTF Loader / Text Services Framework |

## Related

These entities connect to this article. Type is shown on every link.

[TextInputHost.exe: Windows Process](https://feex.it/wiki/process/textinputhost.exe)[What is a Windows process: Guide](https://feex.it/wiki/software/system/what-is-a-windows-process)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Text Services Framework ](https://learn.microsoft.com/windows/win32/tsf/text-services-framework)· CTF and TSF
- [Microsoft Support: Windows ](https://support.microsoft.com/windows)· Public support naming
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: ctfmon.exe

  **Typical path**: C:\Windows\System32\ctfmon.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/ctfmon.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)