I’ve written before about WinPatrol, one of my favorite programs. I run WinPatrol on all my computers — actually, I run the paid version WinPatrol Plus — on all my family’s home Windows computers.
WinPatrol is absolutely free and has a huge amount of features, as can be seen in the first few screenshots below.
WinPatrol Plus has a one-time charge that gets you a few additional features, but its main value is that it gets you access to the WinPatrol Plus programs information database. There are two WinPatrol Plus licenses available: one version for one user’s and all of that user’s computers, and another version for the user’s and all of his/her immediate family’s computers!
First, let’s look at a couple WinPatrol/WinPatrol Plus screens that are the same in both versions — and very useful.
The first is the Startup Programs tab in the WinPatrol. Notice that the default display gives you the program’s title, the command used to start it, the company that suppied it, the type of startup, and when WinPatrol first detected the program.
Also notice that the Type column includes the type "Disabled" — the ability to disable, without removing, the auto-starting of individual programs is one of the features I use most often.
We’ll take a look at the program ctfmon.exe later in this article.
In the next image, we see WinPatrol’s Delayed Start tab.
These are the programs that would have started immediately when I started Windows. However, I used WinPatrol’s Delayed Start function to delay their startup processes for a few minutes to make my Windows boot process faster.
I love this feature. I’m not sure why Bill didn’t add this as one of the reasons to upgrade to WinPatrol Plus, though.
In the Program Delay Startup Options image below, we see the options that we can change for these auto-starting programs.
Not only can we delay the startup for as much as 60 minutes 50 seconds, we can also choose to start the program minimized, maximized, or in a normal window.
Now, let’s take a look at the WinPatrol (the free version) information dialog box on ctfmon.exe, which we saw as one of the diaabled auto-starting programs on the Startup Programs tab.
In the individual program dialog box, which you can see by clicking on the "Info…" button in WinPatrol or WinPatrol Plus, WinPatrol will tell you the information if was able to discover on this computer.
It tells us that the program’s title is CTF Loader, it’s from Microsoft, it’s version 5.1.2600.5512, copyright infomraiton, it’s startup location in the Windows Registry (and that the startup is disabed), the file path, when the file was created, when it was last saved, its size, and when it was first detected by WinPatrol.
There’s a lot more information available if you have purchased WinPatrol Plus and click the "PLUS Info…" link. Or, you can jump straight to the PLUS Info information by double-clicking on the program name in WinPatrol.
The PLUS Info button links to the WinPatrol web site and pulls up detailed information about ctfmon.exe and also ctfmon.dll. The first, ctfmon.exe, activates Microsoft’s Alternative User Input Text Input Processor and the Microsoft Language Bar.
Since I don’t use either of those features (I might, if I used text-to-speech software), I disabled the autostarting of ctfmon.exe.
The information on ctfmon.dll is more interesting — it’s part of a keylogger.