Hi, I was checking my system startup with Spybot S&D when I found this:

The problem is that when I went to search for it, I found some infomation pertaining to Microsoft (under properties), making it appear legit.

The problem is: is the ctfmon.exe legit, or rouge?

It seems that there is possibly an error with SpyBot S&D. I'll alert the appropriate people.

There are both legit and malware for ctfmon.exe, however the one which is listed in the right side of your screen shot is for ctfmon32.exe which is most definately a parasite.

You haven't given us enough information to determine if the file is legit or not in your particular case. Here is why:

/s795-ctfmon_exe.html
/s9624-ctfmon_exe.html

Ensure that your Anti-Virus product has the most current dat files and scan your system.

I'm going to download HijackThis and get the log. Where should I post the log?

Latest update: Did Live Update, scanned system using Norton AntiVirus, found no threat. I'm still disabling it though, since the legit version is not essential of system running.

This indeed seems to be a SpyBot error. It appends the wrong information...

Your ctfmon.exe is MS Office related. Here's an article explaining how to disable it:

OFFXP: What Is CTFMON and What Does It Do? (Q282599)

_________________
Tony CLSID List

Thanks for the info, should I recheck the box since it is legit and I have no intention of removing it?

Well, given the fact it's mainly a resource hog, I recommend you uninstall "Alternative User Input" as per the MS article. THat will remove ctfmon.exe from Msconfig as well.

_________________
Tony CLSID List