Ctfmon.exe if found should be only in Windows/System32, as I am told. But I found a couple other copies in these locations:
Windows\SoftwareDistribution\download\ Think it might be a virus or am I just a little over my head?
Nope. Well, it shouldn't. There are certain trojans that use cftmon.exe to log keystrokes. However, as a normal process it is part of Microsoft Office. It controls the language bar and support for languages with different text input methods, like chinese, japanese, arabic, etc. You can disable the process by going to Control Panel --> Regional and Language Options --> Languages --> Details --> Advanced, and turning off advanced text services. Obviously this isn't ideal if you need to enter text in arabic or some other such language. But otherwise, it should be quite safe, and it would be easier to identify trojans using cftmon as a cover.
Yeah you're probably fine. Some are confused by ctfmon.exe because it likes to pop back as a startup even after unchecking it in msconfig>startup, and in most cases, you don't need it.
I opted to just turn off advanced text services, which pretty much disables it. That way it also makes it a lot easier to tell if you do by chance get a ctfmon that is false and malware.
Here's how to disable it in XP and Vista, it's quite easy really. What is "ctfmon.exe" and how to disable it in Windows XP and Vista - VISTA.BLORGE