You can right-click on the ctfmon.exe or CTF Loader process in the Task Manager and then choose Open file location. If the location is the System32 folder, the file is the genuine one. If not, then you should perform a virus scan as soon as possible.