How to remove Procmon64 from system

Question

How to remove Procmon64 from system

Simon Tomsett 0

I've just installed Kudu (system cleaner), which shows Procmon64 as running at start up. I no longer need Procmon 64.

How do I remove it from my system? I've tried every obvious way, but it's still there. Is this a bug in Kudu or is there a secret removal method?

0 comments

2 answers

Your answer

Answer 1

Simon Tomsett 0

I've removed Procmon log and Procmon from the Registry, but but it's still showing in Kudu, with a new entry for audio end point builder! I'll try Microsoft Autoruns as a last resort.

User's image

Simon Tomsett 0 Reputation points

2026-08-17T10:09:49.74+00:00

Autoruns didn't find anything Procmon related.
Simon Tomsett 0 Reputation points

2026-08-17T10:19:35.18+00:00

Good News. After the third reboot, Procmon has gone.

And Audio is still working, so can I just ignore the audio end point entry?
RLWA32 52,816 Reputation points

2026-08-18T07:27:41.08+00:00

@Simon Tomsett The Sysinternals Process Monitor application installs a driver in addition to the main executable. So if you want to completely remove Process Monitor you may also want to delete the installed driver. It is named PROCMON24.SYS and usually has the hidden attribute so it may not appear when you view folder contents. See the example below that shows the installed Process Monitor driver -
Simon Tomsett 0 Reputation points

2026-08-18T13:05:31.4633333+00:00

Already done. Many thanks.

Answer 2

Marcin Policht 106.8K MVP Volunteer Moderator

Check Task Manager → Startup apps and disable anything named Process Monitor, Procmon, or Sysinternals. Also check these locations for a Procmon shortcut:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup

If it isn't there, check Task Scheduler. Run taskschd.msc

Look under Task Scheduler Library and search for anything referencing Procmon64.exe or Process Monitor. Disable/delete that task if you find one.

Also check the Run registry keys. From an elevated Command Prompt:

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"

If one of those contains Procmon64.exe, remove that specific value by using Registry Editor (regedit)

You can also search the file system for Procmon64.exe and then inspect where it is located. In File Explorer, select This PC and search for Procmon64.exe - you can also use an elevated Command Prompt with where /r C:\ Procmon64.exe. Once you find it, right-click the file and check Properties → Digital Signatures or Details to confirm it is the Sysinternals Process Monitor. If you no longer need it, you can terminate Procmon64.exe first and then delete the executable.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Simon Tomsett 0 Reputation points

2026-08-16T11:38:01.0066667+00:00

Many thanks for the suggestions. I've applied all of them without success.

I've also deleted all the files in SysInternals which might relate to ProcMon.

The only error message I've got is:

which makes me think it's a corrupt file, somewhere. (But where?)
Marcin Policht 106.8K Reputation points MVP Volunteer Moderator

2026-08-16T13:35:44.0133333+00:00

The screenshot changes the situation quite a bit. That file is not Procmon64.exe, and it is not a corrupted Procmon file. It is a YARA rule named sig_base_gen_sysinternals_anomaly.yar, located under:

C:\Users\paw... \AppData\Roaming\kudu\yara-rules

The contents confirm that it is a detection rule for Sysinternals tools. In fact, the rule is specifically looking for files that appear to be modified Sysinternals tools. The line description = "SysInternals Tool Anomaly - does not contain Mark Russinovich as author" tells us what it is intended to detect.

So I would not delete or modify that .yar file. It is a rule used by Kudu, rather than Procmon itself. The interesting part is actually the kudu\yara-rules directory. If Kudu is what is producing the error or detecting Procmon, it may be scanning the Sysinternals files and reporting an anomaly.

Since you've already removed the Procmon startup entries and deleted the Sysinternals files, the next thing you might want to try is to search for Procmon64.exe, Procmon.exe, and procmon, rather than searching for Sysinternals. If those return nothing, search for Procmon in the Windows Registry or use Microsoft's Autoruns, which is much better than Task Manager at finding obscure startup mechanisms.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin