up vote 4 down vote favorite
share [g+] share [fb]

I am trying to load ProcMon (from Sysinternals) and I get the following error on startup:

`Unable to load Process Monitor device driver`

In the Event Viewer, I get the following:

`Driver PROCMON11.SYS has been blocked from loading.`

Question: what is blocking it from loading?

Background info: I have no anti-virus or malware checker software installed, other than Windows Defender (which I think is part of Win7).

link|improve this question
85% accept rate
feedback

3 Answers

up vote 6 down vote accepted

It seems that most people on the web who had this problem, solved it by installing a newer version of procmon, or an older version if their's was the latest.

link|improve this answer
feedback
up vote 0 down vote

I was not aware that Procmon.exe even needed a "PROCMON11.SYS". I've been running Process Monitor as a standalone executable just fine. I searched my C drive for a procmon11.sys and it does not exist. Maybe it is packaged with the executable?

Viruses often try to prevent software from running that might alert someone to its presence. It sounds like a virus might be aware that you are trying to start Process Monitor and giving you this obscure error message to throw you off track.

Try installing the free version of AVG... or try installing Spybot Search and Destroy. If I'm right... the installation or update of those programs will probably fail.

Check out this answer.

link|improve this answer
5  
When I run Procmon.exe on a 64-bit system, it spawns a process Procmon64.exe and loads Procmon20.sys neither of which exist as files on the hard disk. I assume this are contained inside the procmon.exe executable and extracted and and run/loade on demand. I am guessing the 32-bit version will use procmon11.sys instead of procmon20.sys – sgmoore Nov 17 '10 at 10:35
1  
Yes, ProcessMonitor extracts its driver at runtime. In fact, RootkitRevealer not only extracted its driver at runtime, but gave it a random filename to avoid detection by rootkits. – Synetech Mar 31 '11 at 1:06
feedback
up vote 0 down vote

Try running ProcMon as administrator (right-click ProcMon.exe and select "run as administrator").

By default, it'll pop the "Run as Administrator" dialog (probably triggered by trying to access a kernel-mode driver), but if you turned off UAC, you may not get that dialog, and th app would just fail in accessing the driver.

link|improve this answer
I did. But nothing changed. – AngryHacker Nov 19 '10 at 0:36
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.