1

Recently, whenever I try to start KakaoTalk on Windows 10, I get this message and the program exits:

monitor program has been found running in your system

Themida: A monitor program has been found running in your system. Please, unload it from memory and restart your program.

Themida says their product: Themida ® Advanced Windows software protection system, developed for software developers who wish to protect their applications against advanced reverse engineering and software cracking.

So, it sounds like it is something within KakaoTalk that is detecting something on my system. It has not been saying this, but only started saying this after a recent KakaoTalk software update.

What needs to be done so this messages goes away and I can use the KakaoTalk app on Windows 10? Is there a way to troubleshoot what process is conflicting with KakaoTalk?

7
  • 1
    You have Themida installed. Configure it correctly or uninstall it. If this is a corporate computer speak to your IT department.
    – DavidPostill
    Feb 7, 2021 at 18:12
  • I don't know what Themida is? This is my personal computer. Themida says "Themida ® Advanced Windows software protection system, developed for software developers who wish to protect their applications against advanced reverse engineering and software cracking." So, I think it is embedded within the chat software that is detecting something on my system it doesn't like...
    – Sun
    Feb 7, 2021 at 19:03
  • @Ramhound Thermida is not on a list of programs you can uninstall. Like I said, I think it is embedded/compiled into the KakaoTalk software.
    – Sun
    Feb 8, 2021 at 2:18
  • Do you KNOW that KaKao Talk is the software with Themida included in it? I would guess that you can check the name of the executable presenting that error and then search to locate that executable on your filesystem. If it's easy it'll be in the same folder as your KaKaoTalk, or you'll need to check file dates/times to see when it was likely installed. Feb 8, 2021 at 4:40
  • I don't know the internal of KakaoTalk but there's been controversy over their privacy policy so I think this is an adjunct way to scan for "monitoring" software via AI and not launch KakaoTalk if it thinks the host system is compromised in some way. The last desktop software I installed was Spotify Desktop. I can't say for certain, but after I uninstalled and restarted Windows, I don't get the warning message any more.
    – Sun
    Feb 8, 2021 at 23:17

2 Answers 2

0

If you see this message from KakaoTalk, review the latest programs that was recently installed by Windows. Systematically, uninstall the most recently installed software (sort by Install Date). Restart Windows, then see if KakaoTalk lets you go further.

In my case, it was Spotify Desktop software that was uninstalled and the message went away. I don't consider Spotify malicious software, but perhaps there was some false positive with ad system or something in their code that triggered a false positive.

0

Themida is a source code protector that gets baked into many retail programs these days. Because it's purpose is to protect, it doesn't like tools being run that could potentially reverse-engineer its protection.

The most common "debugging" tools it complains about are Sysinternals/Microsoft's "Process Monitor" and "Process Explorer", both of which Themida considers debugging tools. Themida also considers reverse-engineering tools (obviously) in this category, as well, such as IDA Pro, x64dbg, Ghidra, Binary Ninja, Ollydbg, Windbg, and even some EXE analyzers.

Do you use "Process Monitor/Explorer/Hacker"? If so, Process Monitor, when run, loads a filter driver in the background called "PROCMON24.SYS". Unfortunately, this filter driver doesn't have an unload function for some crazy reason, so once Process Monitor is run, this filter driver gets loaded and remains resident even after exiting Process Monitor. Only a full system reboot unloads it.

So try running this software immediately upon a fresh reboot, or even booting into safemode as a test and seeing if it opens there, where the majority of software and drivers won't get loaded.

You can get to safemode by Start menu -> Run (or Win-R shortcut) -> "msconfig" [Enter] -> "Boot" tab -> Check the box for "Safe boot" -> "OK", reboot.

Remember that you'll have to re-open msconfig to uncheck this safe-boot mode to get back to your normal startup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .