16

I am trying to load Process Monitor (Procmon.exe) from Sysinternals, and I get the following error on startup.

Unable to load Process Monitor device driver

In the Event Viewer, I get the following.

Driver PROCMON11.SYS has been blocked from loading.

What is blocking it from loading?

Background information: I have no anti-virus or malware checker software installed, other than Windows Defender (which I think is part of Windows 7).

Peter Mortensen
  • 12,190
AngryHacker
  • 18,647

9 Answers9

13

It seems that most people on the web who had this problem, solved it by installing a newer version of procmon, or an older version if their's was the latest.

Hello71
  • 8,517
  • 5
  • 40
  • 45
Moshe Flam
  • 146
  • 2
    Actually, even installing an older version ( see e.g. archive.org for that ), starting it and then replacing it again with a recent version seems to do the trick.

    Hence, I suspect that procmon.exe silently attempts to install PROCMON11.SYS at the first run, and apparently assumes that it went successfully.

    I suppose one could have used procmon to verify that .. oh, wait

     – ジョージ Nov 30 '20 at 05:57
4

If you ran it successfully before and are having issues now, then most common issue is the procmonXX.sys driver inside of C:\Windows\System32\drivers is locked up by another process, specifically a zombie process of Process Monitor. It probably failed to cleanly exit last time and just got stuck. The solution is to open task manager and kill Process Monitor to solve the issue.

If you want to find out if this is the case, delete that driver file (Process Monitor automatically re-installs it when it runs). If it denies access because it's open in another process, that's definitely the issue. If it deletes it successfully, then it may have been corrupt and the next time you run Process Monitor it'll work by re-installing it.

The reason other solutions here work is because sometimes the filename of the driver will increment (it's at PROCMON24.SYS right now). When you install an older or newer version, it might not used the locked up driver file and install its own instead (depending on the driver version). Restarting your computer also works because all running processes are shut down.

Pluto
  • 161
3

For me, the solution in this article solved my problem.

In one word, we need to install KB3033929.

Jiaming
  • 31
3

Here's a link for the older version:

https://web.archive.org/web/20190220013755/https://download.sysinternals.com/files/ProcessMonitor.zip
slumpyrat
  • 41
3

An action that worked for me was to restart the computer (powering it off in the process, if it matters).

Platform:

  • Windows XP SP2 Professional 64-bit.
  • Process Monitor v3.03 (released 2012-07-16).
  • I had previously used Process Monitor v2.03 (likely release date 2008-12-10).
Peter Mortensen
  • 12,190
1

Evidently, Procmon requires the Workstation service running in order to start. It uses that service to enumerate something and will silently die without it.

This is not documented anywhere and is pretty bogus.

Similar question on Server Fault: https://serverfault.com/a/755869/175310

Community
  • 1
Rasz_pl
  • 11
1

Another potential cause for this error: running procmon.exe rather than procmon64a.exe on ARM64 Windows.

mklement0
  • 2,025
1

I was not aware that Procmon.exe even needed a "PROCMON11.SYS". I've been running Process Monitor as a standalone executable just fine. I searched my C drive for a procmon11.sys and it does not exist. Maybe it is packaged with the executable?

Viruses often try to prevent software from running that might alert someone to its presence. It sounds like a virus might be aware that you are trying to start Process Monitor and giving you this obscure error message to throw you off track.

Try installing the free version of AVG... or try installing Spybot Search and Destroy. If I'm right... the installation or update of those programs will probably fail.

Check out this answer.

Community
  • 1
James T
  • 10,091
  • 4
  • 28
  • 31
  • 6
    When I run Procmon.exe on a 64-bit system, it spawns a process Procmon64.exe and loads Procmon20.sys neither of which exist as files on the hard disk. I assume this are contained inside the procmon.exe executable and extracted and and run/loade on demand. I am guessing the 32-bit version will use procmon11.sys instead of procmon20.sys – sgmoore Nov 17 '10 at 10:35
  • 2
    Yes, ProcessMonitor extracts its driver at runtime. In fact, RootkitRevealer not only extracted its driver at runtime, but gave it a random filename to avoid detection by rootkits. – Synetech Mar 31 '11 at 01:06
0

Try running ProcMon as administrator (right-click ProcMon.exe and select "run as administrator").

By default, it'll pop the "Run as Administrator" dialog (probably triggered by trying to access a kernel-mode driver), but if you turned off UAC, you may not get that dialog, and th app would just fail in accessing the driver.

Traveling Tech Guy
  • 9,998