Process Monitor Removal

I recently encountered problems with an application that contains Themida when I used Process Explorer. When I encountered this problem I proceeded to delete the program and figured I was hunkey dorey. What I discovered was that Process Monitor by design places hooks in the kernel and that my deleting the file would not clear these entries. In researching further I found GMER and identified the fragments and used "Restore SSDT" to get rid of them. I though have one additional entry that I cannot get rid of. The type is ?, the name is C:\Windows\System32\Drivers\PROCMON20.SYS, and the value is "The system cannot find the file specified !. Does anyone know how I can eliminate this? In GMER I do not have the option to "Restore SSDT".

 

Welcome to MajorGeeks, mcertini

See if Autoruns detects it. Should be highlighted in yellow if "File not Found" as you describe.

 

thisisu,

Thank you for your reply. The last entry disappeared. Apparently I did not reboot my computer.

 

Glad to hear it. Be safe