What is SNDMon.exe?

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the SNDMon.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for SNDMon.exe related errors

SNDMon.exe file information

The process known as Symantec Security Drivers Install Monitor belongs to software Symantec Security Drivers or Microsoft PowerPoint Viewer (version 97) by Symantec (

Description: SNDMon.exe is not essential for the Windows OS and causes relatively few problems. SNDMon.exe is located in a subfolder of "C:\Program Files"—e.g. C:\Program Files\Symantec\LiveUpdate\. Known file sizes on Windows 10/8/7/XP are 100,056 bytes (88% of all occurrences) or 100,048 bytes. 
The program has a visible window. The SNDMon.exe file is not a Windows system file. The software starts upon Windows startup (see Registry key: MACHINE\Run). The SNDMon.exe file is a Verisign signed file. It is digitally signed. SNDMon.exe is able to monitor applications. Therefore the technical security rating is 1% dangerous, however you should also read the user reviews.

Uninstalling this variant: If you want to remove the program completely, go to Control Panel ⇒ Software ⇒ Microsoft PowerPoint Viewer 97.

Recommended: Identify SNDMon.exe related errors

External information from Paul Collins:

Important: Some malware camouflages itself as SNDMon.exe, particularly when located in the C:\Windows or C:\Windows\System32 folder. Therefore, you should check the SNDMon.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

part of NAV or NPF 2004
  nagel   (further information)
Norton Internet Security ?
Its a Symantec Driver that runs in the background
Norton AV 2005 (aucun problème) Symantec
it is part of norton antivirus. symantec netdriver monitor
Part of Symantec Norton Internet Security suite
  Georg   (further information)
Part of Norton Antivirus - Detects when you are online so updates can be downloaded. Not a VITAL process
  Nico Martimucci - tech   (further information)
this is part of symantec liveupdate needed for auto and manual updates
Certainly is part of NAV2005, but why is it not removed when NAV2005 is uninstalled? Bug or an explicit choice from Symantec?
System hungry, function unknown
that it has caused my computer to be unusable! Problems have been escalating since the day my subscription to Norton anti-virus ran out and I did not pay to renew / update it, culminating this morning in my computer displaying the 'blue screen of death' immediately after loading Windows 98 and I got the message 'This application has requested the Runtime to terminate it in an unusual way'
file is not a threat - but does cause lag
  kernsdev   (further information)
AntiVirus Software, but it isn't very effective. No real danger, exept it will block other antiviruses sometimes.
disabled it,and my computer is working again
i cannot delete it.
  John Hall  
We run Symantec Enterprise Edition and I have found this on only one of our computers. The computer was exhibiting all the signs of a virus infection. We control our virus definition updates centrally but it was causing the computer to update its definitions daily from somewhere other than our central control server, not good. I searched the Symantec site for it but only turned up one reference that mentioned it was a service a particular virus would stop but nothing about it being a part of our suite. Removed its start command from HKLM/Software/Microsoft/Windows/Current Version/Run No ill af

Rating chart

Summary: Average user rating of SNDMon.exe: based on 20 votes with 16 user comments. 10 users think SNDMon.exe is essential for Windows or an installed application. 3 users think it's probably harmless. 3 users think it's neither essential nor dangerous. 2 users suspect danger. 2 users think SNDMon.exe is dangerous and recommend removing it. One user is not sure about it.

Do you have additional information?
What do you know about SNDMon.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving SNDMon issues

A clean and tidy computer is the key requirement for avoiding problems with SNDMon. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the SNDMon.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

SNDMon.exe [all]