Program file

alcxmntr.exe: the Realtek AC'97 audio event monitor

alcxmntr.exe, shown in Task Manager as AlcxMonitor, is a background component of the Realtek AC'97 audio driver. It is not a Windows file. The genuine copy sits in C:\Windows or in the driver folder the PC maker used, and you can stop it starting without losing the driver. A copy elsewhere is suspect.

By 2-Spyware Editorial TeamPublished Apr 27, 2021Updated Oct 10, 2026

Prefer to check it yourself? The manual checks follow.

Realtek driver component

On a PC with Realtek AC'97 on-board sound, alcxmntr.exe in C:\Windows or in the maker's driver folder belongs to the audio driver package. It is not a virus. Windows does not need it, and the sound driver itself (ALCXWDM.SYS) is a separate file.

The name can be copied by malware. A copy in a user folder, a Temp folder or on a PC with no Realtek AC'97 audio is not the Realtek file. Check the folder before you trust it.

Publisher: Realtek Semiconductor
Program: Realtek AC'97 audio driver package; Task Manager and start-up lists show it as AlcxMonitor, Realtek Audio Event Monitor or Realtek AC97 Audio Event Monitor
Function: Event monitor for the audio hardware. It runs in the background without a window and has a system tray icon according to one source
Usual folder: C:\Windows. Copies also sit in the PC maker's driver folder (a user report names C:\hp\drivers\audio\Realtek) and in the driver backup folder under System32. The old page listed locations without the paths being kept
Known sizes: 57,344 bytes in 88 percent of cases, otherwise 70,144 or 50,176 bytes, as reported on Windows 11, 10 and 7
Start-up: Loaded at start-up through a Run entry in the registry, written by the driver installer
Installed by: The Realtek AC'97 audio driver, often supplied by the PC maker (HP, Compaq and Dell packages are named in user reports and a Dell driver page). Realtek makes the sound chip for many brands, so you can have it without installing Realtek software yourself
Related files: ALCXWDM.SYS is the Realtek AC'97 WDM audio driver; alcmtr.exe is a similarly named monitor reported for Realtek High Definition Audio
Windows file: No
Needed?: No for Windows. Sound normally works without it, though one user report says a program installed afterwards could not find the sound card until it ran again

What alcxmntr.exe does

alcxmntr.exe is the event monitor of the Realtek AC'97 audio driver. The name is usually read as AlcxMonitor. It starts with Windows, has no window of its own and sits in memory watching events from the audio hardware.

It is installed together with the driver. A PC that uses a Realtek AC'97 chip, such as many Compaq, HP and Dell machines of the Windows XP and Vista era, can therefore have it even if the owner never installed Realtek software. The old page said the same: Realtek also supplies sound hardware that other companies build into their PCs.

It has been described as spyware. One source states that it logs usage of Realtek services and that Realtek collects this for quality control. Another source says some companies labelled it spyware because it logs activity and sends it to outside servers. A user who watched a firewall reported that it never connected to the internet. None of the pages read for this reference is from Realtek, so the data collection is not confirmed and not disproved. The old page took a middle line: it did not harvest passwords or personal details, but monitoring user behaviour could be seen as a privacy concern.

The file is not an essential part of Windows, and the audio driver keeps working if the monitor is removed. Many drivers have a monitor process like this one for events and background tasks.

Realtek AC'97 is old technology. Realtek lists its Windows AC'97 drivers for Windows 98 up to Windows 2003, plus a Vista and Windows 7 package. Whether the file is present on a Windows 11 or 10 PC depends on the driver the PC maker supplied. Windows 11 and 10 PCs with Realtek High Definition Audio more often show alcmtr.exe, a differently named file.

About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.

How to check it

Where the file sits and which driver installed it separate the Realtek monitor from a copy that only has the name.

Find the process. Press Ctrl+Shift+Esc. On Windows 11 and 10 open the Details tab, or look for AlcxMonitor on the Processes tab, and note whether there is more than one.
Open the file location. Right-click the row and choose Open file location. The expected folder is C:\Windows, or a driver folder the PC maker created. Drivers are often placed in the Windows main folder so that they work, so this is normal. A copy in AppData, Temp, ProgramData, a user profile or the root of a drive is not the Realtek file.
Look at the file details. Right-click the file, choose Properties > Details and read Company and Product. Both should name Realtek. Then open Digital Signatures. The signing state of this file was not confirmed in the sources read (one source calls it Microsoft signed), so a missing signature on a file in C:\Windows is not proof of a problem, but a missing one elsewhere is a warning.
```
Get-AuthenticodeSignature C:\Windows\alcxmntr.exe | Format-List Status, SignerCertificate
```
Compare the size. Reported sizes are 57,344, 70,144 and 50,176 bytes. A size far from these is a reason for a closer look, not proof; your driver version may differ.
```
(Get-Item C:\Windows\alcxmntr.exe).Length
```
Check the start-up entry. List the Run entries and read the path in the AlcxMonitor value. It must point to the same file you inspected.
```
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```
Check that the hardware exists. Open Device Manager (right-click Start > Device Manager) and expand Sound, video and game controllers. A Realtek AC'97 entry, or ALCXWDM.SYS under the driver details, matches the file. No Realtek audio device at all means the file has no reason to be there.
Scan if anything is off. Open Windows Security > Virus & threat protection > Scan options and run a full scan, then a Microsoft Defender Offline scan.

The folder and the details tell you the file is placed like the Realtek one. They cannot prove the content is unmodified. If the file fails any check, scan before you delete anything.

Do you need alcxmntr.exe?

Windows does not need it, and there is no need to remove it if it causes you no trouble. Disable it at start-up first; remove the audio software only if you want to replace it.

Keep it if the sound is fine. If it does not slow the PC or interfere with a program, leave it. Ending the process from Task Manager is temporary; it returns at the next start.
Stop it starting: Windows 11 and 10 Settings. Open Settings > Apps > Startup, find AlcxMonitor or Realtek AC97 Audio Event Monitor if it is listed, and turn it off. Not every Run entry appears in this list.
Stop it starting: Task Manager. Press Ctrl+Shift+Esc, open Startup apps (Windows 11) or the Startup tab (Windows 10), right-click the entry and choose Disable.
Stop it starting: msconfig on old systems. On Windows XP and 7, press Windows+R, type msconfig and clear the box on the Startup tab. A user report says the process kept running after the box was cleared; the reason was not found, so check Task Manager after a restart.
```
msconfig
```
Test the sound. Restart and play audio. If the sound is gone after you disabled the monitor, enable the entry again and reinstall the audio driver.
Update the audio software. Install the audio driver from your PC maker's support page for your model, or from the board maker for a self-built PC. Realtek lists its generic AC'97 drivers for older Windows versions, and a Vista and Windows 7 package. Generic Realtek drivers may not suit a branded PC, so take the maker's version first.
Remove the audio software. Open Settings > Apps > Installed apps (Windows 11) or Settings > Apps > Apps & features (Windows 10), select the Realtek AC97 audio entry and choose Uninstall. Then open Device Manager > Sound, video and game controllers and, if needed, right-click the audio device and choose Uninstall device. Restart and reinstall the maker's driver, otherwise the PC loses its sound.
If the file is not Realtek's. Run a full scan and a Microsoft Defender Offline scan, and let Defender remove what it finds. Then repair system files.
```
sfc /scannow
DISM /Online /Cleanup-image /RestoreHealth
```

Warning signs

What you see	What it means
alcxmntr.exe in a user folder, AppData, Temp or ProgramData	The Realtek file belongs to C:\Windows or a driver folder. Any malware can be named anything, so treat this as not Realtek's.
No Realtek AC'97 audio device on the PC	The file is installed with the driver. If you have no such hardware or driver, there is no reason for it.
Company or product in the file details is not Realtek	The genuine file names Realtek as the publisher.
Several copies running at once	One monitor runs at start-up. Several simultaneous copies do not match how it works. Copies on disk in the driver and backup folders are normal; copies running are not.
The process uses a lot of CPU, memory or the network	A sound monitor that waits for events should use very little. Heavy use points to a different file with the same name.
Hackers can use the name to hide a virus	The old page warned that this file name can be borrowed. Only the folder and details checks can tell the copies apart, not the name.
Freezes and slow start-up that began with the file	Users reported slowdowns and programs that would not close with it running on Windows XP. These reports are anecdotal.

Everyday problems

Sound is missing after alcxmntr.exe was deleted

The old page warned that deleting the file can bring an error and silence. Users report both outcomes: sound unaffected on one PC, and a message that the file could not be found on another. The exact error text was not kept, so it is not repeated here.

If the sound is gone, reinstall the Realtek audio driver from your PC maker's support page. In Device Manager (right-click Start > Device Manager) a missing or failed ALCXWDM.SYS driver shows under Sound, video and game controllers, and the Update driver option is the first step.

It is running although it is disabled in msconfig

A user reported that the process stayed active with its start-up box cleared. The cause was not found. Restart and check Task Manager again; a second Run entry or a driver backup may be starting it. This lists the Run entries:

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

alcmtr.exe or alcmtr exe: is it the same file?

Not the same file. alcmtr.exe is a similarly named audio event monitor reported for the Realtek High Definition Audio driver, while alcxmntr.exe belongs to the older AC'97 driver. The two are checked the same way: folder, company in the file details and the Realtek audio device in Device Manager.

alcxwdm.sys: what is it?

ALCXWDM.SYS is the WDM audio driver for Realtek AC'97 hardware. It is the part that makes the sound work, while alcxmntr.exe is only the monitor. A Microsoft support thread from 2012 describes the driver stopping and points to Device Manager and a driver download as the fix.

Questions people ask

What is alcxmntr.exe?

alcxmntr.exe is the event monitor of the Realtek AC'97 audio driver, shown as AlcxMonitor or Realtek AC97 Audio Event Monitor. It is installed with the driver, runs in the background without a window and starts with Windows. It is not a Windows system file.

Is alcxmntr.exe a virus or spyware?

It is not a virus when it is the Realtek file in C:\Windows or the maker's driver folder. Some sources called it spyware because it was said to log usage; that claim is not confirmed by Realtek in the pages read, and one user saw no network traffic. A copy in a user or Temp folder is suspect and should be scanned.

Where is the genuine alcxmntr.exe?

In C:\Windows, and in the PC maker's driver folder (for example C:\hp\drivers\audio\Realtek on an HP, as one user reported). A backup copy also sits under System32 in the driver backups. Reported sizes are 57,344, 70,144 and 50,176 bytes.

Do I need alcxmntr.exe at start-up?

No. Windows does not need it and the audio driver keeps working without it. Disable it in Settings > Apps > Startup or in the Startup tab of Task Manager and restart. If sound disappears, enable it again and reinstall the audio driver.

How do I update or remove the Realtek audio software?

To update, install the audio driver from your PC maker's support page. To remove it, use Settings > Apps > Installed apps (Windows 11) or Apps & features (Windows 10) and uninstall the Realtek AC97 entry, then reinstall the maker's driver. Without a driver the PC has no sound.

How can I tell a fake alcxmntr.exe?

Check the folder, the company in the file details, the size and the Run entry. A copy outside C:\Windows and the driver folders, with a company other than Realtek, or on a PC with no Realtek AC'97 device, is not the genuine file. Run a Microsoft Defender full scan and an offline scan.

Why do I have it if I never installed Realtek software?

Realtek makes sound chips that other companies build into their PCs. The PC maker's audio driver then installs the Realtek monitor along with the driver. Several user reports name HP and Compaq driver packages as the source.

What is alcmtr.exe, and is it the same as alcxmntr.exe?

alcmtr.exe is a different file. It is reported as an event monitor for the Realtek High Definition Audio driver, and alcxmntr.exe belongs to the older AC'97 driver. The checks are the same for both: folder, company in the file details and a Realtek audio device in Device Manager.

Sources

Version data read on Oct 10, 2026.

Questions and experiences

Ask about this page: members and our editors answer. Reading is open; writing needs a free account.

0 comments

…

5,486 members already hereReading, writing, commenting and voting. 0 verified · 211 joined this year

All members Join