Nmon.exe: what it is and how to remove it
Nmon.exe - the executable file that is identified as an undesirable program due to shady processes running on the system. This file is a part of the application that can be harmful or even malicious.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
An automatic scan can look at Nmon.exe and the other programs installed around the same time.
Do it yourself · free Remove Nmon.exe yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Nmon.exe: summary
| Damage | It affects the speed and performance of the machine, triggers unwanted behavior, changes in the registry[1] |
|---|---|
| Name | Nmon.exe |
| Type | Malware |
| Issues | The file can run in the background and create many questions due to suspicious processes and associated programs, tools, files. Since the system gets affected from the inside, it is difficult to determine what is the reason for slowness and performance issues |
| Possible relation | It is speculated that Nmon.exe can be associated with trojans, worms or contain particular malicious scripts that trigger installations of malware |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Distribution | Not recorded in the old report |
|---|---|
| Symptoms | An unknown process in Task Manager |
| Files and processes | Nmon.exe and C:\Program |
| Evidence | 4 write-ups by security sites; details still limited |
| File name | Nmon.exe |
| What it is | Of unknown origin |
| First seen | 9 June 2020 |
| Facts checked | 6 October 2026 |
What the Nmon.exe file is
From our report of Jun 2020 · not reviewed since
Nmon.exe virus is the file associated with Windows software that can be used as a part of a worm or trojan payload
Nmon.exe - the executable file that is identified as an undesirable program due to shady processes running on the system.
This file is a part of the application that can be harmful or even malicious. The threat may run on the machine and sneakily alter settings, disable or add features, files, programs. All these functions create persistence and significantly lessens options for the removal and system repair.
This file can be a serious trojan related to other malware and distribute the payload of a serious threat, but it also can be considered safe and related to a program that gets corrupted or somewhat affected without your knowledge.
Nmon.exe is linked with OnMark 2000 Survey. When this file is really associated with the program it should be found in C:\Program Files\Viasoft\OnMark 2000 Survey\NMON.EXE. This location should be the best indication that file is related to the program and not malicious or potentially dangerous.
If it is found in any other place or cannot be located easily, you should consider this program at least undesirable and look out for any malware traces, virus damage, and so on.
Nmon.exe is the file that normally is designed to run commands, launch processes, trigger programs. It is not a Windows OS particle, so the file can be terminated if causing trouble. When you notice anything suspicious in regards to these files, suspicious programs, or processes, you should first find the path of the file or program and determine if the piece of malicious or safe and useful.
Nmon.exe virus can be the part of malware payload because some researchers identified this executable as a piece of data that Rbot.hz worm adds on the system once the machine is affected. This W32/Rbot-HZ threat can act as a remote access tool or open backdoors for trojans, allow unauthorized remote access to the PC.
Since the file is in a common format, Nmon.exe virus can easily end up triggering background services, malware programs and still remain silent. Malicious intruders that fall in these malware, worm, or trojan categories are known for being silent and affecting poorly secured networks. So weak passwords can result in a backdoor trojan, info-stealing malware infiltrations.
If your device is infected and your machine is controlled by a remote attacker, your computer is not working properly anymore. You need to remove Nmon.exe, or a virus that triggers all the changes and damage on the computer. Such programs can help you find, indicate, and if anything that gets affected by the infection.
From our report of Jun 2020 · not reviewed since
Determine if the file is a malicious Nmon.exe virus or not
To determine if the Nmon.exe virus is malicious or not, you need a proper system scan using anti-malware tools.
If the full check on the computer states about pice of malware, you should run the elimination and take care of the threat. That should happen automatically when you use proper antivirus detection engine-based applications.
Nmon.exe removal can get difficult if the program is installing more files or programs on your machine. The persistence can go significantly high, and once the malware triggers all the shady processes, your device starts running slow. Speed issues also trigger freezes and system crashes that can lead to more severe issues than the background process.
Nmon.exe virus can appear in the Task Manager as a process running in the background. You should have some questions about the persistence and purpose of the intruder when the file appears out of nowhere and is not related to anything explainable. You should determine the path via Task Manager to see the location of the file. If you find a suspicious directory associated, you should investigate further.
You can remove Nmon.exe virus if the anti-malware program that you run on the system shows the file on a list of malware detected. This is the best indication that you need to get rid of the threat and clean the machine further. Also, remember the importance of professional programs and file repair requirements.
Choose reliable anti-malware tools, clean the machine, and try to find virus damage or affected, corrupted files, so you can repair them and get back to the normal working devices. Such stealthy malware like Nmon.exe virus can affect various parts of the computer without your knowledge, as experts always note. So try to clean the system as soon as possible.
How to check the Nmon.exe file
- Path:
C:\Program - File:
Nmon.exe
From our report of Jun 2020 · not reviewed since
More from our earlier report on Nmon.exe
- Nmon.exe removal procedures depend on particular purpose of the threat because corrupted software may be uninstalled and trojans not so easily.
- Rely on anti-malware tools and run the full system scan to find possibly harmful programs and viruses
- Recover system files, functions, or even programs that the virus affects.
- Run and find the damage for repairing
Where Nmon.exe comes from
From our report of Jun 2020 · not reviewed since
Trojans, ransomware, worms, and other malware that stealthily injects its scripts on the system can spread easily when users don't pay attention to the content that gets clicked on or is downloaded. It is unnoticed when the malicious file is downloaded without your consent or knowledge.
You can trigger the drop of the threat when you download pirated software, use torrent services, or surf on deceptive pages, misleading domains. Sometimes hacked or malicious sites can have many layers and launch malware installations after a few clicks on the content.
Spam email campaigns also have many issues since users tend to overlook details and red flags. Notifications with financial information and claims about orders, receipts, invoices often can include files with malicious purposes, and once the document is opened or downloaded executable, DLL or different format triggers the drop of a virus payload.
What to do with Nmon.exe
How to remove Nmon.exe
It is usually a leftover of an unwanted program.
Uninstall the program, then delete what remains.
Step 1: Uninstall programs you did not mean to install
Nmon.exe rarely comes alone: it is usually installed by, or together with, a free program. In Windows 11 open Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and sort by install date.
Uninstall every entry from the day the trouble began that you did not install on purpose, for example a download manager, a converter or a browser you never chose.
Keep drivers and entries from Microsoft, Intel, AMD, NVIDIA or your PC's maker unless you are sure.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Nmon.exe, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Nmon.exe that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
From our report of Jun 2020 · not reviewed since
Get rid of any traces and associated programs by removing Nmon.exe virus
You can remove Nmon.exe from the machine if it causes issues, triggers unwanted processes, and affects the performance of the device for you.
You need to determine the purpose, source, and the level of danger before though. You can't un the security tool or a anti-malware program, so the malware is detected.
Once you find the Nmon.exe virus on the list of potentially malicious programs, you can run the same security or antivirus tool and delete all the traces. or should work perfectly for you because these programs are based on AV detection engines.
Also, do not forget about corrupted file and program issues. After the Nmon.exe removal procedure, run and check for corrupted, damaged, or differently affected files, system functions to repair. Once that is fully done, you can use the PC normally again.
[GI=method-1]You may benefit from the reboot in Safe Mode with Networking when Nmon.exe virus runs its malicious processes
[GI=method-2]System Restore can act as a virus removal solution because it recovers the machine in a previous state when Nmon.exe was not present
Questions about Nmon.exe
What is Nmon.exe and why is it running?
Every process is started by something:
- a program you installed
- a Windows service
- a scheduled task
- a startup entry
To learn why Nmon.exe runs, find its file with Open file location in Task Manager, then look for an entry pointing to that file in Settings > Apps > Startup and in Task Scheduler.
Sort Installed apps by date to see what arrived when the process first appeared. Once you know the owner, you can decide whether to keep it, switch it off at startup or uninstall it completely.
Can I delete the Nmon.exe file?
Only after you know what it belongs to. If Nmon.exe is part of a program, uninstall that program through Settings instead, so its services and tasks go too. If it belongs to nothing and is unsigned, end the process, disable whatever starts it and then delete its folder.
Do not delete files from the Windows folder or files signed by Microsoft: those are part of the system, and removing them can stop Windows from starting. When in doubt, run a Microsoft Defender scan first and let it decide.
How did Nmon.exe get onto my PC?
Files like Nmon.exe, which is of unknown origin, usually arrive with a free program whose installer added extra offers that were ticked by default. They can also stay behind after you uninstall such a program, because the uninstaller removes the main part only.
Sort Installed apps by date and look at what was installed around the time the file appeared; that is usually the source. Next time, choose Custom or Advanced in installers and untick additional software. Read each screen before clicking Next.
Why does Nmon.exe have a strange name?
Random or look-alike names help unwanted files avoid attention. A name that resembles a Windows component sounds trustworthy, and a random one changes from PC to PC so it cannot be searched easily. The observation here is an unfamiliar process called Nmon.exe in Task Manager.
Judge the file by where it is and who signed it, not by its name: Windows files sit in C:\Windows and carry Microsoft's signature, and anything else that imitates them deserves removal. When in doubt, a full scan in Windows Security settles it.
Can I rename or move Nmon.exe to stop it?
Do not. Renaming or moving a genuine file breaks the program or the Windows feature it belongs to, and Windows may restore it anyway. Renaming a malicious copy does not make it harmless either: whatever starts it may still find it, or download a fresh copy.
The right tools are the program's uninstaller for unwanted software, a full scan and the offline scan for malware, and System File Checker for damaged Windows files. Each removes or repairs the related entries as well.
Is a single scan enough to trust Nmon.exe?
For a genuine file in its normal folder with a valid signature, yes: a clean scan confirms what the location and signature already told you. For a file in an odd folder or without a signature, a clean result is less reassuring, because new malware is not always detected at once.
In that case update Windows Security, scan again a day later and keep an eye on the file. If it comes back after deletion or uses CPU while the PC is idle, treat it as malicious.
Can I just delete Nmon.exe?
Not right away. If the file is running or something restarts it, deleting fails or the file returns. First check what it is:
- open Properties
- look at the publisher and the signature
- note the folder
A file that matches an unfamiliar process called Nmon.exe in Task Manager and has no publisher is not part of Windows. End its process in Task Manager, remove the startup entry or scheduled task that points to it, then delete the file and restart. If it comes back, an offline scan with Microsoft Defender removes what keeps restoring it.
Why does Nmon.exe use so much CPU?
Usually it is doing work for Windows or another program:
- updates
- indexing
- scanning
- a stuck task
Wait a few minutes after start-up, then check again. If high use continues, restart the PC, install pending updates and check the related program. If the busy copy runs from an unusual folder, high CPU can be a cryptominer using the name.
The Details tab in Task Manager shows which copy is busy; for a system process, right-click it and choose Go to service(s) to see the services behind it.
Why are there several Nmon.exe processes?
Windows and many programs run separate instances for different tasks, tabs or users, so several copies in Task Manager can be normal. Right-click each one and choose Open file location: they should all point to the same genuine folder.
Many copies alone are not a sign of infection. A copy that points to another folder, or one with no publisher on the Details tab, is the one to check further. If the count keeps growing, a program may be starting new instances in a loop.
Will Fortect remove Nmon.exe?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Nmon.exe, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Redcanary: Windows Registry Attacks: Knowledge Is the Best Defense (read October 6, 2026)
- Howtogeek: What is RAT Malware, and Why Is It So Dangerous? (read October 6, 2026)
- Dieviren: DieViren (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)