Autoruns v14.06 and Sysmon v13.30

Alex_Mihaiuc well it's failed to disable components is Installed components for i.e. Is it new normal behaviour? We (ok I am) look at builds v13.x and it works fine.

14.06 is still broken. Open -> Save > and Compare still cannot load the saved .arn file with Win7 ESU, Win 8.1 and Win10 LTSB. Works okay with Win11 and some newer W10 builds.

Has no one tested this?
Am I the only one with this problem?
It would be nice if someone could confirm.

In the Sysmon zip file, Sysmon64.exe shows a file and product version of 13.30. However, upon installation, it displays v13.24. Additionally, once installed, C:\Windows\Sysmon64.exe displays a file and product version of 13.24, as does the C:\Windows\SysmonDrv.sys. Is this the latest version of 13.30? Or is the product version incorrectly listed on install and post-install? 

Autoruns is still broken 

JosephMy It appears you have a mix between v13.24 and v13.30. I think that in your case the previous version was not fully uninstalled before getting to v13.30. Completely remove sysmon with:

sysmon64 -u force

then make sure that C:\Windows\sysmon64.exe doesn't exist anymore and start again v13.30.

hqqddy is this still the crash with rundll entries containing spaces?

Oh, hqqddy, I saw such problems with v14 and I thought they were all fixed. I would owe you one if you could provide a more detailed description so I can get a fix out. Either here or via mail at "syssite".

Alex_Mihaiuc it's  looks like this. is it normal? I saw it start from first v14.

Hi Alex_Mihaiuc, thanks for the reply. I did try the -u force command, it appears that the executable persists in C:\Windows although the output says that it's the Sysmon64 service is stopped and and Sysmon64 is removed. As a workaround, I'm running -u force, then deleting the executable. Thanks.

JosephMy the fact that we don't properly handle this common upgrade path is very useful feedback in itself, thanks!

click-click really weird it's regressing on the older systems, I'll have a look and get back to you with a fix.

hqqddy - getting that error while trying to disable one of the "?????" entries towards the bottom of the list, is that correct?