Okay, look, here's the deal. FileMon - at least the FileMon that was available before the Microsoft acquisition of SysInternals (I haven't had the chance to test any prior versions) - probably *does* install something to the Windows system folder. However, it cleans itself up afterwards. Let me explain how I believe this is true.
I used to run it on the computers at the college I went to. I was just an ordinary student, and the college computers (running NT 4) were set up so that there were no write permissions to the Windows folder, *especially* the system folder. Don't get too cocky on reading this - the program refused to run normally. It just wouldn't start.
However, I did notice that on computers where it *did* run, it extracted a file to the current directory, which was removed very quickly. This file - which I have on my USB drive - is called filem.sys and has an md5sum hash of 5888bb7122cb80babf3a849189bee679. At least, the version that was extracted did. I got the file by having a batch file continually running which attempted to copy the file to another directory repeatedly. Not the best or most efficient way to do it, but it works.
Now, when this file is in the same directory as the EXE and the program is run on a system with write permissions denied to the Windows folder, it works. I'm not kidding.
My best guess here is that the program attempts to use the SYS file, and if it can't find it, it extracts it to the current directory, moves it to the system folder, and then tries again. The system folder is probably used because that's the canonical place for such files. But it would explain why it doesn't work when it's not extracted, and does when it is.
Now can we stop the argument now?