RuntimeBroker.exe is this any good?


  1. Posts : 608
    win 10 64 bit os x64 based processor now with 20h2 update
       #1

    RuntimeBroker.exe is this any good?


    i keep getting a warning that win10 blocked this file from running. RuntimeBroker.exe i find it in a few places on my pc in the windows folder using the file explorer and doing a search for it. so i did a online search and the search is kind of confusing as it tell me i can remove it if i do not run may windows apps. but i just do not know how may programs i use that are windows app and how many are not.

    so because windows thinks this is some type of bug and tells me it blocked it from running might i just remover it? if so is there a faster way to remove it rather than going into all the folders file explorer found it in and deleting it?

    thanks
      My Computer


  2. Posts : 5,391
    Windows 11 Pro 64-bit
       #2

    As long as the process located within C:\Windows\System32\RuntimeBroker.exe it’s not a virus.
      My Computer


  3. Posts : 1,728
    Windows 10 Pro x64 22H2
       #3

    In addition to what FreeBooter said...

    The Runtime Broker is responsible for checking if a store app is declaring all of
    its permissions and informing the user whether or not its being allowed

    The Runtime Broker used outbound TCP 443, any other connection should be considered malware.

    edit:
    Unless it's digitally signed.
    right click start button -> Windows PowerShell
    In powershell console run this code to verify it's not a virus:

    Code:
    Get-AuthenticodeSignature -LiteralPath "C:\Windows\System32\RuntimeBroker.exe" | select -ExpandProperty Status
      My Computer


  4. Posts : 608
    win 10 64 bit os x64 based processor now with 20h2 update
    Thread Starter
       #4

    this is where it is located it looks like it is in the system32 section. but more of them are in other locations and i keep getting a warnings that windows has blocked this program or file from running so if it was a real windows file then why is windows blocking it?

    RuntimeBroker.exe    is this any good?-screenshot-2023-06-13-153221.png
    Attached Thumbnails Attached Thumbnails RuntimeBroker.exe    is this any good?-screenshot-2023-06-13-152254.png  
      My Computer


  5. Posts : 1,728
    Windows 10 Pro x64 22H2
       #5

    Run Get-AuthenticodeSignature for each of those blocked files, simply replace path to file in the command from my previous post and make sure output is "Valid"
      My Computer


  6. Posts : 608
    win 10 64 bit os x64 based processor now with 20h2 update
    Thread Starter
       #6

    when i did the search it did not give me the complete path. but i will give it a go and see. ok i opened the power shell but it will not paste those tree lines into the power shell and i'm not typing all of them in so i will try to delete one that is not in the sys32 folder and see what happens
      My Computer


  7. Posts : 1,728
    Windows 10 Pro x64 22H2
       #7

    Get to the point as shown in your screenshots, then right click each file and click properties.
    there you'll find the path and also digital signature status.

    Make sure each one has digital signature (certificate), that's alternative to powershell option.
      My Computer


  8. Posts : 608
    win 10 64 bit os x64 based processor now with 20h2 update
    Thread Starter
       #8

    ok here are all the right click and properties and one has the digital signature the other do not
    RuntimeBroker.exe    is this any good?-screenshot-2023-06-13-160934.png

    - - - Updated - - -

    ok i did an update it may have needed one and i will see if this error returns. it shows up as a notice. the next time i see the notice i will open it and see what it is asking me to do. i may have turned off something and have to go and allow it. i do see in the task manger that runtimebroker is not using any memory so maybe it needs to be turned on. thanks
      My Computer


  9. Posts : 1,728
    Windows 10 Pro x64 22H2
       #9

    WinSxS is a system folder in Windows that stores different versions of files, backups or copies of Windows system files, and files required for installing Windows and updating Windows
    Those are therefore backup files, but only one is supposed to be active which is in system32 folder.

    If you want to make RuntimeBroker.exe to start doing something, ex. to observe it's behavior, you can do so by running apps from MS store or by logging into store apps which support login or login to MS store.

    Didn't test but this should invoke RuntimeBroker.
    I've taken a look on my system and some files are unsigned as well here, so it's not a virus. (I know because I've reinstalled OS yesterday, no virus)
      My Computer


  10. Posts : 608
    win 10 64 bit os x64 based processor now with 20h2 update
    Thread Starter
       #10

    ok thanks let me run it for now and see if this returns. it did do about 5 updated files so this may be the issue. again thanks for the help.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 21:03.
Find Us




Windows 10 Forums