Windows 10: Two RuntimeBroker.exe at startup

Hi!
After 1709 update I found these two instances of RuntimeBroker.exe in my tasklist:





and






I disabled Cortana in previous version (and mantained it disabled)... so: why these two programs are running?

Thanks!
Joe

:)

 

Beyond sick of this issue - Event ID 10016 application issue.

What if there is no :

HKEY_CLASSES_ROOT\AppID\RuntimeBroker.exe

Do you mean ?

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\runtimebroker.exe

Thanks

 

Runtime Broker once again taking up over 1GB of memory?

Hi

I cannot agree more, of the hundreds of Microsoft responses I have read over time, only a few have been relevant to the problem - far less useful.

I think I do understand what is going on however: procmon from sysinternals is your friend here - default the filters and then filter the responses by process name 'RuntimeBroker.exe'.

------------------------------------------------------------------------------------

A snip from a quick looks gives :-

18:45:51.0066040 RuntimeBroker.exe 60076
CloseFile O:\Pic archive\Holidays\Greece Evia and islands May 2013
SUCCESS C:\Windows\System32\RuntimeBroker.exe C:\Windows\System32\RuntimeBroker.exe -Embedding

18:45:51.0069628 RuntimeBroker.exe 60076 CreateFile
O:\Pic archive\Holidays\Greece Evia and islands May 2013 SUCCESS
Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened
C:\Windows\System32\RuntimeBroker.exe C:\Windows\System32\RuntimeBroker.exe -Embedding

18:45:51.0072617 RuntimeBroker.exe 60076 DeviceIoControl
O:\Pic archive\Holidays\Greece Evia and islands May 2013 INVALID PARAMETER
Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding

18:45:51.0072970 RuntimeBroker.exe 60076 CloseFile
O:\Pic archive\Holidays\Greece Evia and islands May 2013 SUCCESS
C:\Windows\System32\RuntimeBroker.exe C:\Windows\System32\RuntimeBroker.exe -Embedding

18:45:51.0076644 RuntimeBroker.exe 60076 CreateFile
O:\Pic archive\Holidays\Greece Evia and islands May 2013 SUCCESS
Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened
C:\Windows\System32\RuntimeBroker.exe C:\Windows\System32\RuntimeBroker.exe -Embedding

.

.

.

yada yada yada

-----------------------------------------------------------------------------------------------------------

This shows the program hammering my system - particularly my external usb O: drive, most accesses were to it.

This disk contains approx 2TB of photos and music and it died recently. Taking the box apart I found that the sata/usb controller had fried - literally - melted!!

The disk itself survived and is now in another box.

Last but Best!!!!

The snippet above is culled from a 1 (ONE) SECOND selection of the output from procmon in which RuntimeBroker conducted 4754 file IO operations on my system!! - and this had been going on for hours.

So a few hours (many - days even) is not going to do the kit much good. IMHO.

 

You know what i never notice two or more instances of RuntimeBroker.exe in Task Manger. The RuntimeBroker.exe is stored in C:\Windows\System32 folder if the RuntimeBroker.exe not running from C:\Windows\System32 folder then you have malware infection.

 

I have four instances running and that is normal on my machine. *Nerd

 

Every RuntimeBroker.exe runs from C:\Windows\System32\ ... So I guess it's ok. Well, before 1709 I've no RuntimeBroker.exe starting with Windows and staying in.