RuntimeBroker.exe Virus? How to Spot a Fake Process and Remove It

RuntimeBroker.exe is normally a legitimate Microsoft Windows process, but malware can reuse the same filename. The genuine file should run from C:\Windows\System32\RuntimeBroker.exe and carry a valid Microsoft signature. High CPU, high memory, or several Runtime Broker processes do not prove infection by themselves. A copy in AppData, Temp, another user-writable folder, an invalid signature, or a scheduled task that launches the file is a much stronger warning.

Is RuntimeBroker.exe real or fake?

Windows uses Runtime Broker to help manage permissions for Microsoft Store apps. It can start more than one instance as different apps request access. The name shown in Task Manager is therefore only the beginning of the check; the file location, signer, parent or launcher, and behavior matter more.

Check the path and Microsoft signature

1. Open Task Manager with Ctrl+Shift+Esc.
2. Open the Details tab, right-click RuntimeBroker.exe, and select Open file location.
3. Check that the folder is C:\Windows\System32. A folder whose name merely contains “Windows” or “Microsoft” is not equivalent.
4. Right-click the file, open Properties → Digital Signatures, and confirm that Windows reports a valid Microsoft signer.

You can also check the signature in PowerShell. The result for the genuine System32 file should show a valid status and a Microsoft signer:

Get-AuthenticodeSignature "$env:windir\System32\RuntimeBroker.exe" |
  Format-List Status, StatusMessage, SignerCertificate

For a suspicious copy, replace the path with the exact file you found. Do not upload a private work file or an executable that may contain customer data. Microsoft Sysinternals Sigcheck is another official way to display hashes, version information, and signature details. Our guide to checking whether an EXE file is safe explains how to interpret these signals together.

Does high CPU mean RuntimeBroker.exe is a virus?

No. High CPU or memory is a symptom, not a malware verdict. Microsoft notes that an app can make Runtime Broker consume unusually large amounts of memory. If the file is the signed System32 copy, close recently opened Store apps, end Runtime Broker once in Task Manager, and restart Windows. Do not delete the System32 file or disable Windows components just to stop a temporary spike.

Escalate to a malware check when sustained resource use appears together with a wrong path, an invalid or missing signature, an unfamiliar outbound connection, a new task or service, repeated security-tool alerts, or recurrence immediately after reboot. Coin-mining malware often exposes itself through persistent CPU or GPU use, but the resource graph alone cannot identify the program.

Inspect a RuntimeBrokerService scheduled task

Malware authors can give a task a Windows-looking name. A task called RuntimeBrokerService is not automatically malicious, and it is not a standard verdict by itself. Open Task Scheduler → Task Scheduler Library and inspect these fields:

• Actions: the exact executable, script host, command, and arguments.
• Triggers: whether it runs at sign-in, at startup, or every few minutes.
• Author and creation time: whether they match a software installation you recognize.
• Destination: whether the action points to System32 or to a writable folder such as %LOCALAPPDATA%\Temp.

The built-in command below displays the task definition. Replace the example task name only with the exact name you found:

schtasks /query /tn "\RuntimeBrokerService" /xml

Read the command and arguments before deleting anything. A familiar name can hide a PowerShell, command-script, or user-profile executable. Conversely, an unfamiliar task may belong to legitimate software. The action path and signer resolve that ambiguity. If a suspicious service launches the same file, follow the deeper checks in our Service Miner removal guide.

How to remove a fake RuntimeBroker.exe and its persistence

1. Disconnect from the network. This interrupts mining traffic and reduces the chance that a loader downloads another component.
2. Record the evidence. Save the file path, task or service name, action and arguments, and detection name. Do not execute the file to test it.
3. Disable the confirmed launcher. In Task Scheduler, disable the suspicious task first. Stop a malicious service only after you have verified its executable path. If the process returns, check startup apps, Run entries, scripts, and Image File Execution Options hijacking.
4. End the suspicious process. End only the wrong-path copy. Do not delete the signed System32 Runtime Broker.
5. Remove the malicious file and related detections. Quarantine the file with your security tool. If deletion fails, scan from Safe Mode or an offline environment rather than changing permissions on protected Windows folders.
6. Reboot and scan again. Recheck the task, service, path, CPU use, and security alerts. A clean first scan does not prove that every loader or persistence entry is gone.

A visible miner process may be only the payload. A scheduled task, service, Run entry, script, or bundled loader can recreate it after quarantine. Gridinsoft Anti-Malware can check the computer for the process, related files, startup entries, tasks, services, and other persistence before you reconnect it.

If the scan confirms a cryptocurrency miner, use the broader Coin Miner malware guide to check cooling, performance, and other miner symptoms. If an unknown loader ran, assume the incident may include more than mining. Change important passwords from a clean device if you also see account alerts, browser-session theft, or unauthorized logins.

Confirm that cleanup worked

• The only RuntimeBroker.exe instances open from C:\Windows\System32 and have valid Microsoft signatures.
• The suspicious task or service does not return after reboot.
• No script or user-profile executable launches from the former task action.
• Idle CPU or GPU use returns to the machine’s normal baseline.
• A second full scan finds no related loader, miner, startup entry, or exclusion.

Keep the device offline if the wrong-path file returns. Reappearance means the launcher remains or the cleanup missed another component; repeating “End task” will only hide the symptom briefly.

FAQ

References

1. Microsoft Support. “Runtime Broker is using too much memory.” Microsoft, accessed August 14, 2026. support.microsoft.com.
2. Mark Russinovich. “Sigcheck v2.91.” Microsoft Sysinternals, updated February 4, 2026. learn.microsoft.com.
3. Microsoft Learn. “schtasks commands.” Microsoft, updated February 3, 2023. learn.microsoft.com.