Intel System Usage Report (SUR) update initiated a system restart without user consent

[rcp]

Please ensure that future versions of this package do not automatically restart the computer without user consent.

Events:

Log: Application
Source: MsiInstaller
Timestamp: 21/09/2021 15:01:02
User: SYSTEM

EventID: 1042

Description: Ending a Windows Installer transaction: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\downloads\86621605-2a0b-4128-8ffc-15514c247132\IntelSURQCSoftwareAssetManagerInstaller.msi. Client Process Id: 3812.

EventID: 1033

Description: Windows Installer installed the product. Product Name: Intel(R) SUR QC Software Asset Manager. Product Version: 3.5.5033. Product Language: 0. Manufacturer: Intel Corporation. Installation success or error status: 0.

EventID: 1005

Description: The Windows Installer initiated a system restart to complete or continue the configuration of 'Intel(R) SUR QC Software Asset Manager'.

[mjflorida]

Also check in Services that below service is either not there or set the manual so even if it IS in there, it can't restart automatically. 

[AlHill]

Or, just say "NO" when installing IDSA (for example) when it asks you to participate in the Computing Improvement Program.

Doc (not an Intel employee or contractor)
[Windows 11 is the new Vista]

[fryercraig]

Got bit by this earlier today. Had about 30 windows open, and boom! Everything gone. Not cool.

[allklier]

I'll add my distinct rage at this situation.

This is system is used among other things for live stream productions. An un-commanded restart is not just an inconvenience or minor data loss, but a major operational failure in that case. The engineering team that wrote this non-critical software and who thought it is ok to restart a system without warning needs some serious re-training and usability help.

This needs to be rectified very rapidly.

Jan

[sigsss]

WHAT IN THE ACTUAL DOG F()CK, HOW F INCOMPETENT CAN YOU BE!!"(!"#"!)(

FORCE RESTART WITH OUT USER CONSENT??????? I'M CUTTING MY FACE WITH A KNIFE IN RAGE OVER THIS

[Emil1]

This happened to me just moments ago on two machines!

We have one Windows-10 based server which I remote into from my desk. I noticed that after I remoted in, it logged me in like after restart. Checked the event viewer and voila.

"Vom Prozess "msiexec.exe" wurde auf Anforderung des Benutzers "NT-AUTORITÄT\SYSTEM" das Ereignis "neu starten" für den Computer "XXXXXX" aus folgendem Grund initiiert: "Kein Titel für den Grund"
Ursachencode: "0x80030002"
Herunterfahrtyp: "neu starten"
Kommentar: "Der Windows Installer hat einen Neustart des Systems initiiert, um die Konfiguration von "Intel(R) SUR QC Software Asset Manager" fortzusetzen bzw. abzuschließen.""

Moments after, as I was checking something on our main Server, which runs Windows Server 2012 R2, suddenly a blue screen "restarting..." appears... After logging in, I check the event viewer... the same event as above!

The thing is that I have occasionally experienced unwanted update-initiated automatic restarts on a Windows 10 before, but never ever on a Windows server machine! It had always to be started manually by an admin! This really needs to be handled by Intel ASAP!

[Keir]

This just happened to me today, not only did it restart without warning but I had to look through the event viewer to find out what was responsible. I'm just a home user, who knows how many this people is happening to who wouldn't know how to do that.

[RTPGiants]

Just adding a "me too" to this. Went searching for malware only to find it's Intel's issue here. Come on guys...

[allklier]

I have uninstalled the Intel Driver and Support and other utilities on my system now. Not sure if it will help, but worth a try. I have a live production later today on a separate system and am trying to figure out how to prevent this from happening in the middle of the show.

I also just saw the Intel SUR QC Asset Manager in the services.msc and disabled it there. Good riddance.

If anyone has any ideas of which service to stop or utility to uninstall beyond the obvious, hints are appreciated.

Jan

[mjflorida]

I posted some findings earlier in this thread.  You can try those.  No guarantee they actually correct the issue, but they line up with the offending service called out in even viewer anyhow.

[allklier]

Thanks. Looked it up. That may be insufficient. I had uninstalled that earlier, but still found the SUR QC Asset Manager (the component whose update apparently triggers this **bleep** show) still listed in services.msc. So you may want to disable that on top of things.

[mjflorida]

Yeah, for me it did not uninstall the service from the service panel, but it did set it to manual.  Likewise, the directory of C:\program files\intel\SUR is now completely empty.   So the service itself is no longer there, even though Windows still lists it.  (Full path in the services control panel is given as C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe")

My guess is that like so many Windows installers that the service is no longer there, but it does a crappy job of completely cleaning up after itself.  If you try to start the service, you'll get the following error:

[RTPGiants]

Just as a note, even with the stuff installed, the service is Manual. I've not uninstalled anything, but I did set it to disabled instead which should prevent it from starting. Will see how that goes.

[ComeOnNow]

The fact that this was reported over 20 days ago and just hit two developer machines in my office this morning, losing work is outrageous.

This should have been fixed long ago, how has this updated not been pulled? Someone needs to answer for this. This destroys confidence in your company.

[PartTimeGeek]

I am the IT Director for my firm. I was in the middle of two remote sessions to the office working with team members when my NUC suddenly went to a blue background with "Restarting" and spinning dots, with no warning.

I am understandably paid to be paranoid about any and all cybersecurity threats, and Intel just cost me 30 minutes of lost work, and a few more grey hairs during the process of tracking down what nefarious process caused my Windows 10 Pro 21H1 Hades Canyon NUC to reboot to sink in it's hooks into my OS.

And I find an intel Telemetry app being the cause of it... And though I did install the Driver Support Assistant, I don't remember ever being given the option to opt out of telemetry during the install, because I ALWAYS opt out of such things.

Please make sure this is addressed in this thread when the problem is resolved?

[allklier]

It doesn't seem to be a high priority as the last post of 'still working on it' is now 7 days old by @David_G_Intel. Given the severity of the impact and the number of reports of this happen just today it seems like they would want to do something to stabilize the patient while sorting out what the long-term answer is.

Jan

[achoh]

Followed the rabbit trail of a ruinous (3 hrs work - gone) unprompted restart and ended up here. Where's the fix? This issue needs to be addressed immediately.

[CCD-Paul]

I experienced a sudden reboot as well on my 2019 Server.. on 10/11/21

Event ID: 1074

The process msiexec.exe has initiated the restart of computer [COMPUTER] on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80030002
Shutdown Type: restart
Comment: The Windows Installer initiated a system restart to complete or continue the configuration of 'Intel(R) SUR QC Software Asset Manager'.

[patientviking]

This happened to me yesterday (10/12) too!  Rebooted my computer without any notification.  Dug in to the event logs and found this was the cause.  Very disappointing that Intel will allow this and on top of it not respond to the issue.  Uninstalling and disabling service from my company devices.  Good bye intel improvement!  We are not going to help you if you are not going to help us.

[Ronny_G_Intel]

Hi everyone,

The Intel SUR QC Software Asset Manager that is causing a system reboot and error is related to the Intel® Computing Improvement Program (Intel® CIP). Intel CIP is an optional opt-in program offered to users during an initial installation of the Intel® Driver & Support Assistant.  

The Windows Installer* initiates a system restart to complete or continue the configuration of Intel SUR QC Software Asset Manager and results in rebooting and/or in error code 0x80030002.

The Intel SUR QC Software Asset Manager Service can be deleted to stop this behavior. Here are the steps to delete impacted service and files:

1. Open Command Prompt” and run as administrator mode.
2. In the command prompt window, type the following: sc delete "Intel(R) SUR QC SAM".
3. Execute the above command.
4. If the C:\Program Files\Intel\SUR\QUEENCREEK\Updater folder exists, delete all files under this location.

Or you can completely uninstall the Intel CIP from Control Panel and this should also remove the service.

We apologize for the inconvenience generated by this application.

Regards,

Ronny G

[Salim]

I hear ya, but if we decide to keep it, is the sudden reboot something that is going to happen again or was it just an unintentional one off and if it has already happened on a certain device, won't happen again on that device? Please confirm.