How to Remove the runonce.exe virus from PC

What is runonce.exe?

runonce.exe is a legitimate process file known as Run Once Wapper; it is associated with Windows Operating System and developed by Microsoft Corporation. It is typically located in C:\Windows\System32.

Malware programmers create files with malicious content and name them after runonce.exe witn an intention to spread virus on the internet.

Affected Platform: Windows OS

How to check if your computer is infected with runonce.exe malware?

Keep an eye for the following symptoms to see if your PC is infected with runonce.exe malware:

Internet connection fluctuates
runonce.exe takes too much CPU space
PC slows down significantly
Browser automatically redirects to some irrelevant websites
Unsolicited ads and popups starts appearing
Screen freezes constantly

If your PC is infected with runonce.exe malware, it will invite other malwares to cause more damage to your computer. Take the following steps to diagnose your PC for possible runonce.exe malware attack:

Step 1: Simultaneously press CTRL+ALT+DEL keys to open Task Manager.

Step 2: If you notice the file located outside the file path C:\Windows\System32, then you should run an antivirus scan to get rid of the malware.

How to remove the runonce.exe file from system using Comodo Antivirus?

Step 1: Download the award-winning Free Internet Security.

Step 2: Installation configuration frames will be displayed. Select the configuration you would like to apply.

Step 3: Select Customize Configuration option and arrange installers, configuration, and file location.

Step 4: Restart your PC.

Step 5: It will take some time for the Comodo Internet Security to update the antivirus.

Step 6: Proceed with a quick scan that automatically begins after the update.

Step 7: If threats are found during the scanning, you will be prompted with an alert screen.

Step 8: Comodo Antivirus will remove the runonce.exe virus from your computer including all other malwares!

Website Malware Directory Resources:

Related Resources:

Malware Entries

Safe Entries

First Seen: 23 October 2011 at 11:23 am

No.	Company	File Type	SHA1	MD5	Malware Name	Digitally Signed	File Version	Product Version	Submitted From	Malware Behavior
1	Корпорация Майкрософт	Executable	0fa9171ad46b06c5 3651e347a76e9f12 7a9e2ebf	e3aced9c119d5d30 9fd2d8520062d3d3	Virus.Win32. Sality.gen	No	6.00.2900. 2180 (xpsp_sp2_ rtm.040803 -2158)	6.00.2900. 2180	Ukraine	N/A
2	Корпорация Майкрософт	Executable	136802b9fb2b435e a9d19bab600af305 ac35b286	53ecef4d9bdbc618 ff93dd5a0433f886	Virus.Win32. Virut.Ce	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Russian Federation	N/A
3	Microsoft Corporation	Executable	69c3bf1eee6aa007 113441218be62e39 59dd4d94	1d407f34673474b7 5d2bae9a60e72299	Virus.Win32. Virut.CE	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	156.220.2.23/32	N/A
4	Microsoft Corporation	Executable	7371004a4bca0124 a352cbd84e7fa03e 18351f82	3102f9c31d83ae0b 229d96d521f58a04	Virus.Win32. Virut.CE	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Angola	N/A
5	Microsoft Corporation	Executable	89eb2ddb33413076 e80e9805a0e56ac1 cfa3b4bc	f3cf9aa109d8f7b2 66a813e6b7e1d849	Virus.Win32. Parite.gen	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Taiwan	N/A
6	Microsoft Corporation	Executable	df05d9ca74a59559 e3b01f26d0cc037e 68aa4caf	87b83e898c14df4c fe61f2c5f1722e82	Virus.Win32. Virut.CE	No	6.00.2900. 2180 (xpsp_sp2_ rtm.040803 -2158)	6.00.2900. 2180	Indonesia	N/A
7	Microsoft Corporation	Executable	0fca9a271f984c38 d7fbef0ce62ebdc9 11cb1a23	03ef5d29be88881c 7b9905403e6ab3a7	Virus.Win32. Virut.CE	No	6.1.7601.1 7514 (win7sp1_r tm.101119- 1850)	6.1.7601.1 7514	Morocco	N/A
8	Microsoft Corporation	Executable	6cec435b70989a7e a3c5ef5ffc66dcae 5680e2ef	9832835c83f737ce 664085994bcafb81	Virus.Win32. Virut.CE	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Egypt	N/A
9	N/A	Executable	14121f804176d016 64351e38d6ca3ba1 7ce1ae3f	4c663ea5f5c72ee3 65ce0be1a08696e2	Win32.Neshta .A	No	N/A	N/A	181.66.169.99/32	N/A
10	Microsoft Corporation	Executable	399b9c397d304cc8 1a5be3fc94e9b9c1 cc1434bf	6a25f816463b8b38 0601753eeebc850a	Virus.Win32. Virut.CE	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	102.41.88.6/32	N/A
11	Microsoft Corporation	Executable	a16d01838f253f03 d5c7fe141a422862 12eb82c2	bfc6d7f62eed4594 f7bf1bc864c58b23	Virus.Win32. Virut.CE	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Poland	N/A
12	Microsoft Corporation	Executable	9ed351a79750a67a d059894cb6e97d04 ece6457f	a74b4eeaa61cf822 f23564de4eddf34c	Virus.Win32. Virut.Ce	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	10.224.1.116/32	N/A
13	Microsoft Corporation	Executable	0c57e93e67d1a605 d565805ed9565b2c ec1bd6a0	5b4c4d5a6f072b5e de0020b1a5c6a5d5	Virus.Win32. Virut.CE	No	6.0.6001.1 8000 (longhorn_ rtm.080118 -1840)	6.0.6001.1 8000	United States	N/A
14	Microsoft Corporation	Executable	6321517d16482494 4621405c572b3bc8 9a0d3999	7fb3dedfb4b2f19f 3269b0bdfc5f9749	Virus.Win32. Parite.gen	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Bulgaria	N/A
15	Microsoft Corporation	Executable	7f25cfbf0e331cf3 3831cecce112f69f 0ef901c0	4673879c50e9f763 7482f4ac0eabc84b	Virus.Win32. Virut.CE	No	6.1.7600.1 6385 (win7_rtm. 090713-125 5)	6.1.7600.1 6385	Indonesia	N/A
16	N/A	Executable	af90218fc7f7026f 6182d95104fa747b f652229f	f4dafd2cf5c112c7 a5b421369565a048	Virus.Win32. Virut.CE	No	N/A	N/A	197.39.113.130/32	N/A
17	Microsoft Corporation	Executable	f1b61b286c4ac8f5 f629490f5e037f12 34210895	30978ed939a24dde fde92314e68cbdce	Virus.Win32. Virut.CE	No	6.1.7601.1 7514 (win7sp1_r tm.101119- 1850)	6.1.7601.1 7514	Pakistan	N/A
18	Microsoft Corporation	Executable	7d0a899aedcd0432 8229a5ccf70cc3d8 efa4e8bc	4b3f1cf98613d631 60a9fbf4face7370	Virus.Win32. Virut.CE	No	6.1.7600.1 6385 (win7_rtm. 090713-125 5)	6.1.7600.1 6385	South Africa	N/A
19	Microsoft Corporation	Executable	6b8bc2d5a18cbf7b b1f27954f3bbccbc a5a1a0d6	343bde70a618d3e1 d70e40fb56bbba1e	Virus.Win32. Virut.CE	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	India	N/A
20	Microsoft Corporation	Executable	28f04a7a7f5bf04a f32b42e921c402bd 69e7abaf	1e8d43b47b7634c7 7be4b7c3f2cb6262	Virus.Win32. Virut.BV	No	6.00.2900. 2180 (xpsp_sp2_ rtm.040803 -2158)	6.00.2900. 2180	Angola	N/A
21	Microsoft Corporation	Executable	7973dd11c0449d6e d2d77560780afa71 51db9663	c8f8ac4ab708a850 1157efb0a8156798	Virus.Win32. Virut.CE	No	6.00.2900. 2180 (xpsp_sp2_ rtm.040803 -2158)	6.00.2900. 2180	Egypt	N/A
22	Корпорация Майкрософт	Executable	e79578c23a371ea3 7312cf3bd8be7094 29742d59	36d7fd0baa7a2867 78b796e90a8e8a12	Virus.Win32. Virut.CE	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Ukraine	N/A
23	Microsoft Corporation	Executable	aeab8642f04726c9 149e74c609c52a7f 5e36b2d6	1ce1664f68bce98a 37aa9ba0c64c45d8	Virus.Win32. Virut.CE	No	6.00.2900. 2180 (xpsp_sp2_ rtm.040803 -2158)	6.00.2900. 2180	Poland	N/A
24	Microsoft Corporation	Executable	ffa5feebfa00ca0f 2efb1dc804c670d3 ef129e2a	8fb860f01b52223e 01496b39d5fff317	Virus.Win32. Virut.CE	No	6.1.7600.1 6385 (win7_rtm. 090713-125 5)	6.1.7600.1 6385	South Africa	N/A
25	N/A	Executable	a0384f8fa52e6037 a4c73c4f6d32d266 4d0c11d3	d383104a457502b6 2cbb9dd360d95906	Win32.Neshta .A	No	N/A	N/A	Turkey	N/A
26	Microsoft Corporation	Executable	98926c561e082cbd 0ad6a51116ca2ae9 c1f56fb1	78232bc5fe565412 89e58a02cc23bb0e	Worm.Win32.M abezat.b7	No	6.00.3790. 1830 (srv03_sp1 _rtm.05032 4-1447)	6.00.3790. 1830	37.124.143.163/32	N/A
27	Корпорация Майкрософт	Executable	1f0940f548268668 54a55f6ccbe398d8 75bef765	93ea17c3e94cb7e4 f2c6401409bb7c68	MalCrypt.Ind us!	No	6.00.2900. 2180 (xpsp_sp2_ rtm.040803 -2158)	6.00.2900. 2180	Russian Federation	N/A
28	Корпорация Майкрософт	Executable	1d783373e266fbee ab979caa3731dacb 21561a4a	252d545e9d8c8280 ead78e38f9fbf0dd	Virus.Win32. Sality.gen	No	6.00.2900. 2180 (xpsp_sp2_ rtm.040803 -2158)	6.00.2900. 2180	Ukraine	N/A
29	Microsoft Corporation	Executable	7bc0f81b8d3a85bc c917a7f121696997 44490469	4c0a76afa27c8132 33599846842cbefe	Virus.Win32. Virut.CE	No	6.1.7601.1 7514 (win7sp1_r tm.101119- 1850)	6.1.7601.1 7514	Pakistan	N/A
30	Microsoft Corporation	Executable	d5456b725b767da5 a6a647792c0c88fa 939cf55f	10e8959f30fcd41e 099f0d0857aacdb3	Virus.Win32. Virut.CE	No	6.1.7600.1 6385 (win7_rtm. 090713-125 5)	6.1.7600.1 6385	154.160.21.150/32	N/A
31	Корпорация Майкрософт	Executable	1828d588218f051f c80a1dd12ef20f29 20a32aba	a2be58828a9a40e5 8ca5d1daec5b047d	Virus.Win32. Expiro.R0	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Ukraine	N/A

Prev 1 2 3...8 Next

Display 4 items per page

4 items per page
8 items per page
16 items per page
32 items per page

Safe Entries

First Seen: 23 November 2008 at 4:30 am

No.	Company	File Type	SHA1	MD5	Digitally Signed	File Version	Product Version	Submitted From
1	Microsoft Corporation	Executable	cd71c30532a4f74a 1bae79dac6c76dba ffbb0c72	1dd3b5ea7926057f 944e980fd679246a	No	10.0.19041 .3636 (WinBuild. 160101.080 0)	10.0.19041 .3636	United States
2	Microsoft Corporation	Executable	6bef27a0bf764735 f501547dedd09906 f74c7618	617cc7c2bfce4117 0bbadc25c785beeb	No	6.00.2600. 0000 (xpclient. 010817-114 8)	6.00.2600. 0000	Internal Submission
3	Корпорация Майкрософт	Executable	767d432cf654db69 8222e3b9c1f7ab21 c3dba9fc	8ed18e70049ed07c ea5c7fa39f6b7f33	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	Kazakhstan
4	Microsoft Corporation	Executable	4d6e1ee474c9e700 076193ea7826ab6f 3beab397	e86d73b48f65501f c47c1283798b7625	No	6.00.2900. 5512 (xpsp.0804 13-2105)	6.00.2900. 5512	145.255.148.244/32
5	N/A	Non-executable	32431e7411d47e5e 48987f25b956eb4d 59ad1d59	84923928d9ac71f6 c2669fca116c120e	No	N/A	N/A	United States
6	Microsoft Corporation	Executable	006ea21bca1b9dd5 1c5045f6d3ff5bf3 b6aa3630	6d29543c62bd1bea 61e5db434794f9d1	No	6.00.2800. 1106 (xpsp1.020 828-1920)	6.00.2800. 1106	Canada
7	Beijing Rising Information Technology Co., Ltd.	Executable	f2ebba443aba8f5e b76a6101307815bf 00799314	37fcc31aadc86dcd d34fc99726eb1bb5	Yes	19, 0, 0, 3	19, 0, 0, 3	10.224.1.61/32
8	Microsoft Corporation	Executable	6ea609fd026d5e1a b7989063df91a9a4 54a5c078	e8b2634a22060edd 4a5f9b7e500c527c	No	10.0.19041 .3570 (WinBuild. 160101.080 0)	10.0.19041 .3570	United States
9	Beijing Rising Information Technology Co., Ltd.	Executable	c20c27567825bc1a 76e4c54eb24336c8 36e7f441	5afa66feff2da5eb d209ce0ddb2f7814	Yes	19, 0, 0, 3	19, 0, 0, 3	Internal Submission
10	Microsoft Corporation	Executable	4d75b023f4914b52 24b4db08fd03ab00 34d28e41	918087b8dc6ae504 918cdb986ab59e37	No	10.0.19041 .3636 (WinBuild. 160101.080 0)	10.0.19041 .3636	United States
11	Microsoft Corporation	Executable	1478dc8635b564c7 40103c6a8ff5caf8 374da0a0	ec798c94932a86c0 1742220825073416	No	10.0.19041 .1 (WinBuild. 160101.080 0)	10.0.19041 .1	104.238.128.144/32
12	Microsoft Corporation	Executable	c4725908a78f8520 24b323ab51bd2544 ef383ec2	d11a40e523ac5c4b 68aa05f0fcb0b493	No	10.0.17666 .1000 (WinBuild. 160101.080 0)	10.0.17666 .1000	Canada
13	N/A	Non-executable	9a0b9a6603562971 1f3777e11cfef28e d3fdccac	0a49e4f9fbf40bd8 67633b2190f44dce	No	N/A	N/A	United States
14	Microsoft Corporation	Executable	2fc4cf44e71d2752 f9d2b2dfee835678 e4326e0d	b0601d161fc575e7 931f08264ceb27e1	No	10.0.22468 .1000 (WinBuild. 160101.080 0)	10.0.22468 .1000	United States
15	N/A	Executable	2a08e25a8f290881 dbb029bbc8e0c98e 604f427e	e672ba1d39eea438 36db8df5fd707ce0	No	N/A	N/A	10.224.1.22/32
16	Microsoft Corporation	Executable	9856dadd0f49b00c 72524e0233a8bf02 7374dadf	a368c8afdaeb269f 48e8d7a006ee6a15	No	10.0.19041 .1 (WinBuild. 160101.080 0)	10.0.19041 .1	United States
17	N/A	Non-executable	d6696eafdc72fa09 b310caafab6edcef 6c3e4ce9	195774d29e707776 1d2e3b8be89c41af	No	N/A	N/A	United States

Prev 1 2 3...5 Next

Display 4 items per page

4 items per page
8 items per page
16 items per page
32 items per page

Malware Search Engine

How to Remove “runonce.exe”

What is runonce.exe?

How to check if your computer is infected with runonce.exe malware?