The genuine runonce.exe file is a software component of Microsoft Windows Operating System by Microsoft Corporation. "Runonce.exe" is a Microsoft Windows Operating System component program, called the "Run Once Wrapper Utility," that should not be removed. It should reside in "C:\Windows\System32". It can be executed as a command line utility, usually with its optional parameter, "/AlternateShellStartup", within a user session and often by putting it in a user's logon script, to trigger Active Setup. When a user logs into a Remote Desktop Services session from a client computer to use published applications located on the server, the instance of "Explorer.exe" that acts as the shell and shows the desktop and is responsible for Active Setup specifically does not execute on the server within that session. This means that the Registry's "Run" and "RunOnce" keys are not consulted at logon and the environment that the published application needs may not get set up. The "Run Once Wrapper Utility" compensates for this difference.
RunOnce stands for RunOnce Wrapper Utility
The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the runonce.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.
Description: The original runonce.exe from Microsoft is an important part of Windows, but often causes problems. Runonce.exe is located in the C:\Windows\System32 folder.
Known file sizes on Windows 10/11/7 are 50,688 bytes (61% of all occurrences), 48,640 bytes, 47,104 bytes, 34,816 bytes or 36,864 bytes.
It is a Windows system file. The program has no visible window. The runonce.exe file is a trustworthy file from Microsoft.
Therefore the technical security rating is 2% dangerous; however you should also read the user reviews.
Is runonce.exe a virus? No, it is not. The true runonce.exe file is a safe Microsoft Windows system process, called "Run Once Wrapper".
However, writers of malware programs, such as viruses, worms, and Trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are e.g. Backdoor:Win32/Fynloski.A (detected by Microsoft), and Backdoor.Win32.DarkKomet.aaco (detected by Kaspersky).
To ensure that no rogue runonce.exe is running on your PC, click here to run a Free Virus Scan.
How to recognize suspicious variants?
If runonce.exe is located in a subfolder of C:\Windows, the security rating is 1% dangerous. The file size is 50,688 bytes (37% of all occurrences), 33,792 bytes, 34,816 bytes, 47,104 bytes or 36,864 bytes.
The file is a Windows core system file. The program is not visible. The runonce.exe file is a Microsoft signed file.
If runonce.exe is located in a subfolder of the user's profile folder, the security rating is 78% dangerous. The file size is 674,816 bytes.
Runonce.exe is not a Windows core file. The program has no visible window. The software starts upon Windows startup (see Registry key: Run).
Runonce.exe is able to monitor applications, record keyboard and mouse inputs and manipulate other programs.
If runonce.exe is located in a subfolder of Windows folder for temporary files, the security rating is 78% dangerous. The file size is 674,816 bytes.
External information from Paul Collins: There are different files with the same name:
"mdac_runonce" is not required to run at start up. Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe".
"RunOnce" can run at start up. Part of MS Data Access Components - only required if you use these
Important: Some malware disguises itself as runonce.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the runonce.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.
Score
User Comments
It was duplicated in my SysWOW64 and cause my PC to blackscreen. By pushing control and Alt and Del I got to Task Manager and when I ended it my PC windows screen came back. I deleted it from the sysWOW64 location PD
After system turned on, when i clicked on user login, screen went blank, i pressed Alt+Ctrl+Del and opened taskmanager(processes tab) and found runonce.exe which i didn't find earlier, so when i selected this and clicked on "End Process" iam am able to login and i can see my desktop. Rama Krishna
It destroys my files terminate intalled programs. And so on donrapheal
i think it is a virus because for one thing it kept my pc from booting and when it does boot it give me a blue screen. maybe i got it from that free wifi at motel 6 Ethan Frohm
Responsible for loading a bad network driver that causes Windows 10 to install as "Personal Server" with Enterprise Apps, enrolls you as an Azure "client", & orphans your PC. Small part of a large multi-hack out since 2012. Mack Bolan
C:\Windows\SysWOW64\runonce.exe my firewall found it in this directory. Saeb Khanzadeh
Seems safe and used by Windows. It doesn't appear to do much, and hasn't done anything harmful to my computer. Probably still good to make sure that's from C:/Windows/System32 anonymous
Summary: Average user rating of runonce.exe:
based on 15 votes with 7 user comments.
3 users think runonce.exe is essential for Windows or an installed application.
5 users think it's probably harmless.
One user thinks it's neither essential nor dangerous.
One user suspects danger.
5 users think runonce.exe is dangerous and recommend removing it.
2 users don't grade runonce.exe ("not sure about it").
Best practices for resolving runonce issues
A clean and tidy computer is the key requirement for avoiding problems with runonce. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.
Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.
To get your computer running as fast as it did on day one, you can 8reset your PC. Your personal files will remain intact, but any programs you installed will need to be reinstalled.
To help you analyze the runonce.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. A good Bantivirus software detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.
Score
User Comments
PD
Rama Krishna
donrapheal
Ethan Frohm
Mack Bolan
Saeb Khanzadeh
anonymous
Summary: Average user rating of runonce.exe: based on 15 votes with 7 user comments. 3 users think runonce.exe is essential for Windows or an installed application. 5 users think it's probably harmless. One user thinks it's neither essential nor dangerous. One user suspects danger. 5 users think runonce.exe is dangerous and recommend removing it. 2 users don't grade runonce.exe ("not sure about it").