Run Once Wrapper

[Tastrom]

After I have logged in my desktop turns black. Mouse is working and I can start the Taskmanager. When I delete a process called Run Once Wrapper (runonce.exe) I get back the normal desktop and the PC seems to work OK. I have scanned for virus and malware, found no problem. According to HP is this problem caused by a virus.

Tom

[DavidPK]

Hi Tom,

Stop the process running as you've already done using Taskmanager, then download and run Autoruns on the following link.

https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Look at what's trying to be launched from the RunOnce wrapper - there will probably be 2 similar entries, one starting HKLM and the other starting HKCU.

Post back with what's listed.

Regards,

DP-K

[marcycn]

I don't have an HP but I've been searching for a solution to the runonce.exe file ALL day!  I was having to do exactly what Tom was doing.  There is a lot of info out there that just doesn't work.  I found this tonight and ran the autoruns and searched for runonce and there it was.  I unchecked it, (had to do it as administrator) along with a few others that I don't want to run (as long as I was there 🙂 and rebooted.  IT WORKED!!  Runonce is no where to be found.

I didn't find HKLM or HKCU though.  Oh well, I'm happy and you are a life saver.  🙂

[DavidPK]

Good to hear

All the best,

DP-K

[Tastrom]

Hi,

Here is the result.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2015-02-12 12:36

Binkiland c:\users\tom\appdata\roaming\binkiland\updateproc\bkup.dat 2015-02-10 17:05

It looks like a program Binkiland is started  by RunOnce.

Regards

Tom

[DavidPK · Accepted solution]

Hi Tom,

Right click on Autoruns and select 'Run as Administrator' to launch the application and then remove the tick next to the entry:

Binkiland c:\users\tom\appdata\roaming\binkiland\updateproc\bkup.dat 2015-02-10 17:05

Close Autoruns and restart the notebook - does it boot to the Desktop normally now?

Regards,

DP-K

[Tastrom]

Yes!

Thank you.

Tom

[DavidPK]

Hi Tom,

You're welcome

I would suggest downloading AdwCleaner on the following link to clear up the associated files - save it to your Downloads folder.

https://toolslib.net/downloads/finish/1/

When downloaded, close all open programs, open your Downloads folder and double click the application to run it ( click yes to any uac prompt ).

Click the Scan button.

When the results are displayed, click the Clean button - when prompted to restart, click Ok.

Best regards,

DP-K

[marcycn]

FYI - be careful.

The latest trend in the awful Windows ecosystem is pretty ridiculous — scammers have a fake version of the reputable AdwCleaner tool, which is a real tool for Windows experts. And this one pretends your computer is infected and tries to make you pay them to remove it.

AdwCleaner is indeed a real freeware tool, with a good reputation for removing spyware and adware. It’s not as well known as MalwareBytes because it’s not all that user friendly, since it is meant for Windows experts rather than regular users. And the scammers have tried to mimic the interface, stealing the logo, and even ripping out the icon (badly) for their fake version.

Fake AdwCleaner is Being Distributed Through Adware Infections

To read the whol article go here:

http://www.howtogeek.com/209654/scammers-are-using-a-fake-version-of-adwcleaner-to-trick-people/

Always something isn't it?  😞

[frustrated371]

Please help, I am having the same issue but have done what you have suggested but the runonce is not appearing when I run autoruns as adminstrator.

What make sthings worse is my laptop is less then a month old!