Fix: runonce.exe Black Screen

Some users have been dealing with a black screen during the login procedure. Upon investigations, some users have discovered a suspect runonce.exe application running inside Task Manager. If the process is closed, the black screen disappears and Windows manages to load the remaining components. This particular issue can either be caused by a known Windows 7 bug or by a virus infection.

Most of the time, this issue starts manifesting after the user mistakenly installs the Vosteran malware (trojan) thinking he’s installing Adobe Reader. Other spyware programs that are known to cause this issue are Jamenize and Binkiland. If the issue is a symptom of a malware infection, removing the infection will fix the black screen issue caused by runonce.exe process.

If you’re currently struggling with this issue, let’s start by making sure your system is not suffering from a virus infection (Method 1). If you establish that your system is free of malware, you can begin making the appropriate steps to get around the Windows 7 bug (Method 2).

Keep in mind that both methods presented below are based on solutions provided by other users finding themselves in the same situation as yourself. Please follow the two methods as intended (in order) and go through each step until you resolve the black screen issue caused by the runonce.exe process. Let’s begin!

Method 1: Dealing with a malware infection

Before you start following the fix aimed at allowing users to get past the Windows 7 bug, it’s important to make sure that the issue is not caused by a virus infection. Ignoring this step might make you look past the virus infection and leave your system vulnerable to future attacks and information leaks.

Let’s make sure that your system your system is not infected. Here’s a quick guide to making sure that the black screen issue caused by the runonce.exe is not a symptom of an infection:

1. Open a Run window (Windows key + R), type “appwiz.cpl” and hit Enter in order to open Programs and Features. 
2. In Programs and Features, look through your program’s list for a Vosteran, Jamenize or Binkiland entry and uninstall every occurrence from your system. Once the malware’s installation files are uninstalled, pop up another Run window (Windows key + R), type “regedit” and hit Enter to open Registry Editor.
   
3. In Registry Editor, use the left pane to navigate to Computer > HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > RunOnce, then move over to the right pane.
   
4. Now on the right-pane, delete every key that is not named (Default). You can do this by right-clicking each key and choosing Delete. Repeat this process systematically until you’re only left with the (Default) key. At this point, you can safely close Registry Editor.
   Note: Keep in mind that if you remove the malicious keys without continuing with the steps below, the malware will likely regenerate the deleted keys.
5. Next, perform a system-wide scan with your active security suite in order to make sure that you remove every occurrence of the virus infection.
   Note: If your active security suite isn’t able to identify any additional infected files, we recommend double-checking by scanning again with a powerful anti-spyware like Malwarebytes. To make it easier, follow our in-depth article (here) on removing malware with Malwarebytes.
6. Once the scan is complete and the threats eliminated, reboot your computer and see if the black screen returns. If the issue was caused by a virus infection, the issue should be eliminated completely.

In case this method wasn’t efficient in getting rid of the black login screen caused by the runonce.exe process, proceed to Method 2 for steps on getting around the Windows 7 bug.

Method 2: Prevent runonce from opening via msconfig (Windows 7)

If you’re looking for a quick and easy fix around this Windows 7 bug, the easiest way to remove the issue is to pop open System configuration and prevent the runonce.exe process from ever opening. This method was successful in helping a lot of Windows 7 users to avoid the popular runonce.exe bug.

Microsoft has already addressed this bug on Windows 7 via a hotfix, so if you want to avoid going through the steps below you can use Windows Update (WU) to bring your system up to date, then restart your system. The bug should automatically be addressed once all the pending updates are applied.

Note: Keep in mind that this does not treat the symptoms of the issue and should not be used in case you’re dealing with a malicious file. With this in mind, only follow the steps below if you previously determined that the runonce.exe process is not malicious.

If you decide to prevent runonce.exe from opening at system startup, here’s what you need to do:

1. Press Windows key + R to open up a Run window. Type “msconfig” and hit Enter to open System Configuration.
   
2. In the System Configuration window, go to the Services tab and scroll down through the list to find the RunOnce service. Once you manage to identify it, uncheck the box associated with it in order to prevent the service from opening at startup and hit Apply.
3. Reboot your system and see whether the black screen issue caused by the runonce.exe process is solved.