Removing a Trojan Hidden in Windows RunOnce Registry Keys

A Trojan can use Windows Registry RunOnce entries to launch itself the next time a user signs in. This persistence method is simple, quiet and frequently paired with a dropped executable, a scheduled task or a browser modification. Removing the visible registry value without dealing with the associated file can allow the infection to return.

The safest process combines malware scanning, careful registry inspection and verification after a restart. These instructions apply mainly to Windows 10 and Windows 11 computers, including systems used in Australian homes, schools and small businesses. The information is educational; it does not replace professional incident response for a compromised business network.

How RunOnce Persistence Works

The relevant registry locations are usually:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

A 32-bit Trojan on 64-bit Windows may instead appear under HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce. Values in the user hive affect one account, while entries in the machine hive can affect every user and generally require administrator rights.

RunOnce is intended for legitimate one-time setup operations, so its presence is not automatic proof of infection. A value pointing to a recently created file in AppData, Temp or an oddly named folder is more suspicious than a recognisable installer. Security news about changing malware tactics can help explain why a familiar Windows mechanism is being abused, including the reporting collected in security news.

Prepare Windows Before Editing The Registry

Disconnect the computer from the internet if the Trojan is actively downloading files, stealing information or displaying remote-control behaviour. Unplug Ethernet or disable Wi-Fi, but leave the device powered on long enough to save evidence such as the suspicious value name and file path. On a personal computer, avoid signing into banking, email or cryptocurrency services until the system has been checked.

Create a restore point and export any registry key before changing it. Press Win + R, enter regedit, and browse to the relevant RunOnce key. Right-click the key, choose Export, and save the backup somewhere separate from the suspicious file. Do not import registry files from random forums or delete an entire key because one value looks unfamiliar.

Run a full scan with Microsoft Defender, then use Microsoft Defender Offline if the threat keeps returning. Offline scanning starts outside the normal Windows session, making it harder for a protected Trojan to interfere. In Australia, the Australian Cyber Security Centre is a useful reference for general incident-response advice, while Scamwatch guidance is relevant if the infection followed a fake parcel, tax or banking message.

Locate And Remove The Malicious Entry

Open Registry Editor as an administrator and inspect the three RunOnce paths. Look at the Data field rather than judging only the value name. Malware often uses random characters, misleading names such as WindowsUpdate, or a command that launches PowerShell, wscript.exe, mshta.exe, rundll32.exe or a file from a user-writable directory.

Before deleting a value, copy its complete command and check the referenced file’s properties. A valid Windows component normally has a consistent publisher, sensible location and a Microsoft signature, although signatures can be forged or stolen. Uploading a suspicious file to a reputable multi-engine scanner may expose a known detection, but do not submit documents containing private Australian tax, identity or business information.

Quarantine or delete the malicious executable with Defender or another trusted security product first. Then return to Registry Editor, right-click only the confirmed malicious value and choose Delete. If Windows reports that the key is protected, use an administrator account or remove the entry in Safe Mode rather than changing ownership and weakening permissions.

Check Other Places The Trojan May Hide

A RunOnce value is often just the first launch point. Inspect Task Manager > Startup apps, the Startup folders, scheduled tasks and browser extensions. Also review HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and the equivalent machine-level Run key, because a Trojan may copy itself from a one-time entry into a permanent startup location.

Microsoft Sysinternals Autoruns can provide a broader view of logon, services, drivers, scheduled tasks and other auto-start locations. Enable verification options where available, hide signed Microsoft entries, and research each unfamiliar item before disabling it. A clean-looking RunOnce key does not prove that the computer is safe if a service or scheduled task recreates the entry.

Restart normally and watch whether the suspicious file, pop-up, browser redirect or registry value returns. Run another full scan after the reboot and check Windows Security’s protection history. If the Trojan reappears, use Safe Mode or Defender Offline, then scan from a trusted rescue environment. A system used for work in Sydney, Melbourne or a regional office should be isolated from shared drives until persistence has been ruled out.

Protect Accounts And Personal Files

Treat a persistent Trojan as a possible credential-stealing incident. From a separate, trusted device, change email, banking, social media and workplace passwords, beginning with the most important accounts. Enable multifactor authentication, review active sessions and contact a bank immediately if payment details may have been exposed. Australian users should also monitor unexpected myGov, payment or delivery-related activity.

Copy essential documents only after scanning them, and keep at least one backup disconnected from the computer. Do not rely on a backup made while the infection was active. If files were encrypted or renamed, avoid rushing to pay a ransom; preserve a sample and the ransom note, because recovery options differ by malware family. The VirLock recovery guide illustrates why identifying the specific threat matters before attempting restoration.

Mac users should follow platform-specific procedures rather than applying Windows registry instructions. Security information for Apple computers, including relevant removal and prevention practices, is available in Mac malware guidance.

Choose The Right Cleanup Method

The best approach depends on whether the suspicious entry is clearly identified, whether the malware has administrator access and whether the computer contains sensitive data. Manual editing is suitable for a knowledgeable home user dealing with one confirmed value, while a broader scan is preferable when several persistence mechanisms are present.

Method	Best Use	Main Benefit	Important Limitation
Microsoft Defender full scan	Common home infections	Built into supported Windows systems	May miss a new or heavily obfuscated threat
Defender Offline	Malware that restarts or blocks scans	Runs outside the normal Windows session	Requires a restart and may need recovery access
Autoruns review	Multiple startup locations	Shows a wide range of auto-start entries	Requires careful research to avoid disabling legitimate software
Professional incident response	Business, financial or identity compromise	Preserves evidence and checks broader exposure	Costs more than routine home cleanup

After cleanup, install Windows updates, update browsers and remove pirated or unsupported software that may have delivered the Trojan. Keep Defender protections enabled, use standard user accounts for daily work and treat unsolicited remote-support calls as suspicious. These habits are especially valuable in the Australian market, where fake bank, parcel and government notices commonly imitate trusted brands.