OneBrowser Removal: OB Browser, Services, and Leftovers

OneBrowser, also seen as OB Browser, should be removed like a potentially unwanted browser, not like a normal cache cleanup. The easiest path is to scan with Gridinsoft Anti-Malware, quarantine OneBrowser detections, reboot, and rescan. The manual path is longer: uninstall OB, stop updater services and tasks, remove confirmed OB folders, then inspect registry and firewall leftovers. Deleting only visible cache files can leave onebupdate, obupdate, or OBUpdate able to restore parts of the browser.

Gridinsoft detects PUP.FPL.OneBrowser.dd around OB Browser components such as %LocalAppData%\OB\ and browser-profile leftovers. A complete cleanup may also need to check install folders, uninstall entries, updater services, scheduled tasks, and firewall rules. That is why the useful cleanup path is a full OneBrowser remediation checklist, not just “clear AppData.”

Choose the cleanup path

If you want the safer and faster route, use Gridinsoft Anti-Malware to detect OneBrowser components, quarantine them, reboot, and scan again. This is the better option when you are not comfortable with Services, Task Scheduler, Registry Editor, or firewall-rule cleanup.

Manual removal is possible, but it is more error-prone. You need to confirm every item before deleting it: the installed app entry, updater services, scheduled tasks, %ProgramFiles(x86)%\OB\, %LocalAppData%\OB\, uninstall keys, app-path keys, and any firewall rules that point to an OB executable. Do not delete registry branches or system task folders broadly.

What is OneBrowser or OB Browser?

OneBrowser is a Chromium-style browser/PUP family that can leave a browser profile, updater components, uninstall entries, services, scheduled tasks, and browser data behind. On a live PC, users usually notice it because OneBrowser or OB appears in installed apps, because OBUpdateService.exe or an update service keeps running, or because a security tool detects OneBrowser-related files after the user thought the program was gone.

Do not treat every browser-profile file as malicious by itself. Files such as Local State, Crashpad, ShaderCache, or component_crx_cache are normal Chromium-style data names. The problem is ownership and persistence: if those folders belong to OB Browser and the browser is unwanted, clean the app and its updater path rather than deleting random cache folders from Chrome or Edge.

Uninstall OB or OneBrowser first

Open Settings -> Apps -> Installed apps and search for OB, OneBrowser, One Browser, or OneBrowser Update. If an uninstall entry is present, use it before manual deletion. Close browsers and save work first because the uninstaller may close an OB process or updater.

If you see OneBrowser or other suspicious applications that you don't remember installing, you should remove them as well.

After uninstalling, reboot once. A reboot releases locked files and makes persistence checks clearer. If the entry refuses to uninstall, disappears without removing files, or reappears after reboot, continue with the updater, task, and folder checks below.

Stop OneBrowser updater services and tasks

OneBrowser cleanup often fails when an updater is still active. Check Services, Task Scheduler, and the task file before deleting folders. OneBrowser-related names to check include:

• HKLM\SYSTEM\ControlSet001\Services\onebupdate
• HKLM\SYSTEM\ControlSet001\Services\obupdate
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OBUpdate
• C:\Windows\System32\Tasks\OneBUpdate

If you are not comfortable editing services or tasks manually, scan instead of experimenting in the registry. If you do check manually, prefer viewing first. In an elevated Command Prompt, these read-only checks are safer than deleting keys immediately:

sc query onebupdate
sc query obupdate
schtasks /Query /TN OBUpdate

If those entries exist after the OneBrowser uninstall, stop the service or disable the task before deleting folders. Do not remove unrelated Windows services. Similar-looking names that do not contain OB, OneBrowser, or OneBUpdate should be verified before action.

Files and folders to check

Only remove these paths when they clearly belong to OneBrowser/OB Browser and after the app, updater, and browser processes are closed. Replace environment variables with your own Windows paths; do not delete the parent AppData, Program Files, or User Data folder.

Common OB user-profile leftovers under %LocalAppData%\OB\User Data\ include:

• Local State
• Variations
• BrowserMetrics\
• Crashpad\metadata, Crashpad\settings.dat, and Crashpad\reports\*.dmp
• ShaderCache\, GrShaderCache\, and GraphiteDawnCache\
• component_crx_cache\

Those paths help confirm that the leftovers belong to OB Browser. They are not a reason to delete the same-named folders from a legitimate Chrome, Edge, Brave, or Vivaldi profile.

Registry keys that can confirm persistence

Use the registry as a confirmation source, not as the first cleanup step. Export a backup of any key before deleting it, and avoid broad search-and-delete actions. OneBrowser-related keys to look for include:

• HKLM\SOFTWARE\WOW6432Node\OB
• HKCU\SOFTWARE\OIB
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OB
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OB|UninstallString
• HKU\...\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OB|UninstallString
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OneBrowser
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OneBrowser|UninstallString
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneBrowser.exe
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneBrowser.exe|(Default)
• HKLM\Software\Microsoft\Active Setup\Installed Components\{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

Firewall-rule leftovers may also appear under HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules. Treat random firewall-rule GUIDs carefully: confirm that the value points to an OB or OneBrowser executable before removing it. GUIDs by themselves are not enough to identify a malicious rule.

Check browser extensions and profiles

After removing OneBrowser itself, check Chrome, Edge, Firefox, and any browser you actually use. Look for unknown extensions, forced search engines, startup pages, notification permissions, and “managed by your organization” policies you did not set. Do not mark the extension ID bojobppfploabceghnmlahpoonbcbacn as malicious by name alone; current public results associate that exact ID with Malwarebytes Browser Guard, so verify the extension name, publisher, source, and install time before action.

Open Extensions/Add-ons again and remove any entry linked to OneBrowser or clearly out of place.

If search or homepage settings still change after removing OB, follow the broader browser hijacker removal guide. If the symptom is extra tabs opening by themselves, use the multiple-tabs troubleshooting flow. If OneBrowser arrived with a cleaner, optimizer, archive, or bundle installer, check the PUP cleanup pattern for system utilities as well.

Scan for leftovers that make OneBrowser return

If %ProgramFiles(x86)%\OB\, %LocalAppData%\OB\, onebupdate, obupdate, or OBUpdate returns after reboot, treat the case as more than leftover cache. A full Gridinsoft Anti-Malware scan can check for detections, hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and persistence that a manual uninstall may miss.

When the scan is complete, quarantine detections, reboot, and scan again if the same files or tasks return. If the browser stored important bookmarks or passwords, export only what you need before deleting the OB profile and do not import extensions or settings wholesale into a clean browser.

What not to delete

• Do not delete the parent %LocalAppData%, %ProgramFiles(x86)%, or C:\Windows\System32\Tasks folder.
• Do not delete Chrome, Edge, Brave, or Firefox User Data folders just because OB has a folder with the same Chromium-style names.
• Do not run setup.exe from the OB installer folder to “repair” the browser unless you intentionally want it installed.
• Do not remove firewall rules by GUID until the rule value points to an OB or OneBrowser executable.
• Do not trust a browser extension or updater because its name looks familiar; check publisher, path, and install source.

FAQ

References

1. Microsoft Learn. “sc query.” Microsoft, accessed June 25, 2026. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query
2. Microsoft Learn. “schtasks query.” Microsoft, accessed June 25, 2026. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-query