OneBrowser Removal: Delete OneBUpdate and OB Leftovers

OneBrowser and its OneBUpdate updater should be removed together. OneBUpdate is not a Windows component: under a confirmed OB install, OneBUpdateService.exe, an updater service, or a scheduled task can restore files after the visible browser is gone. The easiest path is to scan with Gridinsoft Anti-Malware, quarantine OneBrowser/OIBrowser detections, reboot, and rescan. For manual cleanup, uninstall OB or OIB first, stop only confirmed updater services and tasks, remove OB-owned folders, and then check registry and default-app leftovers.

Gridinsoft detects PUP.FPL.OneBrowser.dd, PUP.Win32.OneBrowser.dd!c, and PUP.rHeur.OneBrowser.dd around OB Browser components such as %LocalAppData%\OB\, %LocalAppData%\OB\OneBUpdate\OneBUpdateService.exe, and browser-profile leftovers. Recent OIB-style variants can also expose %ProgramFiles(x86)%\OIB\Application\, oibrowser.exe, oibupdate, chrome_elf.dll, chrome_proxy.exe, or notification_helper.exe under the unwanted browser folder. A complete cleanup may also need to check install folders, uninstall entries, updater services, scheduled tasks, and firewall rules. That is why the useful cleanup path is a full OneBrowser/OIBrowser remediation checklist, not just “clear AppData.”

Choose the cleanup path

If you want the safer and faster route, use Gridinsoft Anti-Malware to detect OneBrowser components, quarantine them, reboot, and scan again. This is the better option when you are not comfortable with Services, Task Scheduler, Registry Editor, or firewall-rule cleanup.

Manual removal is possible, but it is more error-prone. You need to confirm every item before deleting it: the installed app entry, updater services, scheduled tasks, %ProgramFiles(x86)%\OB\, %ProgramFiles(x86)%\OIB\, %LocalAppData%\OB\, uninstall keys, app-path keys, and any firewall rules that point to an OB or OIB executable. Do not delete registry branches or system task folders broadly.

What is OneBrowser or OB Browser?

OneBrowser is a Chromium-style browser/PUP family that can leave a browser profile, updater components, uninstall entries, services, scheduled tasks, and browser data behind. On a live PC, users usually notice it because OneBrowser, OB, or OIBrowser appears in installed apps, because OneBUpdateService.exe, OBUpdateService.exe, oibupdate, or another update service keeps running, or because a security tool detects OneBrowser-related files after the user thought the program was gone.

Do not treat every browser-profile file as malicious by itself. Files such as Local State, Crashpad, ShaderCache, chrome_elf.dll, chrome_proxy.exe, or component_crx_cache are normal Chromium-style names in the right vendor path. The problem is ownership and persistence: if those files sit under an unwanted OB/OIB browser folder, clean the app and its updater path rather than deleting random cache folders from Chrome or Edge.

What is OneBUpdate and why does it return?

OneBUpdate is the updater/persistence component associated with the OneBrowser or OB Browser install. Check the relationship by path and service name rather than filename alone. A process such as %LocalAppData%\OB\OneBUpdate\OneBUpdateService.exe, a onebupdate service, or C:\Windows\System32\Tasks\OneBUpdate task inside the same OB install is part of this cleanup lane. Remove the parent browser first, then disable the confirmed updater before deleting its folder. If the service or task returns after reboot, run a full scan instead of repeating file deletion.

Uninstall OB or OneBrowser first

Open Settings -> Apps -> Installed apps and search for OB, OIB, OneBrowser, OIBrowser, One Browser, or OneBrowser Update. If an uninstall entry is present, use it before manual deletion. Close browsers and save work first because the uninstaller may close an OB/OIB process or updater.

If you see OneBrowser or other suspicious applications that you don't remember installing, you should remove them as well.

If OneBrowser is missing from Installed apps or Windows says it cannot find the uninstaller, also check Control Panel -> Programs and Features. For a broken entry, use Microsoft’s Program Install and Uninstall troubleshooter rather than downloading an unknown third-party uninstaller. Continue with the service, task, and folder checks only when the remaining item clearly points to OB, OIB, OneBrowser, or OneBUpdate.

If OneBrowser remains under Settings -> Apps -> Default apps after uninstall, first set a trusted installed browser as the default for web links. Reboot and scan again. A stale name can remain because browser capability or file-association registration survived the uninstall; do not search the registry and delete every result. Export a backup and remove only entries that clearly point to the missing OB/OneBrowser executable, or leave registry cleanup to the scanner.

After uninstalling, reboot once. A reboot releases locked files and makes persistence checks clearer. If the entry refuses to uninstall, disappears without removing files, or reappears after reboot, continue with the updater, task, and folder checks below.

Stop OneBrowser updater services and tasks

OneBrowser cleanup often fails when an updater is still active. Check Services, Task Scheduler, and the task file before deleting folders. OneBrowser/OIBrowser-related names to check include:

• HKLM\SYSTEM\ControlSet001\Services\onebupdate
• HKLM\SYSTEM\ControlSet001\Services\obupdate
• HKLM\SYSTEM\ControlSet001\Services\oibupdate
• %LocalAppData%\OB\OneBUpdate\OneBUpdateService.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OBUpdate
• C:\Windows\System32\Tasks\OneBUpdate

If you are not comfortable editing services or tasks manually, scan instead of experimenting in the registry. If you do check manually, prefer viewing first. In an elevated Command Prompt, these read-only checks are safer than deleting keys immediately:

sc query onebupdate
sc query obupdate
sc query oibupdate
schtasks /Query /TN OBUpdate

If those entries exist after the OneBrowser/OIBrowser uninstall, stop the service or disable the task before deleting folders. Do not remove unrelated Windows services. Similar-looking names that do not contain OB, OIB, OneBrowser, or OneBUpdate should be verified before action.

Files and folders to check

Only remove these paths when they clearly belong to OneBrowser/OB Browser/OIBrowser and after the app, updater, and browser processes are closed. Replace environment variables with your own Windows paths; do not delete the parent AppData, Program Files, or User Data folder.

Common OB user-profile leftovers under %LocalAppData%\OB\User Data\ include:

• Local State
• Variations
• BrowserMetrics\
• Crashpad\metadata, Crashpad\settings.dat, and Crashpad\reports\*.dmp
• ShaderCache\, GrShaderCache\, and GraphiteDawnCache\
• component_crx_cache\

Those paths help confirm that the leftovers belong to OB Browser or OIBrowser. They are not a reason to delete the same-named folders from a legitimate Chrome, Edge, Brave, or Vivaldi profile.

Match detections to the OB path

Recent OneBrowser cleanup cases can show several Gridinsoft names for the same unwanted browser family, including PUP.FPL.OneBrowser.dd, PUP.Win32.OneBrowser.dd!c, and PUP.rHeur.OneBrowser.dd. Use the detection together with the path. A hit under %LocalAppData%\OB\, %LocalAppData%\OB\OneBUpdate\, %ProgramFiles(x86)%\OB\Application\, or %ProgramFiles(x86)%\OIB\Application\ supports OneBrowser/OIBrowser cleanup; a similar Chromium cache filename under Chrome, Edge, Brave, or Vivaldi should be checked by browser name, publisher, and install time before deletion.

Registry keys that can confirm persistence

Use the registry as a confirmation source, not as the first cleanup step. Export a backup of any key before deleting it, and avoid broad search-and-delete actions. OneBrowser-related keys to look for include:

• HKLM\SOFTWARE\WOW6432Node\OB
• HKCU\SOFTWARE\OIB
• HKLM\SOFTWARE\WOW6432Node\OIB
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OB
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OB|UninstallString
• HKU\...\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OB|UninstallString
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OneBrowser
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OneBrowser|UninstallString
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneBrowser.exe
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OneBrowser.exe|(Default)
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\oibrowser.exe
• HKLM\Software\Microsoft\Active Setup\Installed Components\{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

Firewall-rule leftovers may also appear under HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules. Treat random firewall-rule GUIDs carefully: confirm that the value points to an OB or OneBrowser executable before removing it. GUIDs by themselves are not enough to identify a malicious rule.

Check browser extensions and profiles

After removing OneBrowser itself, check Chrome, Edge, Firefox, and any browser you actually use. Look for unknown extensions, forced search engines, startup pages, notification permissions, and “managed by your organization” policies you did not set. Do not mark the extension ID bojobppfploabceghnmlahpoonbcbacn as malicious by name alone; current public results associate that exact ID with Malwarebytes Browser Guard, so verify the extension name, publisher, source, and install time before action.

Open Extensions/Add-ons again and remove any entry linked to OneBrowser or clearly out of place.

If search or homepage settings still change after removing OB, follow the broader browser hijacker removal guide. If the symptom is extra tabs opening by themselves, use the multiple-tabs troubleshooting flow. If OneBrowser arrived with a cleaner, optimizer, archive, or bundle installer, check the PUP cleanup pattern for system utilities as well.

Scan for leftovers that make OneBrowser return

If %ProgramFiles(x86)%\OB\, %ProgramFiles(x86)%\OIB\, %LocalAppData%\OB\, onebupdate, obupdate, oibupdate, or OBUpdate returns after reboot, treat the case as more than leftover cache. A full Gridinsoft Anti-Malware scan can check for detections, hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and persistence that a manual uninstall may miss.

When the scan is complete, quarantine detections, reboot, and scan again if the same files or tasks return. If the browser stored important bookmarks or passwords, export only what you need before deleting the OB profile and do not import extensions or settings wholesale into a clean browser.

What not to delete

• Do not delete the parent %LocalAppData%, %ProgramFiles(x86)%, or C:\Windows\System32\Tasks folder.
• Do not delete Chrome, Edge, Brave, or Firefox User Data folders just because OB has a folder with the same Chromium-style names.
• Do not run setup.exe from the OB installer folder to “repair” the browser unless you intentionally want it installed.
• Do not remove firewall rules by GUID until the rule value points to an OB or OneBrowser executable.
• Do not trust a browser extension or updater because its name looks familiar; check publisher, path, and install source.

FAQ

References

1. Microsoft Learn. “sc query.” Microsoft, accessed June 25, 2026. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query
2. Microsoft Learn. “schtasks query.” Microsoft, accessed June 25, 2026. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-query
3. Microsoft Support. “Fix problems that block programs from being installed or removed.” Microsoft, accessed July 12, 2026. https://support.microsoft.com/en-us/windows/deployment/install-upgrade/fix-problems-that-block-programs-from-being-installed-or-removed