OneStart Browser Hijacker: Complete Removal from 30 Infected Machines

LIMEHAWK - Managed IT

Home>Incident Reports>OneStart Browser Hijacker: Complete Removal from 30 Infected Machines

Machines

Incident

Help desk tickets started flooding in over a few days: "My browser homepage changed." "There's a weird toolbar I didn't install." "Popups keep appearing." By the time we correlated them, 30 machines across the organization were all showing the same fingerprint — OneStart.ai had taken over browsers, flipped search settings, and planted itself deep enough that standard antivirus wasn't flagging it. The client's EDR was happy. The users were not.

What is OneStart?

OneStart.ai markets itself as a "productivity browser" but behaves like classic adware. It gets bundled with free software downloads — PDF converters, video players, YouTube-to-MP3 sites, the usual suspects — and installs during the "next, next, next" phase of a free tool install. Once on a machine, it does the whole adware playbook:

- browser hijacking: changes homepage, default search, and new tab page to OneStart properties
- ad injection: injects banner ads and popups into web pages, including banking sites
- persistence: creates multiple scheduled tasks that reinstall it if removed
- data collection: tracks browsing history and sends to remote servers
- AV evasion: signed binaries and a "legitimate" uninstaller let it bypass most antivirus

The uninstaller in Add/Remove Programs is the bait. It removes the visible application and nothing else — the scheduled tasks, registry entries, and hidden folders all stay put, and within 15 minutes the whole thing is back.

Why standard removal fails

Users had tried uninstalling it themselves. Their IT contact had tried Control Panel. We got the tickets because it kept coming back within hours. Four things keep it alive:

1. scheduled tasks: OneStartUpdaterTaskUser runs every 15 minutes and reinstalls if files are missing
2. hidden AppData folders: files in %LOCALAPPDATA%\OneStart.ai are untouched by the uninstaller
3. registry persistence: startup entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run
4. process respawn: if you kill OneStart.exe, DBar.exe relaunches it immediately

Order matters. If you delete files first, the scheduled task restores them. If you kill the process first but leave the task, the task respawns it. We needed a script that kills every process first, then removes scheduled tasks, then cleans files, then purges registry — in that exact sequence.

Solution

We built a PowerShell removal script that calls NirSoft UninstallView for the initial uninstall attempt, then does the manual cleanup the uninstaller skips. Every registry key is backed up before deletion so we have a recovery path if anything goes sideways on an unusual machine build.

Safety feature: all registry keys are backed up to C:\limehawk\registry_backup before deletion. If something goes wrong we can restore.

Post-removal

After the script runs, browsers still have the jacked settings cached in their own profiles. Users need to reset each browser manually:

- Chrome: Settings > Reset settings > Restore settings to their original defaults
- Edge: Settings > Reset settings > Restore settings to their default values
- Firefox: Help > More troubleshooting information > Refresh Firefox
- All browsers: check the Extensions page and remove anything suspicious

Outcome

Script deployed to all 30 affected machines via RMM. Average runtime was 47 seconds per machine. Zero reinfections reported in the 30 days since cleanup. We also blocked the OneStart.ai domain at the DNS filter and added detection rules to flag future installations before they spread.

machines cleaned: 30
script runtime: 47 seconds per machine
items removed: 12+ per machine average
reinfections: zero (30 days)

Prevention measures implemented:

- blocked OneStart.ai and related domains at the DNS filter
- added OneStart to the application blacklist in RMM
- user training: always choose Custom Install and uncheck bundled software
- weekly scheduled scan for OneStart processes as an early warning

Key takeaways

Takeaway

the "uninstall" option in Add/Remove Programs is deliberately incomplete for PUPs like this.

Takeaway

scheduled tasks are the real persistence mechanism — kill them before touching files.

Takeaway

signed-but-unwanted is the hardest category for AV to catch; DNS blocking is the better control.

Takeaway

when a removal keeps failing, it's almost always process-order, not the cleanup commands themselves.

Need help with something like this? Contact us

• Getting Verification Codes You Didn't Request? How to Tell Spam From Account Compromise (Security)

• Finding Your BitLocker Recovery Key After a Windows Update Breaks Boot (Security)

• BEC Wire Fraud at a Title Company: How We Stopped a High-Six-Figure Loss (Security)