PUA.Win64.OneStart.E
PLATFORM:
Windows
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
SYSTEM IMPACT RATING:
INFORMATION EXPOSURE:
Threat Type: Potentially Unwanted Application
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It connects to certain websites to send and receive information.
TECHNICAL DETAILS
File Size: 3,585,648 bytes
File Type: EXE
Initial Samples Received Date: 28 Oct 2025
Arrival Details
This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Potentially Unwanted Application drops the following files:
- %AppDataLocal%\OneStart.ai\OneStart\User Data\BrowserMetrics\BrowserMetrics-6318CDB1-E30.pma
- %AppDataLocal%\OneStart.ai\OneStart\User Data\component_crx_cache\metadata.json
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad\settings.dat
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Account Web Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Account Web Data-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Affiliation Database
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Affiliation Database-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\chrome_cart_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\chrome_cart_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\ClientCertificates\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\ClientCertificates\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index-dir\the-real-index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm\index-dir\the-real-index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\commerce_subscription_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\commerce_subscription_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\discounts_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\discounts_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Favicons
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Favicons-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Google Profile.ico
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\History
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\History-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\InterestGroups
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\InterestGroups-wal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data For Account
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data For Account-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Cookies
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Cookies-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Network Persistent State
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\NetworkDataMigrated
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\SCT Auditing Pending Reports
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Trust Tokens
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Trust Tokens-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\parcel_tracking_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\parcel_tracking_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PersistentOriginTrials\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PersistentOriginTrials\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Preferences
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PrivateAggregation
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PrivateAggregation-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\README
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network\NetworkDataMigrated
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network\Safe Browsing Cookies
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network\Safe Browsing Cookies-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Secure Preferences
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SegmentInfoDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sessions\Session_13307043512173805
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\db-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\SharedStorage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\SharedStorage-wal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Top Sites
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Top Sites-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Web Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Web Data-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\WebStorage\QuotaManager
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\WebStorage\QuotaManager-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\DeferredBrowserMetrics\BrowserMetrics-6318CDBA-1330.pma
- %AppDataLocal%\OneStart.ai\OneStart\User Data\extensions_crx_cache\metadata.json
- %AppDataLocal%\OneStart.ai\OneStart\User Data\FileTypePolicies
- %AppDataLocal%\OneStart.ai\OneStart\User Data\First Run
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\hyphen-data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Last Version
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Local State
- %AppDataLocal%\OneStart.ai\OneStart\User Data\MEIPreload
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform\ukm_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform\ukm_db-wal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\index
(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)
It adds the following processes:
- "{Malware file path}{Malware File Name}" {Chromium/Electron subprocess parameters used to spawn crash handlers, GPU and renderer processes, utility services, and auxiliary browser components responsible for networking, storage, and rendering tasks.}
It creates the following folders:
- %AppDataLocal%\OneStart.ai\OneStart\User Data\AmountExtractionHeuristicRegexes
- %AppDataLocal%\OneStart.ai\OneStart\User Data\AutofillStates
- %AppDataLocal%\OneStart.ai\OneStart\User Data\BrowserMetrics
- %AppDataLocal%\OneStart.ai\OneStart\User Data\CertificateRevocation
- %AppDataLocal%\OneStart.ai\OneStart\User Data\component_crx_cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\CookieReadinessList
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad\attachments
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad\reports
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crowd Deny
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\chrome_cart_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\ClientCertificates
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index-dir
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm\index-dir
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\commerce_subscription_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\discounts_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\parcel_tracking_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PersistentOriginTrials
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SegmentInfoDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalStorageConfigDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sessions
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache\index-dir
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\WebStorage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\DeferredBrowserMetrics
- %AppDataLocal%\OneStart.ai\OneStart\User Data\extensions_crx_cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OnDeviceHeadSuggestModel
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OpenCookieDatabase
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OptimizationHints
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OriginTrials
- %AppDataLocal%\OneStart.ai\OneStart\User Data\PKIMetadata
- %AppDataLocal%\OneStart.ai\OneStart\User Data\PrivacySandboxAttestationsPreloaded
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ProbabilisticRevealTokenRegistry
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Safe Browsing
- %AppDataLocal%\OneStart.ai\OneStart\User Data\SafetyTips
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform\ukm_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\SSLErrorAssistant
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Subresource Filter
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Subresource Filter\Unindexed Rules
- %AppDataLocal%\OneStart.ai\OneStart\User Data\TpcdMetadata
- %AppDataLocal%\OneStart.ai\OneStart\User Data\TrustTokenKeyCommitments
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Variations
- %AppDataLocal%\OneStart.ai\OneStart\User Data\WidevineCdm
(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)
Other System Modifications
This Potentially Unwanted Application adds the following registry entries:
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart
UsageStatsInSample = 00000001
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\BLBeacon
version = 136.0.7103.113
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\BLBeacon
state = 00000001
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\BLBeacon
failed_count = 00000000
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
extensions.ui.developer_mode = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
google.services.last_signed_in_username = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
storage_id_salt = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
google.services.account_id = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
safebrowsing.incidents_sent = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
pinned_tabs = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
search_provider_overrides = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
prefs.preference_reset_time = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
google.services.last_username = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
session.startup_urls = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
session.restore_on_startu = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
browser.show_home_button = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
homepage = {Random Charact
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
enterprise_signin.policy_recovery_token = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
homepage_is_newtabpage = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
efault_search_provider_data.template_url_data = {Random Characters}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\StabilityMetrics
user_experience_metrics.stability.exited_cleanly = 00000000
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState\{GUID}
usagestats = 00000000
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState\{GUID}
metricsid =
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState\{GUID}
metricsid_installdate = 0
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState\{GUID}
metricsid_installdate = 0
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState\{GUID}
metricsid_enableddate = 0
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState\{GUID}
lastrun = {File timestamp}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\StabilityMetrics
user_experience_metrics.stability.exited_cleanly = 00000000
Other Details
This Potentially Unwanted Application adds the following registry keys:
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\BLBeacon
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs\Default\
extensions.settings
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\StabilityMetrics
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
Update\ClientState\{GUID}
HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\
OneStart\PreferenceMACs
It connects to the following website to send and receive information:
- http://{BLOCKED}rt.ai:443
- http://{BLOCKED}rtapi.com:443
It accepts the following parameters:
- --type= - Process type (browser/renderer/gpu-process/utility/crashpad-handler)
- -user-data-dir= - User profile directory location
- -initial-client-data= - IPC handles for child processes
- -fallback-handler - Error recovery mode
- -no-periodic-tasks - Disable background tasks
- -no-pre-read-main-dll - Skip DLL pre-reading optimization
- -help - Display help message
- -version - Show version information
- -source= - Launch source identifier
- --disable-gpu-sandbox - Disable GPU process sandboxing
- --annotation= - Add process annotation to crash reports
- --attachment= - Attach file to crash reports
- --database= - Crash report database path
- --metrics-dir= - Metrics files directory
- --monitor-self - Run second crash handler
- --monitor-self-annotation= - Module annotation for handler
- --monitor-self-argument= - Arguments for second handler
- --no-identify-client-via-url - Disable client ID in upload URL
- --no-rate-limit - Disable crash upload rate limiting
- --no-upload-gzip - Disable gzip compression for uploads
- --pipe-name= - Named pipe for IPC communication
- --url= - Crash report upload URL
- /prefetch:{1-16} - Prefetch hint
SOLUTION
Minimum Scan Engine: 9.800
SSAPI PATTERN File: 2.868.05
SSAPI PATTERN Date: 04 Sep 2025
Step 1
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Delete this registry key
[ Learn More ]
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\BLBeacon
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\PreferenceMACs
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\PreferenceMACs\Default
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\PreferenceMACs\Default\extensions.settings
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\StabilityMetrics
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\Update
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\Update\ClientState
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\Update\ClientState\{GUID}
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\PreferenceMACs
Step 4
Delete this registry value
[ Learn More ]
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart
- UsageStatsInSample=00000001
- UsageStatsInSample=00000001
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\BLBeacon
- version=136.0.7103.113
- state=00000001
- failed_count=00000000
- version=136.0.7103.113
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\PreferenceMACs\Default
- extensions.ui.developer_mode={Random Characters}
- google.services.last_signed_in_username={Random Characters}
- media.cdm.origin_data={Random Characters}
- media.storage_id_salt={Random Characters}
- google.services.account_id={Random Characters}
- safebrowsing.incidents_sent={Random Characters}
- pinned_tabs={Random Characters}
- search_provider_overrides={Random Characters}
- prefs.preference_reset_time={Random Characters}
- google.services.last_username={Random Characters}
- session.startup_urls={Random Characters}
- session.restore_on_startup={Random Characters}
- browser.show_home_button={Random Characters}
- homepage={Random Characters}
- enterprise_signin.policy_recovery_token={Random Characters}
- homepage_is_newtabpage={Random Characters}
- default_search_provider_data.template_url_data={Random Characters}
- extensions.ui.developer_mode={Random Characters}
- In HKEY_CURRENT_USER\SOFTWARE\OneStart.ai\OneStart\StabilityMetrics
- user_experience_metrics.stability.exited_cleanly=00000000
- usagestats=00000000
- metricsid
- metricsid_installdate=0
- metricsid_enableddate=0
- lastrun=13307043515161071
- user_experience_metrics.stability.exited_cleanly=00000000
Step 5
Search and delete these folders
[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result. - %AppDataLocal%\OneStart.ai\OneStart\User Data\AmountExtractionHeuristicRegexes
- %AppDataLocal%\OneStart.ai\OneStart\User Data\AutofillStates
- %AppDataLocal%\OneStart.ai\OneStart\User Data\BrowserMetrics
- %AppDataLocal%\OneStart.ai\OneStart\User Data\CertificateRevocation
- %AppDataLocal%\OneStart.ai\OneStart\User Data\component_crx_cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\CookieReadinessList
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad\attachments
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad\reports
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crowd Deny
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\chrome_cart_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\ClientCertificates
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index-dir
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm\index-dir
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\commerce_subscription_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\discounts_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\parcel_tracking_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PersistentOriginTrials
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SegmentInfoDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalStorageConfigDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sessions
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache\index-dir
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\WebStorage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\DeferredBrowserMetrics
- %AppDataLocal%\OneStart.ai\OneStart\User Data\extensions_crx_cache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OnDeviceHeadSuggestModel
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OpenCookieDatabase
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OptimizationHints
- %AppDataLocal%\OneStart.ai\OneStart\User Data\OriginTrials
- %AppDataLocal%\OneStart.ai\OneStart\User Data\PKIMetadata
- %AppDataLocal%\OneStart.ai\OneStart\User Data\PrivacySandboxAttestationsPreloaded
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ProbabilisticRevealTokenRegistry
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Safe Browsing
- %AppDataLocal%\OneStart.ai\OneStart\User Data\SafetyTips
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform\ukm_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache
- %AppDataLocal%\OneStart.ai\OneStart\User Data\SSLErrorAssistant
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Subresource Filter
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Subresource Filter\Unindexed Rules
- %AppDataLocal%\OneStart.ai\OneStart\User Data\TpcdMetadata
- %AppDataLocal%\OneStart.ai\OneStart\User Data\TrustTokenKeyCommitments
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Variations
- %AppDataLocal%\OneStart.ai\OneStart\User Data\WidevineCdm
Step 6
Search and delete these files
[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result. - %AppDataLocal%\OneStart.ai\OneStart\User Data\BrowserMetrics\BrowserMetrics-6318CDB1-E30.pma
- %AppDataLocal%\OneStart.ai\OneStart\User Data\component_crx_cache\metadata.json
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Crashpad\settings.dat
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Account Web Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Account Web Data-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Affiliation Database
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Affiliation Database-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Cache\Cache_Data\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\chrome_cart_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\chrome_cart_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\ClientCertificates\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\ClientCertificates\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\js\index-dir\the-real-index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Code Cache\wasm\index-dir\the-real-index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\commerce_subscription_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\commerce_subscription_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnGraphiteCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\DawnWebGPUCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\discounts_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\discounts_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Rules\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension Scripts\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Extension State\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Favicons
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Favicons-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Google Profile.ico
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\GPUCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\History
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\History-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\InterestGroups
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\InterestGroups-wal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Local Storage\leveldb\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data For Account
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data For Account-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Login Data-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Cookies
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Cookies-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Network Persistent State
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\NetworkDataMigrated
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\SCT Auditing Pending Reports
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Trust Tokens
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Network\Trust Tokens-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\parcel_tracking_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\parcel_tracking_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PersistentOriginTrials\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PersistentOriginTrials\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Preferences
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PrivateAggregation
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\PrivateAggregation-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\README
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network\NetworkDataMigrated
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network\Safe Browsing Cookies
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Safe Browsing Network\Safe Browsing Cookies-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Secure Preferences
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SegmentInfoDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Session Storage\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sessions\Session_13307043512173805
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Shared Dictionary\db-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\SharedStorage
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\SharedStorage-wal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\shared_proto_db\metadata\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Site Characteristics Database\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\000003.log
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\CURRENT
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\LOCK
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\LOG
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Sync Data\LevelDB\MANIFEST-000002
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Top Sites
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Top Sites-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Web Data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\Web Data-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\WebStorage\QuotaManager
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Default\WebStorage\QuotaManager-journal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\DeferredBrowserMetrics\BrowserMetrics-6318CDBA-1330.pma
- %AppDataLocal%\OneStart.ai\OneStart\User Data\extensions_crx_cache\metadata.json
- %AppDataLocal%\OneStart.ai\OneStart\User Data\FileTypePolicies
- %AppDataLocal%\OneStart.ai\OneStart\User Data\First Run
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GraphiteDawnCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\GrShaderCache\index
- %AppDataLocal%\OneStart.ai\OneStart\User Data\hyphen-data
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Last Version
- %AppDataLocal%\OneStart.ai\OneStart\User Data\Local State
- %AppDataLocal%\OneStart.ai\OneStart\User Data\MEIPreload
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform\ukm_db
- %AppDataLocal%\OneStart.ai\OneStart\User Data\segmentation_platform\ukm_db-wal
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_0
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_1
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_2
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\data_3
- %AppDataLocal%\OneStart.ai\OneStart\User Data\ShaderCache\index
Step 7
Scan your computer with your Trend Micro product to delete files detected as PUA.Win64.OneStart.E. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Step 8
Search and delete this file
[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result. DATA_GENERIC *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).
Did this description help? Tell us how we did.