Remove Win32:Gepys-B [Trj] Malware [Virus Removal Guide]

1. Open the Settings app

   Press Windows + I on your keyboard to open Settings. Alternatively, right-click the Start button and select “Settings” from the menu.

   

2. Go to “Installed apps”

   In the Settings window, click “Apps” in the sidebar, then select “Installed apps“.

   

3. Find and uninstall the malicious program

   Scroll through the list of installed apps and look for anything suspicious — a program you don’t remember installing, or one with a strange or generic name.
   Quick tip: click “Sort by” and choose “Date installed“. Malware is usually one of the most recently installed programs, so it will appear near the top.
   When you find the malicious program, click the three dots next to it and select “Uninstall“.

   

   Didn’t find any suspicious programs? That’s fine — not all infections install visible apps. Just continue with the next step in this guide.

4. Complete the uninstall

   Confirm by clicking Uninstall in the message box, then follow the remaining prompts.
   Read each prompt carefully — some malicious programs use confusing wording or pre-ticked boxes hoping you’ll click through without looking.

   

1. Open the Settings app

   Press Windows + I on your keyboard to open Settings. Alternatively, click the Start button on the taskbar and select “Settings” (the gear icon).
   

2. Click on “Apps”

   In the “Windows Settings” window, click “Apps“. The “Apps & Features” section should open by default — if it doesn’t, select it from the list on the left.

   

3. Find and uninstall the malicious program

   Scroll through the list of installed apps and look for anything suspicious — a program you don’t remember installing, or one with a strange or generic name.
   Quick tip: click “Sort by” and choose “Install date“. Malware is usually one of the most recently installed programs, so it will appear near the top.
   When you find the malicious program, click on it and select “Uninstall“.

   

   Didn’t find any suspicious programs? That’s fine — not all infections install visible apps. Just continue with the next step in this guide.

4. Complete the uninstall

   Confirm by clicking Uninstall in the message box, then follow the remaining prompts.
   Read each prompt carefully — some malicious programs use confusing wording or pre-ticked boxes hoping you’ll click through without looking.
   

Reset Chrome for Windows to default settings

We will now reset your Chrome browser settings to their original defaults. This will reset your startup page, new tab page, search engine, and pinned tabs. It will also disable all extensions and clear temporary data like cookies. Your favorites, history, and saved passwords will not be cleared.

1. Open the Chrome menu

   Open Google Chrome and click the three-dot (⋮) icon in the top-right corner.

   
   

2. Open Chrome Settings

   Select Settings from the Chrome menu.

   
   

3. Select “Reset settings”

   Look at the menu on the left side of the Settings page. Scroll down and click Reset settings.

   
   

4. Restore Chrome’s original settings

   Click Restore settings to their original defaults.

   

   
   

5. Confirm the Chrome reset

   A confirmation window will appear. Click Reset settings.

   This will:

   • Restore the default search engine, homepage, and new tab page
   • Reset startup pages and pinned tabs
   • Reset site permissions, such as notifications and pop-ups
   • Disable installed extensions
   • Clear temporary cookies and website data

   Don’t worry: Chrome will not delete your bookmarks, browsing history, or saved passwords. If you’re signed in to Chrome, the reset applies on all devices where you’re signed in.

   Restart Chrome and perform a test search. If your searches now open normally in Google, you can stop here.

   If searches are still redirected through shady domains complete the additional step below.

   
   

6. Remove persistent search hijacker data

   Only complete this step if the redirect continues after resetting Chrome.

   Some browser hijackers hide inside Chrome’s local search-engine database. A standard Chrome reset may not remove this database, which is why searches can continue to pass through shady sites.

   The following procedure creates a backup of the affected database and allows Chrome to build a new, clean version. This is safer and less disruptive than deleting the entire Chrome profile.

   First, prevent Chrome Sync from restoring the hijacked settings:

   1. Open a new Chrome tab.
   2. Copy the following address, paste it into Chrome’s address bar, and press Enter:
      

      chrome://settings/syncSetup/advanced

      
      
   3. Under Manage what you sync, select Customize sync.
   4. Turn off Settings and Extensions.
   5. You can leave Bookmarks and Passwords enabled so your important data remains synchronized.

   Note: Some newer Chrome versions may automatically redirect this address to the Google Account settings page. If that happens, locate the list of synchronized Chrome data and turn off Settings and Extensions there.

   

   Now save anything you are working on and close every Chrome window.

   Run the cleanup command:

   1. Press the Windows key on your keyboard.
   2. Type PowerShell.
   3. Open Windows PowerShell. Administrator access is not required.
   4. Copy the entire command shown below.
   5. Right-click inside the PowerShell window to paste the command, then press Enter.
   6. If Windows warns you about pasting multiple lines, select the option to continue.
   
   

   $stamp = Get-Date -Format "yyyyMMdd-HHmmss"
   
   Get-Process chrome -ErrorAction SilentlyContinue |
    Stop-Process -Force
   
   $root = "$env:LOCALAPPDATA\Google\Chrome\User Data"
   
   if (Test-Path $root) {
    $profiles = Get-ChildItem $root -Directory |
    Where-Object {
    $_.Name -eq "Default" -or
    $_.Name -match "^Profile \d+$"
    }
   
    foreach ($profile in $profiles) {
    foreach ($name in @(
    "Web Data",
    "Web Data-journal",
    "Web Data-wal",
    "Web Data-shm"
    )) {
    $file = Join-Path $profile.FullName $name
   
    if (Test-Path $file) {
    $backup = "$file.search-hijacker-backup-$stamp"
    Move-Item -LiteralPath $file -Destination $backup
    Write-Host "Backup created: $backup"
    }
    }
    }
   }
   
   Write-Host ""
   Write-Host "Chrome search data has been cleaned."
   Write-Host "You can now reopen Chrome."

   Wait until PowerShell displays the following message:

   Chrome search data has been cleaned.
   You can now reopen Chrome.

   

   Close PowerShell and reopen Google Chrome. Chrome will automatically create a clean search database for every local profile.

   Next, copy the following address, paste it into Chrome’s address bar, and press Enter:

   chrome://settings/searchEngines

   

   Make sure Google is selected as the default search engine. Test several searches from the address bar and confirm that they no longer pass through shady search engines.

   Your important Chrome data is protected: the PowerShell cleanup does not remove bookmarks, saved passwords, browsing history, cookies, or installed extensions. However, it may reset locally stored Autofill addresses, payment cards saved only on this computer, and form suggestions.

   The original search database is not deleted. PowerShell renames it and adds search-hijacker-backup to its filename so it can be recovered if necessary.

   Keep Settings and Extensions synchronization disabled while testing Chrome. Do not enable every extension at once. Enable only the extensions you recognize, one at a time, and test Chrome after each one.

   

   If the redirect returns after enabling a particular extension, remove that extension immediately.

Reset Firefox for Windows to default settings

We will now reset your Firefox browser settings to their default. The reset feature fixes many issues by restoring Firefox to its factory default state while saving your essential information like bookmarks, passwords, web form auto-fill information, browsing history, and open tabs.

1. Open the Firefox menu and click “Help and Report”

   Click the three horizontal lines in the top-right corner of Firefox to open the main menu, then select “Help and Report“.

   

2. Click “More troubleshooting information”

   In the Help and Report menu, click “More troubleshooting information“.

   

3. Click “Refresh Firefox”

   On the “Troubleshooting Information” page, click the “Refresh Firefox” button in the “Give Firefox a tune up” box in the top-right area of the page.

   

4. Confirm the refresh

   In the confirmation window, click “Refresh Firefox” again. This removes extensions, themes, and customized settings — the usual hiding places for browser hijackers — while keeping your bookmarks, history, and saved passwords safe.

   

5. Click “Finish”

   Firefox will close, reset itself to default settings, and reopen with a window listing the information that was restored. Click “Finish“. Then test Firefox before you add back any extensions.

   About the “Old Firefox Data” folder: Firefox saves a copy of your old profile on your desktop. If something you need is missing after the reset, you can recover it from this folder. Otherwise, delete the folder — it contains sensitive data like passwords and cookies, and may also still hold the malicious files you just removed.

Reset Microsoft Edge to default settings

We will now reset your Microsoft Edge browser settings to their default. This will reset your startup page, new tab page, search engine, and pinned tabs. It will also disable all extensions and clear temporary data like cookies. Your favorites, history, and saved passwords will not be cleared.

Updated for Microsoft Edge on Windows 10 and Windows 11 — July 2026.

1. Open the Edge menu and click “Settings”

   Open Microsoft Edge. In the top-right corner, click the three-dot (…) icon, then click Settings.

   

2. Prevent the unwanted settings from returning through Edge Sync

   If you are signed in to Microsoft Edge, a bad setting or extension may be stored in your Microsoft account and return after the reset.

   Copy the following address, paste it into the Edge address bar, and press Enter:

   edge://settings/profiles/sync

   On the Sync page, turn off these two options:

   • Settings
   • Extensions

   You can leave Favorites and Passwords turned on.

   If Edge says that sync is already off, simply continue to the next step.

   Important: Edge Sync settings are separate for each profile. If you use more than one Edge profile, switch to each affected profile and repeat this step.

   You do not need to sign out of your Microsoft account or delete the Edge profile.

3. Open “Reset settings”

   In the left sidebar, click Reset settings.

   You can also open the reset page directly. Copy the following address, paste it into the Edge address bar, and press Enter:

   edge://settings/reset

   

4. Click “Restore settings to their default values”

   Click Restore settings to their default values.

   

5. Confirm the reset

   In the confirmation dialog, click Reset.

   This resets the startup page, new tab page, search engine, and pinned tabs. It also disables all extensions and clears temporary site data, such as cookies.

   Don’t worry: your favorites, browsing history, and saved passwords will not be deleted.

   

6. Check your extensions before turning them back on

   Copy the following address, paste it into the Edge address bar, and press Enter:

   edge://extensions

   Remove any extension you do not recognize or no longer use. Pay particular attention to extensions related to search, coupons, shopping, PDF conversion, browser protection, new tabs, or video downloading.

   Do not turn all extensions back on at the same time. Enable only the extensions you recognize and trust.

   

7. Select a trusted search engine

   Copy the following address, paste it into the Edge address bar, and press Enter:

   edge://settings/searchEngines

   Select Bing, Google, DuckDuckGo, or another search provider you trust and make it the default. This address opens the list of search engines; the default is set one page back, on Address bar and search, under Search engine used in the address bar.

   Remove any unknown search engines from the list, especially providers with strange names or addresses that you did not add yourself: click More actions (…) next to the engine and remove it.

   Restart Edge and perform a search from the address bar. If searches are no longer redirected, you can stop here.

   

8. If the redirect remains, clean the corrupted search data without deleting the Edge profile

   Use this additional step only if Edge continues to redirect searches after the normal reset.

   This command cleans the search-engine database from every local Edge profile while keeping your favorites, saved passwords, browsing history, cookies, and profiles.

   Before continuing: save anything you are working on because the command will close Microsoft Edge.

   1. Open the Windows Start menu.
   2. Type PowerShell.
   3. Open Windows PowerShell. Administrator access is not required.
   4. Copy the entire command below.
   5. Paste it into PowerShell and press Enter.

   $stamp = Get-Date -Format "yyyyMMdd-HHmmss"
   $root = Join-Path $env:LOCALAPPDATA "Microsoft\Edge\User Data"
   
   Get-Process -Name msedge -ErrorAction SilentlyContinue |
       Stop-Process -Force -ErrorAction SilentlyContinue
   
   Start-Sleep -Seconds 2
   
   if (-not (Test-Path -LiteralPath $root)) {
       Write-Host "The Microsoft Edge profile folder was not found:"
       Write-Host $root
       return
   }
   
   $profiles = Get-ChildItem -LiteralPath $root -Directory |
       Where-Object {
           $_.Name -eq "Default" -or
           $_.Name -match "^Profile \d+$"
       }
   
   $movedFiles = 0
   
   foreach ($profile in $profiles) {
       foreach ($name in @(
           "Web Data",
           "Web Data-journal",
           "Web Data-wal",
           "Web Data-shm"
       )) {
           $file = Join-Path $profile.FullName $name
   
           if (Test-Path -LiteralPath $file) {
               $backup = "$file.search-reset-backup-$stamp"
   
               try {
                   Move-Item -LiteralPath $file -Destination $backup -ErrorAction Stop
                   Write-Host "Cleaned: $($profile.Name)\$name"
                   $movedFiles++
               }
               catch {
                   Write-Warning "Could not clean: $file"
               }
           }
       }
   }
   
   Write-Host ""
   
   if ($movedFiles -gt 0) {
       Write-Host "Microsoft Edge search data has been cleaned." -ForegroundColor Green
       Write-Host "You can now reopen Microsoft Edge."
   }
   else {
       Write-Host "No Edge search database files were found." -ForegroundColor Yellow
   }

   The command does not permanently delete the original files. It renames them as backup files, and Edge creates a clean search database when it starts again.

   Note: this additional cleanup may also reset saved form-fill suggestions, saved addresses, payment cards saved only on this computer, and manually added search engines. It does not delete favorites, passwords, or browsing history.

9. Reopen Edge and test the browser

   Open Microsoft Edge again, visit edge://settings/searchEngines, and select your preferred search engine (one page back, on Address bar and search, under Search engine used in the address bar).

   Perform several searches from the address bar to confirm that the redirect is gone.

   Keep synchronization for Settings and Extensions turned off until you are certain that the computer and extensions are clean. If you enable them again, turn them on one at a time and test Edge after each change.

   

10. If Edge still redirects your searches

    Open edge://policy. If this is your personal computer and Edge displays unknown policies such as ExtensionInstallForcelist or DefaultSearchProvider, the hijacker may be installed outside the browser profile.

    In that situation, continue with the next malware-removal steps and run a complete antivirus scan. If the computer belongs to a company or school, contact its IT administrator before changing any policies.