Epicunitscan.info: what the alert means and how to remove it
Epicunitscan.info is a web address that security software blocks, and people have seen the alert in Chrome since 2017 while scans find nothing. The address no longer loads, so the cause is an extension or synced item in your browser, and the steps below find and remove it.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If redirects to epicunitscan.info keep coming back, a free scan can check extensions, programs and browser settings in one pass.
Do it yourself · free Remove Epicunitscan.info yourself 1 step, about 5 minutes, no software needed.
Epicunitscan.info: summary
| Type | Blocked web address tied to a browser add-on or synced Chrome item; not a program |
|---|---|
| Risk | Medium: the domain does not load today, the risk is the unknown item in the browser that keeps asking for it |
| Symptoms | Repeated antivirus or network-filter alerts naming epicunitscan.info and chrome.exe, a scan that finds nothing, an alert that follows your Google account to other computers |
| How to get rid of it | Turn off extension sync to test, remove unknown extensions, uninstall unknown programs, run Microsoft Defender scans, clear the data Chrome saved in your account and reset the browser (steps below) |
| Our check (6 October 2026) | The name does not resolve (ERR_NAME_NOT_RESOLVED); the registry shows server hold after expiry on 5 August 2026; one visit, no page reached |
| Running since | In reports since February 2017; current registration 5 August 2017; in our guide since 12 June 2019 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 12 more facts
| Installed on the PC | Nothing by visiting the address; the cause is in the browser or its synced data |
|---|---|
| Microsoft detection | No Microsoft detection name is known for the address; we looked and found none, and the old guide's Trojan.Patchbrowse is not a Microsoft name |
| Evidence | The registry record, our 6 October 2026 test, four user reports from 2017 to 2024 and Google's Chrome Help on sync |
| Name | Epicunitscan.info |
| Domains | epicunitscan.info |
| Domain registered | 5 August 2017 |
| Ads shown as | Redirects through ad pages |
| Browsers | Chrome, Edge and Firefox |
| First seen | 12 June 2019 |
| Distribution | Typically ad scripts on free streaming, file-hosting and adult sites, typo domains and hacked websites |
| Damage | Redirects to scam pages, fake updates and tech support scams |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against our own test (desktop Chromium, Lithuania; the name did not resolve), the Identity Digital RDAP record for epicunitscan.info, ICANN's description of the status codes, four public user reports from 2017, 2019 and 2024, and Google's Chrome Help on sync. We could not confirm the detection name Trojan.Patchbrowse or open the 2019 VirusTotal result.
What Epicunitscan.info is, and what the alerts really point to
Epicunitscan.info is a web address that security software blocks, not a program you can find in your list of apps. The people who see the alert report the same thing: it appears in Chrome, it repeats, and a scan finds nothing. That pattern points at something Chrome keeps loading, not at a file on the disk.
- 1
Something in the browser asks for the address
A Chrome extension, a page element or another piece of browser data makes an outbound request to epicunitscan.info. In the pictures from 2019 the program that made the request is the Chrome file
chrome.exe, not a separate program. - 2
Your security software blocks the request
Malwarebytes, Symantec Endpoint Protection and DNS security services have all shown or logged a block for this domain. The page itself never loads, so you see only the alert.
- 3
The alert comes back
Because the cause is still in the browser, the same request is made again the next time Chrome starts or syncs. Several people found that the alert followed their Google account to another computer.
- Address
epicunitscan.info- What the old guide called it
- A potentially unwanted program (adware) that could bring the trojan Trojan.Patchbrowse. We found no vendor page for a detection with that name, so we treat it as unconfirmed
- Current registration
- 5 August 2017 (RDAP record read on 6 October 2026), registrar Domaincomesaround.com LLC
- Registration status today
- Expired on 5 August 2026; the record lists the statuses server hold, client transfer prohibited and redemption period
- Who owns it
- Not shown in the public record, so we name no owner
A domain that keeps being blocked tells you that security vendors listed it. It does not tell you what is on your computer, and a clean scan does not mean the alert was false: it means the scan did not look at the place the request comes from.
Is Epicunitscan.info dangerous?
Our test on 6 October 2026
We tried to open the address the way a visitor does, in a clean desktop Chromium profile in Lithuania. The browser could not find the site at all, so there was nothing to test beyond that.
epicunitscan.info · desktop Chromium · Lithuania (EU) · 6 October 2026
- Does the address load?No. Chromium stopped with
ERR_NAME_NOT_RESOLVED: the name has no working DNS answer, so no page was fetched. - WhyThe registry record read the same day shows the domain with the status server hold, which ICANN describes as not activated in the DNS, and in the redemption period after its expiry on 5 August 2026.
- Notification request, pop-ups, redirectsNone seen, because no page was reached. This says nothing about what the address did in the past.
- Not testedAny earlier state of the site, other countries, phones, a second visit or a click. Ad servers can hide by country, device, referrer or a delay, so one failed visit proves nothing.
- What a dead domain does not changeWhatever on your device asks for the address is still there. Your security software may keep reporting the attempts.
The site is down, the cause on your device is not tested The domain does not resolve today, so visiting it is harmless. That removes the destination, not the thing that keeps calling it. The risk to you is the browser item behind the alert, which our test could not see.
What we know about the address, in order
February 2017
A first help request on the Malwarebytes forum
A user wrote that Malwarebytes kept blocking epicunitscan.info while a scan found nothing, and that Yahoo Mail did not work. Malwarebytes staff answered that this was resolved in the next update, and a volunteer helper walked the user through a clean reinstall of Chrome with the synced data removed. The user reported the blocks had stopped. The domain's current RDAP registration is dated six months after this post, so an earlier registration must have existed; we cannot say who held it.
August 2017
The current registration begins
The RDAP record gives 5 August 2017 as the registration date of epicunitscan.info.
May to November 2019
A Google Chrome Help thread: the alert follows the account
From 9 May 2019 users in a Chrome Help thread described a company antivirus warning "High Risk Website Blocked" for epicunitscan.info. Turning off the syncing of extensions stopped it; signing in on another computer brought it back. The thread collected 194 "I have the same question" votes and was later locked.
June 2019
Our first guide, with two pictures
We published the guide on 12 June 2019 and described the address as a potentially unwanted program linked to the trojan Trojan.Patchbrowse. The picture shows 5 of 70 engines flagging the URL on VirusTotal and the Malwarebytes block message. We cannot reopen that VirusTotal result, so the count is a 2019 snapshot.
Our 2019 picture of the two signs the old guide relied on: a second Malwarebytes block message and a VirusTotal result of 5 of 70 engines flagging http://epicunitscan.info/. The woman is a stock photo. June 2019
A Symantec Endpoint Protection thread
Admins on the Broadcom community forum reported "epicunitscan.info chrome corrupted" and found that renaming Chrome's
Defaultprofile folder stopped the alert until sync was turned on again. A reply from another member called it malware to be removed with a cleanup tool; nobody in the thread named the program.June 2024
The same case on Reddit
A user in r/antivirus wrote that after signing in to Chrome with a personal Google account on a work laptop, the antivirus suite kept blocking epicunitscan.info, and Malwarebytes found nothing. An IT admin replied that several endpoints in their organisation were reaching the domain, that reinstalling Chrome did not help, and that it seemed tied to the Google account.
August to September 2026
The domain expires and is put on hold
The record shows expiry on 5 August 2026 and a last change on 17 September 2026, and the statuses server hold and redemption period.
October 2026
Our new check: the name does not resolve
On 6 October 2026 our browser got
ERR_NAME_NOT_RESOLVEDfor the address.
What it means when you see Epicunitscan.info
The address means that something on your device tried to reach a domain security vendors block. Look at what the alert names as the program, and whether it comes back after you sign in.
| What you see | What it means | What to do |
|---|---|---|
An alert from your antivirus or network filter that names chrome.exe and epicunitscan.info | Chrome itself made the request, so the cause is in the browser: an extension, a synced item or a page element. | Go through the extensions and the Chrome sync steps below. |
| The alert returns on another computer after you sign in to Chrome | The cause travels with the Google account's synced data, as in the 2019 Chrome Help thread and the 2024 Reddit post. | Remove extensions first, then reset what Chrome saves in the account. |
| The alert stops when you sign out of Chrome or turn off extension sync | The same: a synced extension or setting. It is the quickest way to confirm it. | Keep sync off while you clean, then turn it on again. |
| A scan finds nothing | Scanners look at files and programs; a browser extension or synced setting may not be reported as a threat. | Do not stop at the scan. Check the extension list by hand. |
| The address opens in a tab on its own | A redirect from a page or an extension. The page will not load now, but the redirect is the sign. | Remove unknown extensions and check Installed apps. |
| Someone tells you it is the trojan Trojan.Patchbrowse | We found no vendor page for that name. Do not pay for a cleaner that quotes it. | Use Microsoft Defender and the steps below. |
Why wiping the computer does not always stop it
Chrome can keep your extensions, settings and more in your Google account and load them on every computer you sign in to. If a bad item sits in that saved data, a clean reinstall brings it back at the next sign-in.
- What Chrome can sync
- Bookmarks, reading list, passwords, payment info, extensions, web apps, settings and preferences, according to Google's Chrome Help
- What people reported
- In the 2019 thread a user wiped a PC and the alert returned as soon as Chrome signed in; with extension sync off it stopped. We have not reproduced this ourselves
- What fixed it for some
- Removing every extension, then clearing the data saved in the account at chrome.google.com/sync, then turning sync on again. One user said it worked "so far"; it is a report, not a tested guarantee
- What it costs
- Clearing the saved data deletes it from your Google account. Back up your bookmarks and export your passwords first
- What we could not confirm
- Which extension or item carried the address. None of the threads names it, and we have no sample
If your Chrome profile is managed by an employer, ask your IT team before you clear anything. In the 2024 post the alert came from a work laptop signed in with a personal account, and mixing the two is part of what makes it hard to trace.
What can go wrong if an unwanted add-on stays
The address on its own is dead, so the danger is the add-on behind it. We do not know what the item behind the alerts did, so these are the risks the old guide named for adware of this kind, not findings about this one.
- High
Redirects to infected pages
The old guide warned that an add-on which redirects the browser can land you on a page that installs malware without a clear prompt. If redirects are happening, stop them first.
- Medium
Browsing details passed to other parties
Adware can send details about you to others for money. The old guide listed IP addresses, email addresses, geolocation, bookmarks and search queries. Whether this item did we do not know.
- Medium
Unwanted changes to the start page
Changes to the home page that come back after you set it again are removed only with the add-on that makes them.
- Low
A slow or crashing browser
A large number of ads draws on system resources, and a browser that cannot keep up may start to crash.
- Low
Pay-per-click ads
Ads delivered by adware are a way of earning money per click for whoever runs it. That is why removing the add-on takes away the income, not only the nuisance.
What the old guide said adware like this may collect
- IP address
- Email addresses
- Geolocation
- Bookmarks
- Search queries
- Browsing history
From our 2019 guide. We could not link this list to epicunitscan.info with any source.
How Epicunitscan.info got into your browser
We have not established how epicunitscan.info itself reached anyone's browser. The routes below are the usual ones for unwanted add-ons, so they are where to look, not a finding about this address.
| Route | How it happens | What to check |
|---|---|---|
| Software bundles | A free program installs an extra add-on as part of its setup. The extra program appears while you download or install the main one, and it is easy to accept without noticing. | Did something free get installed shortly before the alerts began? |
| Third-party download pages | Unwanted content is placed behind secondary download links and suspicious offers on sites that are not the maker's own. | Where did the last installer come from? |
| A synced extension | An extension installed on one device is saved to the Google account and appears on the others. | Look at the extension list on every device you sign in to, not just this one. |
| Skipped installer steps | Setup screens often hide an optional offer behind the Next button. | Choose Custom or Advanced setup and untick extras. |
How to remove Epicunitscan.info
How to stop the Epicunitscan.info redirects
Work in this order and test a few links after each step, so you know which one was the cause.
Which browser shows the ads?
Remove extensions you do not recognise
Paste
chrome://extensionsinto the address bar and click Remove on anything you did not install yourself, especially anything added shortly before the redirects began.Full procedure with screenshots: Remove a browser extension
Reset what Chrome saves in your account
Back up your bookmarks and export your passwords first. Open
chrome.google.com/sync, choose Delete data and confirm with Delete. Then turn sync on again under Settings > You and Google, and checkchrome://extensionsonce more after the first sync.Clear the site data
Press Ctrl + Shift + Delete, choose All time, tick Cookies and other site data and Cached images and files, and click Delete data.
Reset Chrome
Open Settings > Reset settings > Restore settings to their original defaults and confirm with Reset settings. This resets the start page, search engine and pinned tabs and turns off extensions; bookmarks and saved passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove extensions you do not recognise
Paste
edge://extensionsinto the address bar and click Remove under anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear the site data
Open Settings > Privacy, search, and services > Delete browsing data > Choose what to clear, set All time, tick Cookies and other site data and Cached images and files, and click Clear now.
Reset Edge
Open Settings > Reset settings > Restore settings to their default values and confirm with Reset. Extensions are turned off and the start page goes back to default; favourites, history and saved passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove add-ons you do not recognise
Paste
about:addonsinto the address bar, open Extensions, and choose Remove from the three-dot menu of anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear cookies and site data
Open Settings > Privacy & Security > Cookies and Site Data > Clear Data, tick both boxes and click Clear.
Refresh Firefox
Open the menu > Help > More troubleshooting information and click Refresh Firefox. Add-ons and custom settings are removed and the home page goes back to default; bookmarks, history and passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove extensions you do not recognise
In Safari > Settings > Extensions, select anything you did not install yourself and click Uninstall.
Clear the site data
In Safari > Settings > Privacy > Manage Website Data, remove the site's data, or use History > Clear History > all history. To empty the cache as well, turn on Show features for web developers in Settings > Advanced and choose Develop > Empty Caches.
Check the Mac for apps from the ads
Ads also target Mac users with fake players and "cleaners". In Finder > Applications, move anything unknown to the Bin. In System Settings > General > Login Items & Extensions, remove unknown items. Then use Go > Go to Folder to check
/Library/LaunchAgents,~/Library/LaunchAgents,/Library/LaunchDaemonsand/Library/Application Supportfor folders and files with the same unknown names, and empty the Bin.
Then, whichever browser you use
Step 1: Scan the PC if you downloaded anything from the ads
If you only saw the notifications and clicked nothing, you can stop before this step. If a notification led you to download or run something, delete that file, then scan Windows.
In Windows Security > Virus & threat protection > Scan options, run a Full scan, then choose Microsoft Defender Antivirus (offline scan) and Scan now. The offline scan restarts the PC and takes about 15 minutes on Windows 11 and Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
After removal: keep the ads from coming back
How to find and remove it
Do these in order. The first step costs nothing and tells you whether Chrome sync is carrying it.
- 1
Test whether sync carries it
Turn off extension sync in Chrome: open Settings > You and Google > Sync and Google services > Manage what you sync, and untick Extensions. If the alert stops, the cause is a synced extension. Do not turn it back on yet.
- 2
Remove every extension you do not recognise
Paste
chrome://extensionsinto the address bar and click Remove on anything you did not install yourself. Do this in every browser and on every device that uses the same Google account. - 3
Uninstall suspicious programs
Open Settings > Apps > Installed apps in Windows 11 (Apps & features in Windows 10, or Programs and Features in the Control Panel), sort by install date and uninstall what you do not recognise or that appeared before the alerts began (Uninstall a program or app in Windows On uGetFix).
- 4
Scan, then scan offline
Run a Microsoft Defender Full scan, then the Microsoft Defender Antivirus (offline scan), which finds threats that hide while Windows runs. Also run the scan from your own security software.
- 5
Clear what Chrome saved in your account, if it comes back
Back up your bookmarks and export your passwords first. Then open
chrome.google.com/sync, choose Delete data and confirm with Delete, according to Google's Chrome Help, and turn sync on again. Some users in the 2019 thread fixed the alert this way. Check the extension list again after the first sync. - 6
Reset the browser
Clear cache and cookies, then reset the browser to its defaults to remove extensions and restore the home page and search engine. Do this after the programs are gone.
If a page asked for a password or card number while the alerts were running, change that password now and tell your bank. The old advice to use reputable antimalware software still holds: it finds files that a manual check misses.
How to keep it from happening again
Do
- Watch what you download. Read each setup screen, and choose Custom or Advanced setup to untick extra programs and pre-ticked offers.
- Download programs and extensions only from the maker's site, the Microsoft Store or the Chrome Web Store, and read who published an extension.
- Look at your extension list every few months and remove what you no longer use.
- Keep Potentially unwanted app blocking on: Windows Security > App & browser control > Reputation-based protection.
- Keep your security software up to date and let it scan regularly, so threats are found in time.
- Keep a current backup of your files (File History or OneDrive), so an infection or a failed disk does not cost you your documents.
- On public networks, a VPN hides your IP address from the sites and ad networks you visit; it does not block ads or malware.
Don't
- Skip steps in an installer to get to the end faster.
- Sign in to Chrome with a personal Google account on a work computer.
- Install a cleaner or antivirus that a pop-up recommends, or one that quotes the name Trojan.Patchbrowse as a reason to pay.
- Open the address to see what is there. It does not resolve today, and a copy of it in someone else's link may not be the real one.
Questions about Epicunitscan.info
What is Epicunitscan.info?
Epicunitscan.info is a web address that security software blocks, and our 2019 guide called it a potentially unwanted program. It is not a program: reports from 2017 to 2024 describe antivirus alerts that name Chrome as the program asking for the address while a scan finds nothing.
That points at a browser extension or synced item, not a file. On 6 October 2026 the name no longer resolves, and the registry record shows the domain expired on 5 August 2026. We could not find who owned it.
Is Epicunitscan.info a virus?
The address is not a virus, but the alerts can mean something unwanted in your browser. Visiting it installs nothing, and today it does not load at all.
Our 2019 guide linked it to the trojan Trojan.Patchbrowse and noted that 5 of 70 engines on VirusTotal flagged it; we found no vendor page for that detection name and cannot reopen the 2019 result. Treat the alert as a reason to check your Chrome extensions, not as proof of a trojan.
Why does my antivirus keep blocking Epicunitscan.info?
It keeps blocking because something in Chrome keeps asking for the address, and the block does not remove what asks. In the 2019 Chrome Help thread, users found that turning off extension sync stopped the alert and signing in on another computer brought it back.
That means the request can travel with your Google account. Our test could not see the item, because the site no longer loads, so check your extension list and the Chrome sync steps above.
Why does the alert come back after I reinstall Chrome or wipe my PC?
It comes back when the cause is stored in your Google account, not on the computer. Chrome can sync extensions and settings, so a reinstall or a wipe is followed by the same items at the next sign-in.
A user in the 2019 thread wrote that the alert returned as soon as they signed in again, and an IT admin in 2024 said reinstalling did not help. Remove the extensions, then clear the saved data at chrome.google.com/sync. We have not reproduced this ourselves.
How do I remove Epicunitscan.info?
There is no program called Epicunitscan.info to uninstall, so you remove what asks for it. Turn off extension sync as a test, then remove every extension you do not recognise from chrome://extensions.
Uninstall programs that appeared before the alerts began (Settings > Apps > Installed apps on Windows 11), run a Microsoft Defender Full scan and the offline scan, and reset the browser. If it returns after you sign in, clear the saved data at chrome.google.com/sync after backing up your bookmarks and passwords.
Is it safe to visit Epicunitscan.info?
It is harmless today, because the address does not load. On 6 October 2026 our browser reported ERR_NAME_NOT_RESOLVED, and the registry shows the domain on server hold after its expiry on 5 August 2026.
That is one visit, and it says nothing about what the address served in the past. A domain can be bought and put to new use after it is released, so do not trust a link to it, and do not open it to see what is there.
Does Epicunitscan.info steal my data?
We found no source that shows it did. Our 2019 guide warned that adware can pass IP addresses, email addresses, geolocation, bookmarks and search queries to other parties, but that was a risk of adware in general, not a finding about this address.
The reports we read describe blocked connections, not stolen data. If you entered a password or card number on a strange page, change the password and tell your bank. Otherwise, treat it as an unwanted add-on to remove.
Does it work on Firefox, Edge or Safari?
Every report we found names Chrome. Our 2019 guide said the address appears on Chrome more often than on other browsers, and that it could show up on Firefox, Edge or Safari as well.
We found no report for them. Chrome is also the browser whose sync carried the alert between computers. The browser tabs above give the steps for Chrome, Edge, Firefox and Safari, so you can check each one you use.
Is the Epicunitscan.info domain still active?
No. On 6 October 2026 the name did not resolve, and the registry record shows the statuses server hold and redemption period after an expiry on 5 August 2026. Server hold means the domain is not activated in the DNS.
The domain can still be restored by whoever held it, or become free to register after the redemption period, so the answer can change. If your security software still reports it, the item that asks for it is still on your device.
Will Fortect remove Epicunitscan.info?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Epicunitscan.info, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Identity Digital RDAP: epicunitscan.info (read October 6, 2026)
- ICANN: EPP status codes (serverHold, redemptionPeriod) (read October 6, 2026)
- Malwarebytes Forums: epicunitscan.info (February 2017) (read October 6, 2026)
- Google Chrome Community: epicunitscan.info embedded in google profile deemed as High Risk Website (no longer online) (read October 6, 2026)
- Broadcom Community (Symantec Endpoint Protection): epicunitscan.info chrome corrupted (read October 6, 2026)
- Reddit r/antivirus: help, Google Chrome & epicunitscan.info (read October 6, 2026)
- Google Chrome Help: Get your bookmarks, passwords, and more on all your devices (no longer online) (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)