Fake Microsoft security scans trick victims into uninstalling their antivirus

A wave of websites is offering to check whether your antivirus is working. They call themselves SysScan , carry Microsoft branding, and all reach the same conclusion: Your computer has serious problems, and the cause is the antivirus software you installed.

Windows, they claim, no longer supports third-party antivirus. Uninstall it immediately.

That is false, and it is the first step in a refund scam designed to get victims onto the phone, remove their security software, and ultimately hand over personal, banking, and remote-access information.

We found eleven of these sites on a single host. Although the names vary, the sites work in essentially the same way: Run a convincing-looking but fake security scan, tell the victim their antivirus is causing problems, collect their information, and prepare them for a supposed refund call.

What to know if you see one of these scans

A website cannot run a real security scan. It can only read basic browser data like your operating system, screen size, and approximate location—not check for malware, memory issues, or missing security patches.

Microsoft still supports third-party antivirus software, and legitimate refunds never require you to uninstall security tools or install remote-access software.

If a site tells you to do any of that, close it immediately.

Technical analysis

The scan reads real data and draws invented conclusions

Part of what makes the scam convincing is that the page does measure some real things.

It reads information that a browser legitimately exposes—your user agent, screen dimensions, device memory, processor count, permission states, network information, available web features, and some page performance timings. That allows the results to appear specific to your machine.

But the security conclusions aren’t connected to those measurements.

Fifty of the findings are fixed text written into the page, grouped in blocks that the developer labelled as fake checks.

A wave of websites is offering to check whether your antivirus is working. They call themselves SysScan, carry Microsoft branding, and all reach the same conclusion: Your computer has serious problems, and the cause is the antivirus software you installed.

Windows, they claim, no longer supports third-party antivirus. Uninstall it immediately. That is false, and it is the first step in a refund scam designed to get victims onto the phone, remove their security software, and ultimately hand over personal, banking, and remote-access information. We found eleven of these sites on a single host.

Although the names vary, the sites work in essentially the same way: Run a convincing-looking but fake security scan, tell the victim their antivirus is causing problems, collect their information, and prepare them for a supposed refund call.

What to know if you see one of these scans A website cannot run a real security scan. It can only read basic browser data like your operating system, screen size, and approximate location—not check for malware, memory issues, or missing security patches. Microsoft still supports third-party antivirus software, and legitimate refunds never require you to uninstall security tools or install remote-access software.

If a site tells you to do any of that, close it immediately. Technical analysis The scan reads real data and draws invented conclusions Part of what makes the scam convincing is that the page does measure some real things.

It reads information that a browser legitimately exposes—your user agent, screen dimensions, device memory, processor count, permission states, network information, available web features, and some page performance timings.