Fake Virus Screen Simulator
A fake security scan with invented threat names, a rising detection count, and a label on screen saying it is simulated.
For parody, education, and mockups only
90 sec
Zero gives a clean result. Every name is invented.
7
No ransom screen
Nothing is scanned and no file is read. The screen says so while it runs, and Escape exits fullscreen at any time.
Everything here runs on your device. Nothing you enter is uploaded or stored.
A fake security scan in three styles, with invented threat names, an uneven detection count, and a label on screen saying it is simulated. Escape exits immediately.
How to use it
- Pick a style: a modern security panel, an old antivirus window, or a console scanner.
- Set how long the scan should run before reporting complete.
- Set how many threats it should find. Zero gives a clean result.
- Press Start. Press Escape whenever you want out.
What this tool deliberately does not have
There is no ransom note. No bitcoin address field, no countdown to file deletion, no payment instructions, no “your files have been encrypted, send three hundred dollars to recover them.”
That is a design decision written into the code rather than left to whoever writes the copy, and the reason is simple: the ransom screen is the template of a real extortion attempt. Publishing a generator for it means publishing a tool whose primary use is making a convincing demand for money from a frightened person, and no disclaimer above it changes what the output is for.
What is left is still the thing people came for. The antivirus-scan window — paths flying past, a rising detection count, a progress bar, a list of alarming names — is what “fake virus screen” actually means to most people, and it works without any of the above.
There is also a line of text on screen at all times saying the scan is simulated and Escape exits. A prank screen that does not admit to being one is a scareware page.
Invented names, correct shape
Threat names follow the real grammar: a platform prefix, a detection type, a family name, and a variant letter. Win32:Injector/Foxglove.K reads as scanner output because the shape is right.
Every family name in the list is invented. None of them name anything that exists, which matters more than it sounds: a screenshot of a scan naming a real malware family can be posted as evidence of a real infection, and it will be believed. The shape carries the effect on its own.
Detections do not tick like a clock
A threat count that increments once per second is a timer, and it reads as one. Real scans cluster their detections — several in quick succession while the scanner is working through a downloads folder, then nothing at all for the rest of the run once it reaches system directories.
So detections here accrue on a curve through the first two thirds of the scan and then stop, while the file count keeps climbing. The detection list is also stable: item three does not change once item four appears, because a list that reshuffles mid-scan reads as random noise rather than results.
The file paths
Every path is generated from a seed, so the sequence is reproducible, and every one of them points at a public or system location — C:\Users\Public\Downloads, C:\Windows\Prefetch, C:\ProgramData\Package Cache. None resolves to a real user profile directory, so no screenshot ever exposes a username.
The path line is truncated from the left when it is too long, with a leading ellipsis, so the filename stays visible. That is what a real scanner does, and it is a small detail that reads wrong when it is missing.
What it does not do
It cannot read a file, cannot quarantine anything, cannot access your system, and cannot prevent you closing the tab. On iPhone there is no Fullscreen API, so the fallback is a fixed overlay with the address bar visible, and the hint says so.
Nothing is uploaded and no permission is requested.
Style reference
| Style | Look | Progress |
|---|---|---|
| Modern security app | Dark panel, blue accent | Bar plus percentage |
| Old antivirus window | Raised 3D border, title bar | Bar plus percentage |
| Console scanner | Plain monospace on black | Text counters only |
Questions
How do I get out of it?
Press Escape. It is bound before the screen appears and works whether the browser granted true fullscreen or fell back to a fixed overlay. The Exit button does the same if there is no keyboard to hand.
Why is there no ransom note or payment screen?
Because that is the template of an actual extortion attempt, and a generator for it would be indefensible regardless of any disclaimer above it. This simulates a scan, which is the antivirus-window genre people actually picture, and the ransom variant is deliberately absent rather than merely unbuilt.
Are the threat names real?
No, and deliberately not. They follow the right shape — a platform prefix, a type, a family name, a variant letter — so they read as scanner output, but every family name is invented. A screen naming a real malware family is one screenshot away from being posted as evidence of a real infection.
Does it actually scan anything?
Nothing. It cannot read a single file. The paths flying past are generated from a seed and all point at public or system directories, so no screenshot ever exposes a username. The file count is arithmetic against elapsed time.
Last updated