Clean-your-pc.xyz fake McAfee scan: what it is and what to do

What Clean-your-pc.xyz is, and what the page was built to do

Clean-your-pc.xyz is a fake security-scan page. Nobody goes there on purpose: people are sent to it from other pages, it shows a made-up scan in the name of a well-known antivirus brand, and it tries to sell a "renewal" or push a download. Seeing it does not mean your computer is infected.

1. 1

   You are sent there

   A click on a link on another malicious or low-quality site, or an adware program running quietly on the computer, opens the address in your browser. The old guide describes both causes; the reason for the redirect can differ from case to case.

2. 2

   A scan seems to run

   The page shows a window styled as McAfee or Norton counting files and "threats". It runs inside the browser tab: a web page cannot look through the files on your disk.

3. 3

   The result is always bad

   The page says several viruses were found and that your security licence has expired. The aim is the next click: a paid renewal or a program labelled as a fix.

4. 4

   The pitch pays the people behind the page

   The old guide called it a pay-per-install scheme. What the offered program does is the risk: it can be a fake copy, or a program that installs other malware or records what you type. We never had a sample to analyse, so we do not say which.

Address

clean-your-pc.xyz

Brands it used

McAfee (the screens in our pictures) and Norton (named in the old guide). Neither company runs this page

What the old guide called it

A fake virus scam reached by redirects, in the same family as Yourdatasecurityservice.com, Allowpcprotect.com and Secureform.xyz. We did not re-check those three names and make no claim about them

Current registration

20 September 2025, registrar GMO Internet Group (Onamae.com); expires 20 September 2027 (RDAP record read on 6 October 2026)

Last change to the record

21 September 2026

Who owns it

Not shown in the public record, so we name no owner

Our guide was written in March 2022, but the registry says the current registration of the name began in September 2025. The name must therefore have been registered by someone else earlier, or released and registered again; the record does not say which, and we do not know who ran the 2022 page.

Clean Utility xyz, pcy.xyz and other .xyz scan pages

Some readers land here after searching for clean utility xyz or pcy.xyz.

We found no reliable source that ties either name to Clean-your-pc.xyz, and we did not test them. We cannot say they are the same operator. Our reading is that they belong to the same kind of page: a cheap .xyz address that shows a fake scan or a fake alert.

The .xyz ending is not the problem. It is an ordinary domain ending that scammers like because it is cheap. Plenty of honest sites use it. Judge the page by what it does, not by the ending.

Treat any page as a scam if it says your PC has viruses, shows a countdown, plays an alarm, or tells you to call a number or install a cleaner. A real browser never scans your computer from a web page. Close the tab. If it will not close, end the browser from Task Manager and do not restore the session.

If the same page keeps returning, check Settings, Privacy and security, Site settings, Notifications in your browser. Remove any site you do not know. Then remove unknown extensions and run a Defender scan as described above.

Our test on 6 October 2026

We tried to open the address the way a visitor does, in a clean desktop Chromium profile from Lithuania. The browser could not find the site, so there was no page to test.

What the fake scan says, line by line

The old guide says scare tactics such as timers, threats of dangerous consequences and warnings about stolen accounts are common on these pages, and that they push people into downloading malicious applications offered as security tools. It also names the trick of using familiar security names to make the page look legitimate.

What we know about the address, in order

1. 29 March 2022

   Our first guide, with two pictures

   We published the guide on 29 March 2022. It described the page as a fake virus scam and listed three similar sites it said were probably run by the same people. The first picture shows the fake McAfee Quick Scan with 2 risks; the second shows the "5 viruses" box and the expired-subscription message.

   

2. 2022

   The second screen of the same page

   After the scan, the page showed a box with a Proceed button. The picture is the one from our guide; the woman in it is a stock-style photo added to the illustration, not part of the scam.

   

3. 20 September 2025

   The current registration begins

   The RDAP record gives 20 September 2025 as the registration date of clean-your-pc.xyz, three and a half years after our guide. Whoever held the name in 2022 is not shown.

4. 21 September 2026

   The record last changed

   The registry shows a change on this date, the statuses active and auto renew period, and name servers named onamae-expired.com. It does not say what the change was.

5. 6 October 2026

   Our new check: the name does not resolve

   Our browser got ERR_NAME_NOT_RESOLVED, and a DNS query to 1.1.1.1 returned SERVFAIL. We saw no page.

What it means when you see this page

The page itself tells you nothing about your computer. What matters is how you got there and what you did next.

What can go wrong, and what usually does not

Only visiting a page like this is very unlikely to infect a fully updated computer. The damage comes from what you do on it.

• High

  Paying a fake subscription

  The old guide names loss of money through fake subscriptions as the main harm. A card number typed into the page is in the hands of whoever runs it.

• High

  Installing the "fix"

  The offered program can be a fake version, or malware that installs other malware or records keystrokes and other sensitive details, as the old guide warns. We could not test what the 2022 download did.

• Medium

  Disclosing your details

  Typing in your email, phone number or passwords can lead to further phishing attempts. If you gave a password, change it everywhere it is used.

• Medium

  Redirects to other scam sites

  The old guide lists redirects to other suspicious or malware-laden websites and fake messages offering malicious downloads.

• Low

  Infection by only opening the page

  The old guide says it is highly unlikely that your system gets infected just by entering a site that shows fake notifications, and that with a fully updated system and patched software it should not happen. A browser or system that is out of date is the exception, so update first.

The old guide says nobody lands here by choice. We have no list of the sites that sent people to this address, so these are the routes it describes, not a finding about each victim.

The old guide also says a reputable ad blocker can stop malicious scripts from running, with a cost: broken page elements and no income for legitimate sites that live on ads. Frequent encounters with ads and scam material can also be a sign of adware, so it is worth a look even when you got here only once.