Scam - "Zeus Virus Detected" - How to remove

Zeus virus is used in many tech support scams are aimed at Mac users. These scams claim that Zeus was detected on your Mac, that it’s stealing your information, and that your accounts will be suspended if you don’t “take an action”.

Zeus virus scam is meant to scare you into calling fake tech support representatives who will try to sell you fake virus removal services. They’ll also want to gain access to your Mac.

The webpage that displays the Zeus virus scam isn’t dangerous, as long as you don’t follow its instructions. Close it and you’ll be fine.

In short about the Zeus virus Mac scam:

Classification	Tech support scam, phishing scam.
Dangers of the “Zeus virus detected” scam	Wasted time, if you contacted the scammers, then dangerous software being installed, scammers accessing your computer, and scammers stealing your payment and personal information.
How to avoid scams	Avoid shady websites that show aggressive ads, use an ad-blocker or an anti-malware program, close the browser when you see a scam webpage.
Dealing with the Zeus virus Mac scam	Remove malware from your Mac (with Combo Cleaner, Malwarebytes, or other anti-malware apps), contact your bank and get your money back, report the scam.

What is the Zeus virus Mac scam

Tech support scams are webpages that were created by scammers to convince visitors that their computer is infected. Anyone who visits such a website will be told that their device is in danger and that they must call a phone number to take care of the problem.

In this case, the scam says “Zeus virus detected”, as though your computer was just scanned by an antivirus program and is showing an emergency warning:

Warning: ZEUS VIRUS DETECTED !!!

Call Customer Service: [phone number]

A Suspicious TROJAN Was Trying to Access Your Logins, Banking Details & Tracking Your Internet Activity.

Zeus is a real banking trojan. It only works on Windows PC, though, so I’m not sure why the scammers chose it for their scam that’s aimed at Mac users.

That phone number that the “Zeus virus detected” warning is showing does not belong to Apple; it belongs to a third-party “support” company, the scammers. These scammers try to pretend to be the official Apple support so as to make people trust them.

Scammers create these “Zeus virus detected” warnings and post them online. They copy the look and feel of real Support.apple.com weboages for their scam. Then they advertise the scam online, where random people happen upon it.

How the “Zeus virus detected” scam works

Basic features of the scam

This “Zeus virus detected” scam is very similar to the Error # FXX000 scam:

• It is a webpage displayed in your browser. It appears while you’re browsing the web.
• It expands to full screen, making it difficult to leave the webpage.
• It hijacks your mouse cursor, making it go invisible.
• It constantly shows new pop-ups with various warnings.

The “Zeus virus detected” page can be difficult to close, it’s so persistent that it might get a bit scary. Don’t worry, there are ways to close even the most aggressive and persistent webpages.

Dangers of the scam

So, some people get scared by the “Zeus virs detected” scam, call the given phone number, and say something like “Hey, I saw this warning that my Mac is infected with Zeus virus”. Then, the scammers start their script:

• They try to convince the victim that their computer is indeed infected.
• They tell the caller to install remote access software and allow the fake tech support agent to access the Mac (Fastsupport). Often, scammers use this access to install spyware and to steal private files.
• Scammers pretend to examine the Mac and find more malware. They offer to sell a security package or continued support – for hundreds of dollars.

In short, the “Zeus virus detected” scam costs time, it can cost money, and it could even allow scammers to steal their victims’ personal information.

Here’s another example of the scam page posted by a user on the Apple discussion forums:

How to deal with the “Zeus virus detected” scam

Avoid suspicious websites

First, if you see a warning about your Mac being infected and are not sure whether it’s real or not, visit the actual Support.apple.com site and create a question there. The regulars there have seen many scams and can recognize one right away.

Use an anti-malware app that has a web filter to block malicious websites. You could also use an ad blocker and block pop-ups, as that’s how tech support scams usually spread.

Some versions of the “Zeus virus detected” scam may ask you to type in your password. Don’t do it.

Exit the scam page

What if the “Zeus virus detected” page has taken over your screen and you can’t close it?

• Spam the Escape key (Esc on your keyboard) until the browser’s user interface appears. Then just press the ‘X’ button to close the site.
• Force quit the browser.
  1. Press the Cmd, Alt, and Esc buttons at once and the Force Quit Applications window will come up.
  2. Select your browser (Chrome, Safari, Firefox, etc.) and press the Force Quit button.
  3. Then when starting the browser next time, do it while holding down the Shift key on your keyboard to prevent Zeus virus Mac scam from being opened again.

More advice can be found in this post on how to fix locked browser issues.

Recover from an attack

If you did invite the scammers to connect to your Mac, the first thing to do is to disconnect your computer from the internet or to shut it off. If your computer is off, then malware can’t do anything to it.

Next, you can restart it in safe mode (hold the Shift button while turning on your Mac) and uninstall any app that the scammers had you install. You can also use an anti-malware app like Combo Cleaner, Malwarebytes, or another program that you trust to scan your computer. Remove any malware or potentially unwanted app that these scanners detect.

If you ended up paying the scammers, then you should contact your bank and ask for help. They might be able to recover your money and advise you on how to best report this incident. Reporting is important: the “Zeus virus detected” scam being on an official record will help you defend yourself if your personal information is abused in the future.

Automatic Malware removal tools