{
  "slug": "zeus-virus-detected-alert",
  "canonical_name": "\"Zeus Virus Detected\" Windows Defender alert page",
  "family": "tech-support-popup",
  "impersonates": {
    "brand": "Microsoft (Windows Defender)",
    "disclaimer": "Microsoft is not involved; criminals impersonate the brand.",
    "official_fraud_page": "https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435"
  },
  "goal": [
    "callback",
    "remote-access",
    "payment"
  ],
  "channels": [
    "web",
    "call"
  ],
  "summary": "A browser page styled as a Windows Defender alert: \"Zeus Virus Detected In Your Computer\", do not shut down, call technical support now. The page locks the browser; the number leads to a remote-access sale. Documented in 2017; the template still circulates with other virus names.",
  "status": "archived",
  "first_seen": "2017-04",
  "last_seen": "2017-04",
  "recognise": [
    "A web page claims to scan your computer — a page cannot",
    "Capital letters, alarms, and a toll-free number",
    "Closing the tab or the browser fixes it"
  ],
  "variants": [],
  "specimen": {
    "date": "2017-04",
    "channel": "web",
    "from": null,
    "reply_to": null,
    "subject": "Windows Defender Alert: Zeus Virus Detected In Your Computer !!",
    "attachment": null,
    "body_text": "Windows Defender Alert: Zeus Virus Detected In Your Computer !!\nPlease Do Not Shut Down or Reset Your Computer.\nThe following data will be compromised if you continue: 1. Passwords 2. Browser History 3. Credit Card Information 4. Local Hard Disk Files.\nThis virus is well known for complete identity and credit card theft. Further action through this computer or any computer on the network will reveal private information and involve serious risks.\nCall Technical Support Immediately at (888) 202-7560\nCall Microsoft Technical Department: (888) 202-7560 (Toll Free)",
    "redactions": [],
    "image": "/wp-content/uploads/fake-zeus-virus-detected-alert.png",
    "sources": [
      "https://soft2secure.com/knowledgebase/zeus-virus-detected-alert-scam"
    ]
  },
  "tells": [
    {
      "n": 1,
      "anchor": "body",
      "text": "A web page cannot detect a virus on your computer"
    },
    {
      "n": 2,
      "anchor": "body",
      "text": "\"Do not shut down\" — because shutting down ends the scam"
    },
    {
      "n": 3,
      "anchor": "body",
      "text": "Microsoft does not put phone numbers in alerts"
    }
  ],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [
      {
        "value": "+1 (888) 202-7560",
        "first_seen": "2017-04",
        "last_seen": "2017-04",
        "sources": [
          "https://soft2secure.com/knowledgebase/zeus-virus-detected-alert-scam"
        ]
      }
    ],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not call; close the tab, or close the browser from Task Manager if the page blocks it",
      "Run your real antivirus if you want reassurance"
    ],
    "if_called_or_paid": [
      "Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device",
      "Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers",
      "Expect a call-back from a \"refund department\" — that is act two of the same scam. Hang up"
    ],
    "report_links": [
      {
        "label": "Microsoft: protect yourself from tech support scams",
        "url": "https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435"
      },
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2017-04-13",
      "type": "specimen",
      "title": "Specimen №1: the Zeus alert page with a toll-free number",
      "text": "The guide quoted the page text and the number, and documented the browser-lock behaviour.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/zeus-virus-detected-alert-scam"
      ]
    },
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Grew out of the 2017 guide. Current versions of the same page are tracked under the Microsoft / Apple call-us family.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "microsoft-tech-support-popup"
  ],
  "sources": [
    "https://soft2secure.com/knowledgebase/zeus-virus-detected-alert-scam"
  ],
  "legacy_urls": [
    "/knowledgebase/zeus-virus-detected-alert-scam"
  ],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/zeus-virus-detected-alert",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}