Severity scale:  

Zeus virus. How to remove? (Uninstall guide)

removal by Linas Kiguolis - - | Type: Trojans

Zeus virus is still active in 2017

Zeus virus

Zeus virus is a Trojan horse[1] which has been known as a truly malicious computer virus used by cyber criminals to collect confidential data.

The main target of this virus is people's banking data and similar financial information. However, this name has also been discussed for scams initiated by cyber criminals. If you receive an alert telling that You Have A ZEUS Virus, Windows Detected ZEUS Virus or similar alert claiming that Zeus virus detected on your computer, be sure that you are dealing with the scam.

When dealing with Zeus virus scam on your browser, you can also be informed about YahLover.worm and similar invented threats. Be sure to ignore such tech support scams because their primary aim is to swindle your money by tricking you into calling specific numbers. Once you do that, you are connected to fake technicians who will do their best to lengthen the conversation and increase your phone bill. Besides, they can infect your computer with malware.

The real Zeus virus

Alternatively known as Zeus Trojan, the virus was detected over ten years ago. Since then, it has been continuously evolving and using newly launched stealth techniques to prevent detection.

Looking at their functionality, Trojan horses do not drift far from their initial purpose in Greek mythology[2]: they silently infiltrate computers and wait for the right moment to exploit the infected PC system. They communicate with their C&C servers to get the latest updates needed to work properly, and can easily execute such commands as rebooting or restarting computer, deleting system files, etc.

Once inside the system, Zeus virus typically uses keylogging and form-grabbing techniques to steal sensitive information. However, the latest discussions about this virus are more related to scams than the real system attacks.

If you got a warning message telling that “You Have A ZEUS Virus”, it doesn't mean that you have this trojan horse on your computer. The real virus aims to steal information, so it does everything to stay on the system unnoticed.

As we have already said, chances are that you are dealing with one of Tech support scam viruses that have been seeking to scare their victims into believing that they need to call to “Microsoft” tech experts to save their computers.

Once you fall for Zeus virus scam, the only people you contact are scammers who are trying to earn more money via telephone services. Besides, they can install malware on your computer.[3] informs that these scammers aggressively attack German-speaking computer users.

Due to its versatility, the virus has even acquired a few different names, including ZeuS, Zbot and its later spin-off GameOver Zeus[4]. Regardless of what version of this malware has infected your PC, you must remove it from the computer immediately because it can steal your system information, login information and banking data.

Questions about Zeus virus

Technically, you could find Zeus on Mac OS X but security experts haven't noticed such cases yet. However, the virus has been infecting only Windows OS. To execute Zeus virus removal as thoroughly as possible, we highly recommend you to select only the best antivirus software and steer clear of shady programs. We recommend using Reimage or Malwarebytes MalwarebytesCombo Cleaner 

Modus Operandi of trojan horse

First of all, the virus makes sure that its components are safely deployed and hidden on the system. The location on which Zeus virus loads up its files depends on the version of the malware and whether it manages to take over the PC’s administrative privileges.

If it does, the virus will supplement the %System% folder by dropping one of the following executables: twext.exe, sdra64.exe, ntos.exe, oembios.exe or pdfupd.exe. Otherwise, the virus activation files will be installed on the %UserProfile%\Application Data folder and hidden from the user.

Once the infiltration is done, the virus implements its malicious script into the legitimate system processes, such as winlogon.exe, explorer.exe or svchost.exe which makes it harder to spot the malware, no matter which detection method, manual or automatic, you decide to use.

While running on the system undetected, Zeus will make unauthorized system changes, create new Registry entries or install additional software without user’s permission. Most importantly, however, it will collect, store and transmit personally identifiable information, online banking credentials, social media account usernames and passwords, etc.

During the first years of its appearance, it was mainly used to work against the United States Department of Transportation and collected its data. But the malware has come a long way since then, and its focus has shifted exceptionally towards the online banking exploitation. Now, Zeus virus is known as one of the most successful malicious botnet ever created, and its developer does not give up the top ranks of the FBI’s most wanted list[5].

To be fair, the virus can be programmed to extract almost any information its creators desire and send it directly to the virus Command and Control server[6] for further management.

If you notice that your computer started behaving unusually, for instance, slowdowns or malfunctions prevent you from using your device properly, make sure you inspect the device with a reliable antivirus tool. If you are really infected, it will find and remove Zeus virus from the system.

Follow expert tips to avoid installing the infamous Zeus virus

Currently, malware and most of its follow-up versions are spreading with the help of Zeus virus spam campaigns. Typically, the virus uses names of the well-known delivery services such as Fedex or Royal Mail to trick users into downloading the infected email attachments that are initially disguised regular Word or PDF documents.

Also, the virus may take advantage of malvertising and infiltrate computers in form of a useful update or free version of some well-known application. Finally, the experts also warn about the threat of the virus being delivered on the computer via Sundown or RIG exploit kits which is a popular and successful system infiltration tools used by ransomware and other serious viruses.

We should also exclude these tech support scams using ZEUS name to scare PC users. If you have been seeing such fake alerts, you are infected with adware. The removal procedure of such viruses, just like their infiltration method, is almost the same.

To prevent potentially unwanted programs that can hijack your web browser and start causing fake pop-up ads, you need to be very careful with the freeware, shareware and similar software. Also, keep in mind that adware-type programs have been actively spread with the help of spam.

Such emails can tell you that you must install one “useful” add-on to greatly improve your browsing on the Internet. Please, do NOT do that because you can end up with the unwanted software.

Remove Zeus virus from your home or work PC

When it comes to Zeus virus removal procedure from the infected system, keep in mind it has to be quick and very precise. It is not a malware you can play around with because your privacy and even financial status are at stake every minute the trojan horse is on your computer.

Thus, you should use updated and legitimate security software, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes. Make sure these programs are updated before performing a scan to remove Zeus from your computer fully. They can also help you get rid of the fake alerts reporting about this virus on your computer.

Keep in mind that “You Have A ZEUS Virus”, “Windows Detected ZEUS Virus”, “RDN/YahLover.worm!055BCCAC9FEC infection” and similar alerts are FAKE. They must be ignored because they are just tool used to swindle users' money.

However, before you launch anti-malware software, you have to perform one extra step to ensure a precise malware removal. Restart your PC in a Safe Mode with Networking first. The tutorial provided below explains how to do it.


do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove Zeus virus, follow these steps:

Remove Zeus using Safe Mode with Networking

  • To remove Zeus virus, restart your computer in Safe Mode (with Networking).
  • Download and launch preferable anti-malware software. Run a system scan with it to detect the malicious Zeus program. Make sure you use an up-to-date anti-malware!
  • Once the anti-malware software detects the virus and removes it, change your login details, passwords, and also logins used to log into your bank account. We highly recommend resetting your browsers as well.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Zeus

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Zeus removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Zeus and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Linas Kiguolis
Linas Kiguolis - Expert in social media

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Linas Kiguolis
About the company Esolutions


Removal guides in other languages