3

I installed the GoToMeeting.app because a client used it. I no longer need it, but I can't seem to remove it. Its burrowed in worse than most malware found on a PC.

I tried a simple drag and drop from the Applications folder to the Trash, but that did not work.

I then dropped into the command line:

$ ls /Applications/Go*
/Applications/GoToMeeting:
GoToMeeting (3019).app  GoToMeeting (3356).app
GoToMeeting (3277).app  GoToMeeting (3499).app
$

Then:

$ sudo rm -rf /Applications/GoToMeeting*
$ ls /Applications/Go*
$

Finally, reboot and then:

$ ls /Applications/Go*
GoToMeeting (WWW).app  GoToMeeting (XXX).app
GoToMeeting (YYY).app  GoToMeeting (ZZZ).app
$

So I get another set of them.

Something is running in privileged mode, and it seems to be hiding itself:

$ sudo find /Library -iname GoToMeeting 2>/dev/null
$
$ sudo ps -A | grep -i GoToMeeting
13644 ttys000    0:00.00 grep -i GoToMeeting
$

The hit above is the terminal session searching for the process.

How do I completely remove this application?

  • Have a look at: How do I uninstall GoToMeeting on my Mac? – user3439894 Sep 22 '15 at 1:50
  • Thanks user3439894. Based on the behavior I am seeing, I don't believe its a complete remediation. That is, I don't believe it will completely remove all the application components (otherwise, nuk'ing it from the command line would have worked). Where can I find a list of the malware included with their primary GoToMeeting.app? – user83961 Sep 22 '15 at 2:18
5
+50

It's in your user library. Try this:

rm -fv ~/Library/LaunchAgents/com.citrixonline.GoToMeeting.G2MUpdate.plist

rm -rfv ~/Library/Application\ Support/CitrixOnline/
  • Thanks. That appears to be it. How did GoToMeeting re-install itself into /Applications? That's protected and requires privileges, but I was never prompted with a sudo. (And its the reason all my find's occurred in /Library, and not ~/Library). – user83961 Oct 2 '15 at 21:59
  • If your user is an admin, it has explicit write permissions for /Applications/: drwxrwxr-x+ 79 root admin 2686 Oct 2 20:17 Applications Since the launch agent runs as you, it write to /Applications/. – Jay Thompson Oct 3 '15 at 0:19
  • Since the program run by the launch agent runs as your user, it can also write to /Applications/ I can't English today. – Jay Thompson Oct 3 '15 at 0:35
  • "Since the program run by the launch agent..." - OK, this appear to be another related issue. I use Loadables to track startup programs, but it never reported anything for my user account. Additionally, Apple's Users & Groups settings applet did not report it. – user83961 Oct 3 '15 at 5:16
  • I'm not familiar with Loadables (although it looks useful), so I'm not sure why it didn't show up there. The items listed under Login Items in the Users and Groups prefpane are not launch agents. Those items are just entries in ~/Library/Preferences/com.apple.loginitems.plist. – Jay Thompson Oct 3 '15 at 16:28

You must log in to answer this question.