28

I am unable to completely uninstall the Zoom meeting app from my Mac running macOS Mojave.

I once installed the Zoom meeting app. Then I deleted it from Applications directory. Now, every-time I open a zoom meeting in Google Chrome, the Zoom app gets reinstalled automatically! Terrible...

So I investigated from where and how it has permission to reinstall and I found out they created a hidden folder .zoomus containing ZoomOpener.app and there is a ZoomUsPlugIn.plugin in ~/Library/Internet Plug-Ins directory.

Question: I have deleted the following 4 files:

  • zoom.us.app from /Applications directory.

  • zoomusInstaller.pkg from ~/Downloads directory

  • ZoomOpener.app from hidden .zoomus in home dir

  • ZoomUsPlugIn.plugin from ~/Library/Internet Plug-Ins directory. directory

But it still gets reinstalled. How can I completely uninstall it?

EDIT 2

the support now gave me this script to run: I ran it but it still gets installed again after opening a meeting... this is the worst app i have ever used...

official zoom support drive: https://drive.google.com/drive/folders/1MP0cNLyJjzPLNrvNDCZv9hRuif091f0c

currently i run this script to uninstall, to no success

#! /bin/bash
echo Cleaning Zoom...
echo Cleaning Application Cached Files...
sudo rm -rf ~/Library/Application\ Support/zoom.us
echo Cleaning Application..
{
  sudo rm -rf /Applications/zoom.us.app
  sudo rm -rf ~/Applications/zoom.us.app
  sudo kextunload -b zoom.us.ZoomAudioDevice
  sudo rm -rf /System/Library/Extensions/ZoomAudioDevice.kext
} &> /dev/null

echo Removed Application...


{
    sudo rm -rf ~/Downloads/zoomusInstaller.pkg
    sudo rm -rf /Applications/zoom.us.app
    sudo rm -rf ~/Desktop/Zoom
    sudo rm -rf ~/Library/Application Support/zoom.us
    sudo rm -rf ~/Library/Caches/us.zoom.xos
    sudo rm -rf ~/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin
    sudo rm -rf ~/Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin
    sudo rm -rf ~/Library/Logs/zoom.us
    sudo rm -rf ~/Library/Logs/zoominstall.log
    sudo rm -rf ~/Library/Preferences/ZoomChat.plist
    sudo rm -rf ~/Library/Preferences/us.zoom.xos.plist
    sudo rm -rf ~/Library/Saved Application State/us.zoom.xos.savedState
} &> /dev/null

echo Other stuff...

and i kill the process:

ps -eaf | grep -i [z]oom

EDIT 3

i ran all scripts and killed the process, now one day later, I open another meeting via chrome and... again the installer runs. I am furious

Post is related to a rapidly changing event.

11

Idea #1 - clearing out files

I noticed even after clearing out all the files that matched my find queries.

find all files
$ find . -type f |&grep -iE "zoom|zoom.us"
find all directories
$ find . -type d |&grep -iE "zoom|zoom.us"

You can look at this output to figure out files to delete. This removed most of the Zoom.us cruft:

$ rm -fr ~/Library/Application\ Support/zoom.us \
    ~/Library/Logs/zoom.us Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin \
    ~/.zoomus/ \
    ~/Library/Logs/zoom* \
    ~/Library/Caches/us.zoom.*

Idea #2 - kill the zoom process

Finally I noticed that there was a Zoom.us app still running:

$ ps -eaf | grep -i [z]oom
  502 42920     1   0  7:49AM ??         0:00.77 /Users/smingolelli/.zoomus/ZoomOpener.app/Contents/MacOS/ZoomOpener

If I killed this app the behavior stops.

$ kill 42920

Idea #3 - Follow advice regarding Zoom Launcher Plugin

I do not have this plugin installed and have followed my advice from idea #1 & #2. When I access the "Join Test Meeting" link in Chrome I'm greeted with this page:

ss1

The bit that I find interesting on that page is this blurb:

Please click Open zoom.us if you see the system dialog.

If you search for that phrase on Google you'll end up on this page titled: Zoom Launcher Plugin.

Zoom Launcher via Launch Application

If you are using Google Chrome, Mozilla Firefox, or Apple Safari to join or host a meeting, you will see a dialog box to launch the Zoom application. You can click on the Remember my choice and then Launch Application.

If you look through this page they show how to repair their browser plugin, I suspect you may still have some portion of this running as well, or at least some preferences. You can try following their directions to deal with "issues" related to their plugin. Here's Chrome's but all the popular browsers appear to have this plugin/extension available.

Issues with Zoom launcher plug-in:

On some occasions where the plugins may not be activated, disabled or may not be correctly installed, or installed correctly but failed to run. There are several things you can do to fix it: Check if the Zoom launcher plugin is enabled (re-enable if it was disabled)

Google Chrome:
  1. In the address bar, enter chrome://plugins/ or chrome://extensions/ on later versions of Chrome.

  2. Where it lists "zoom.us launcher plugin" make sure it is enabled and always allowed.

  3. More details on Chrome Plugins

References

  • 8
    That's some nefarious s/w right there. – slm Apr 25 at 12:31
  • 1
    @Shlomo - there may still be a lingering bit that starts this upon login/boot. – slm Apr 25 at 12:37
  • 1
    @Shlomo check /Library/LaunchAgents and /Library/LaunchDaemons – Kevin Apr 25 at 17:43
  • 2
    So they hide a folder by starting it with dot, and also use "zoomus" instead of zoom.us. I note this folder is not in the factory proscribed list of directories to delete. – Harper - Reinstate Monica Apr 25 at 18:09
  • 2
    @ChaimEliyah - yeah that's where I'm at w/ them as well. We have vendors that use it and I always bring this up. Most are blown away. – slm Jun 8 at 12:26
9

Apple will remove this for you if you have enabled keep system files updated.

enter image description here

sudo softwareupdate --background-critical

To check your MRT Configuration Data updates, you can do that as well. Version 1.54 is the version that wrangles ~/.zoomus

system_profiler SPInstallHistoryDataType | grep -A 5 MRTConfigData

The remainder of this article applies to double check Apple and/or force removal and understand a bit more on what is running under the hood.

An installer that clears out this program that used to be installed is available - so you can clean manually as before below if you don't want to have zoom (or uninstalled it already).

If you want to use the software, just update or install the version from 9 July 2019 - https://zoom.us/download#client_4meeting

Before 9 July, the zoom installer was indistinguishable from malware in that it installs files and folders not part of a system manifest before the installer is approved to run. Then this “hidden” process opens a network port for a command and control server to receive requests and not ask the user before installing software or start up the camera and microphone. This listener can also re-install the main zoom program. I know the company says it's goal is to help users, but why not document this and get opt in from the computer admin account before taking these actions?

Until the vendor has a proper uninstaller, you should also delete and put a file in place to prevent the Zoom app from re-installing this persistent agent.

rm -r ~/.zoomus
touch ~/.zoomus

The first command recursively removes the process that listens on port 19421 and the second prevents the current installer from re-installing this "agent" if you choose to not uninstall the app. Once the above steps are done, you should restart your Mac if you're not comfortable finding and killing the web server that listens on the port 19421.

We have tested this fairly rigorously, and removing this process - killing it and blocking it has no effect on the desirable function of the app, so if you need zoom or want to use it - cleaning this up to prevent A privacy breach or unintended reinstall is encouraged.

  • 1
    Nice answer. I was literally only asked about this earlier this morning, so you've probably saved me hours and a whole heap of stress trying to sort it out! :) – Monomeeth Jul 9 at 4:12
  • @Monomeeth I haven’t tested this thoroughly, but believe this is all you need to regain control / patch the privacy exploit. – bmike Jul 9 at 4:26
  • 1
    Apple's stepping in on this now - theverge.com/2019/7/10/20689644/… – slm Jul 11 at 2:04
4

It's noteworthy that ZoomOpener.app runs a webserver on port 19421 that persists even after you uninstall the zoom.us app for OSX. You can verify whether the webserver is running on your machine by running this command:

lsof -i :19421

A security vulnerability with the webserver was recently discovered, patched, opened again via regression, and patched again. My personal opinion is that this app (and any app that runs a webserver as a background process after you uninstall it) should be classified as malware and treated accordingly.

I was able to kill the webserver process following slm's steps #1 and #2 above.

2

Following is a list of files removed when uninstalling Zoom meeting client installed via Homebrew:

/Applications/zoom.us.app
~/Desktop/Zoom
~/Library/Application Support/zoom.us
~/Library/Caches/us.zoom.xos
~/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin
~/Library/Logs/zoom.us
~/Library/Logs/zoominstall.log
~/Library/Preferences/ZoomChat.plist
~/Library/Preferences/us.zoom.xos.plist
~/Library/Saved Application State/us.zoom.xos.savedState

You can try to go through the mentioned directories and delete the files present to see if that resolves your issue.

  • i ran these but it still gets reinstalled.... i also restarted my mac and restarted chrome after – Shlomo Apr 25 at 12:19
  • @Shlomo Whew. How about using AppCleaner to uninstall Google Chrome and see if that fixes things? Make sure to backup any critical Chrome data such as bookmarks beforehand. – Nimesh Neema Apr 25 at 12:20
  • i dont want to uninstall chrome – Shlomo Apr 25 at 12:21
  • Confirmed I removed all the above and it still re-installs w/o prompts. – slm Apr 25 at 12:22
  • @Shlomo That's reasonable. If I was in this situation, I'd attempt to contact Zoom support at this point. – Nimesh Neema Apr 25 at 12:23
2

This is the copy-and-pasteable "one liner" that I used to remove ZoomOpener, which was still running even after uninstalling Zoom:

pkill ZoomOpener; \
osascript -e 'tell application "System Events" to delete login item "ZoomOpener"'; \
rm -r ~/.zoomus

If you need to keep Zoom installed, then touch ~/.zoomus to prevent ZoomOpener from being reinstalled.

0

Install Homebrew and run:

$ brew cask install zoomus
$ brew cask uninstall zoomus

cask install should replace the existing install with the cask version which allows for cask uninstall to successfully uninstall Zoom.

  • Just running the second line (uninstall) should be fine, even if you didn’t install it via cask. You might want to run brew update before to get the latest version of the formula. – Frederik Jul 11 at 7:14
-2

Did you try contacting Zoom. I am pretty sure that this is an approach that they adopt so that they don't lose the users.

The same happened with me with Chrome. I had to format my Mac. I never installed Chrome again.

  • 1
    yes as I stated – Shlomo Apr 29 at 9:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .