Quick Guide: Check for and Remove Zoho Assist

Tags zoho rat

What is Zoho Assist?

Zoho Assist is a remote assistance software that has legitimate uses, but it is also sometimes installed inadvertently or by attackers. Used maliciously, it could grant attackers access not just to your computer but also to any online accounts and services you access through the computer. The purpose of this article is help you determine if Zoho Assist is installed on your Windows computer and remove it.

Zoho Assist will normally appear in the Installed Apps settings panel, but attackers sometimes take steps to hide it. Because of this, we describe three ways to help detect it, and you should check all of them.

 

How to check if Zoho Assist is installed

Detection Method 1: Check Installed Apps

The first place to check is the Installed Apps panel.

You can open this through clicking the windows Start Menu and then searching "Installed Apps" or "Add or Remove Programs" as shown below. Once you locate this, click on Open.

Uploaded image

In the Installed Apps panel, search for "Zoho" and check to see if you see any applications, below is an example of what it might look like. You may also want to sort your applications by date to look for those most recently installed.

Uploaded image

If you see Zoho Assist and want to uninstall it, you can click the "..." to the right of the application, and then click Uninstall.

Uploaded image

 

Detection Method 2: Check in the Program Files folder

The next thing to check is to look for Zoho Assist files on your hard drive in case it was hidden from the Installed Apps panel. in File Explorer.Click on the File Exploer icon on your Task Bar or type "File Explorer" in the Search box in the Task Bar or Start Menu.

Uploaded image

Once opened, click on This PC on the bottom of the left side menu, and then click OS (C:)

Uploaded image

In your OS disk, open the Program Files (x86) folder and look in there for a folder named ZohoMeeting. If you find this folder, that means most likely Zoho Assist is installed.

Uploaded image

 

Detection Method 3: Check for Services

In case Zoho Assist was hidden or installed to a different folder, you should check for to see if the Zoho Assist Service is running..

Open the Services panel by clicking the windows Start Menu and then searching "Services" as shown below.

Uploaded image

In the Services panel, scroll down towards the bottom and look for a service called "Zoho Assist-Unattended Support". If you find it, Zoho Assist is most likely installed.

Uploaded image

 

Removing Zoho Assist

Here are a few ways to remove Zoho Assist or to disable it if you're unable to remove it.

 

Removal Method 1: If you see it in the Installed Apps panel.

  • Click the "..." to the right of the Zoho Assist application to open the drop-down menu and click Uninstall.

    Uploaded image

 

Removal Method 2: PowerShell

If you find the Service, or installation folder, but do not see it under Add or remove programs, you can try uninstalling with PowerShell

  • Open Powershell from the Start Menu
    • Open the Start Menu and search "Powershell" as shown below. Once you locate this, click on Open.Uploaded image
    • Once you've opened Powershell, copy or type the following command, and hit enter. 
      • Get-Package | Where-Object Name -match 'zoho assist' 

        Uploaded image

    • If it shows an application named Zoho Assist Unattend Agent, copy or type the following command, and hit enter: 
      • Get-Package | Where-Object Name -match 'zoho assist' | Uninstall-Package 
        Uploaded image
        • If you are prompted with a User Account Control popup, click Yes to proceed to uninstall the application.Uploaded image

 

Removal Method 3: Disable the Service

  • To open the Services panel, open the Windows Start Menu and then search for "Services" as shown below. Once you locate this, click on Open.Uploaded image

 

  • In the Services panel, scroll down and check for a service called "Zoho Assist-Unattended Support."Uploaded image

 

  • If it's there, to disable it, right-click on the Zoho Assist service, and click properties.Uploaded image

 

  • Then, click the Startup type dropdown menu and choose Disabled.
  • Then under Service Status, click Stop. Uploaded image

 

 

Check that it’s gone

After uninstalling Zoho Assist, we recommend that you repeat all three detection methods above to help determine if it was successfully removed. If Zoho Assist or similar software was present on your computer and you didn't install it on purpose, it may be an indicator that your computer is compromised and you should seek professional services. 

Please also contact the IT Service Desk for further assistance.