What is Zoho Assist?

Zoho Assist is a remote assistance software that has legitimate use cases, but can also sometimes be installed inadvertently, or used by attackers to give them remote access to computers. Used maliciously, it could grant them access to not just your computer but also to any online accounts and services that you access through the computer. This article may help you determine if ScreenConnect is installed and remove it.

Although ScreenConnect will normally appear in Add or remove programs like other software, attackers may take steps to hide these sorts of tools. We've provided three different ways to detect it, and you should check all of them.

How to check if Zoho Assist is installed

Detection Method 1: Check in Add or remove programs

The first place to check is Add or remove programs.

You can open this through clicking the windows Start Menu and then searching "add or remove programs" as shown below. Once you locate this, click on Open

Once you've opened Add or remove programs, search for "zoho" and check to see if you see any applications, below is an example of what it might look like (you can also sort applications by date to look for the most recently installed applications)

If you do see Zoho Assist there, you can click the "..." to the right of the application, and then click Uninstall

Detection Method 2: Check in Program Files

The next place to check is in Windows File Explorer. You are searching for the folder C:\Program Files (x86)\ZohoMeeting. To check if you find it here, do the following:

Open File Explorer either by right clicking on the Start Menu, or clicking on the file icon on your task bar

Once opened, click on This PC on the bottom of the left side menu, and then click on your OS disk -- it's typically named OS (C:)

Once you've opened your OS disk, click on the folder Program Files (x86), and search in there for another folder named ZohoMeeting. If you find this folder, that means most likely Zoho Assist is installed

Detection Method 3: Check for Services

To check for the Zoho Assist Service, open Services.

You can open this through clicking the windows Start Menu and then searching "Services" as shown below. Once you locate this, click on Open

Once you've opened Services, scroll down towards the bottom, and check for the service called "Zoho Assist-Unattended Support". If you find this Service, that means most likely Zoho Assist is installed

Removing Zoho Assist

These are a few potential ways to remove or disable Zoho Assist, in order from most to least preferable.

Removal Method 1: If it appears under Add or remove programs

• click the "..." to the right of the application, and then click Uninstall

  

• check to verify it no longer shows up under add or remove programs, and that the file path and service are no longer there

Removal Method 2: Powershell

If you find the Service, or installation folder, but do not see it under Add or remove programs, you can try uninstalling with Powershell

• open powershell from the start menu
  • You can open this through clicking the windows Start Menu and then searching "Powershell" as shown below. Once you locate this, click on Open
  • Once you've opened powershell, copy or type the following command, and hit enter: 

    • Get-Package | Where-Object Name -match 'zoho assist' 

      

  • It should only list the application named Zoho Assist Unattend Agent if that is the case, copy or type the following command, and hit enter: 
    • Get-Package | Where-Object Name -match 'zoho assist' | Uninstall-Package 
      
      • you may be prompted with a User Account Control popup when uninstalling this, if you are, click Yes to proceed with the uninstallation 
        

Removal Method 3: Disable the Service

• You can open Services through clicking the windows Start Menu and then searching "Services" as shown below. Once you locate this, click on Open

• Once you've opened Services, scroll down towards the bottom, and check for the service called "Zoho Assist-Unattended Support".

• Right click on the Zoho Assist service, and click properties

• Under properties, click the Startup type: dropdown, and choose Disabled, and then click Stop under service status 

Check that it’s gone

After uninstalling ScreenConnect, we recommend that you repeat all three detection methods above to help determine if it was successfully removed. If ScreenConnect or similar software was present on your computer, and you didn't install it on purpose, it may be an indicator that your computer is compromised, and you should seek professional services. 

Please also contact the IT Service Desk for further assistance.