Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Files installed by Zoom for mac OS

The Zoom install package for macOS is mad. Rather than actually using the installer to install things, it does everything in the preinstall script. That's bonkers, and also means that the system won't have a list of the files it installed, because it's doing it using shell script.

The script appears to install two items, namely:

~/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin

If the user opening the package isn't an administrator, it looks like it will install the app in the user's home folder instead. If they are an administrator, Zoom will delete the ZoomUsPlugIn.plugin from /Library if it's there, but it still installs to ~/Library.

It also adds Zoom to your Dock automatically, without asking.

Bizarrely, is installed by unzipping a 7-zip archive, then unzipping another 7-zip archive containing graphics and copying that inside the Frameworks folder in the bundle.

If run by an administrator, the script also executes a script as root to change the ownership of to root:admin.

If you are on macOS 10.10 or above, the script will delete the file "ZoomAudioDevice.kext" from the bundle. Perplexingly, this file doesn't actually seem to exist in the current iteration (it looks like it has been replaced with a userland audio driver instead). On Mac OS X 10.9 and earlier, with the older that presumably had the KEXT in it, the KEXT would be copied to the ~/Library/Application Support/, which it alarmingly makes writable by the "staff" group - so you'd have been loading a KEXT from a directory in your home folder that is writable to other people on the machine(!!)

That's all the installer does, but when the application is first executed, it also creates the folder ~/Library/Application Support/, which holds a database and also a copy of the retina version of the graphics bundle. The application also creates two plist files in ~/Library/Preferences, namely

Copy link

mclow commented Apr 7, 2020

If you want to remove all traces, you should also remove


The first and third one are probably created when you run the app.

Copy link

marcoburato commented May 13, 2020

Not sure if things have changed from a month ago, but in my installer package (Version: 5.0.2 (24030.0508)) the postinstall script will install ZoomUsPlugIn.plugin to /Library/Internet Plug-Ins (so, not to the user folder) when run as root. And, it will always run as root AFAIK, because the installer requires to escalate.

So, in my case I had to delete:

/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin
~/Library/Application Support/

Copy link

flowmar commented May 16, 2020

There are also 2 separate packages that are downloaded from the Zoom website, I don't understand why.
I examined them with the Suspicious Package app and one of them installs about 80MB worth of stuff on the hard drive while the other one installs about 30MB worth of stuff on the hard drive. Very strange, as they both came from the same link on their website.
I downloaded it once, and got one package, turned on a VPN, reloaded the page, and got a different package.
One was called "Zoom.pkg" and the other is "zoomusInstallerFull.pkg". Very strange.

Copy link

fastrr commented Apr 19, 2022

I don't have anything against Zoom but after this weeks news, I don't want it anywhere on my personal laptop, just want it on my work laptop. Here's the commands to just delete all the files listed above, thanks @al45tair for the cleanup guide above.

rm -r /Applications/
rm -r ~/Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin 
rm -r ~/Library/Application\ Support/
rm -r ~/Library/Preferences/us.zoom.xos.plist
rm -r ~/Library/Preferences/ZoomChat.plist

Thanks for the info, I am not fluent in the terminal mode beyond copy paste ;-( can you help shed some light on why I get this error? ~ % ~/Library/Caches/us.zoom.xos
zsh: permission denied: /Users/thundr/Library/Caches/us.zoom.xos

Copy link

pietrorea commented Aug 24, 2022

There's a much longer list of Zoom files listed here, in the brew uninstall script:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment