Zoom virus: what it is and how to remove it
Zoom virus is the generic name that defines unwanted programs, trojans and phishing campaigns delivered with the help of content related to the Zoom application or services. The platform is legitimate and safe to use video communications service, but the popularity of this site also made it more popular among malware creators.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Unsure whether zoom-us-zoom.exe is safe? A free scan checks the file and what starts it.
Do it yourself · free Remove Zoom virus yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Zoom virus: summary
| Distribution | Malicious emails, deceptive or hacked pages, mimicking the official Zoom platform site. Links placed in chatrooms and on emails, other intruders, fake installers |
|---|---|
| Name | Zoom virus |
| The relation | Zoom video conferencing platform that is completely legitimate and not containing malware. Criminals create various campaigns and spread their products using hacked sites with the same name or can hijack video chats to send links to malware delivery services |
| Possible types | Trojans, malware, phishing emails, potentially unwanted applications |
| Variants | Phishing email campaigns. Rogue setups for the tool that deliver malware. Links in the chat that trigger remote access and hacker control. Zoom-bombing campaigns. |
| Danger | People fall for scams and campaigns claiming to be associated with the legitimate Zoom product and can install trojans, password-stealing malware or useless programs without even noticing. Not paying attention to the content and senders of emails or chat messages can lead to issues with privacy and the computer, in general |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 10 more facts
| Elimination options | Zoom virus removal differs from the type of malicious campaign you have encountered, but the best option is the full system scan using anti-malware tools that can detect and delete various intruders and clean the computer from any additional malware or possibly dangerous content |
|---|---|
| Ways to avoid | You should always check if the source of the program or the site you are using is the legitimate and official website to be sure that there is nothing even potentially dangerous associated with the service. |
| Detection names | No Microsoft detection name is known |
| Damage | Not recorded in the old report |
| Type | Loader |
| Symptoms | An unknown process in Task Manager |
| Evidence | 6 write-ups by security sites; details still limited |
| File names | zoom-us-zoom.exe |
| First seen | 3 April 2020 |
| Facts checked | 7 October 2026 |
What Zoom virus does on an infected PC
What readers reported about Zoom virus
Cannot remove Search By Zooms. Cannot remove Search By Zooms. I tried to remove this browser extension, but it keeps appearing. Please help to get rid of this annoying program...
SmartZoom program is trash, how to remove it?!. Help. I do not know how to uninstall SmartZoom, which is sending me ads. Can you tell me how to do it? They are just too annoying and I do not like to see many ads at all. I think this program is bad... Thanks for the help, Clarisse.
Is ZoomEx working properly for you?. I think that ZoomEx is getting progressively worse with time. At this point it only works on about 10%-20% of pictures for me, sometimes takes too long to load. Besides, I have a suspect that it has started displaying ads. Has someone noticed these issues? maybe …
From the comments under our earlier guide; names and contact details removed.
From our report of Apr 2020 · not reviewed since
Zoom virus is the term used to describe various methods that hackers tend to misuse the name of a legitimate video conferencing platform
Zoom virus is the generic name that defines unwanted programs, trojans and phishing campaigns delivered with the help of content related to the Zoom application or services.
The platform is legitimate and safe to use video communications service, but the popularity of this site also made it more popular among malware creators. Since the bigger part of the world turned to online services due to the COVID-19 pandemic in 2020, the popularity of this platform raised to the top.
The accessibility, free services, cross-platform features made the product and company a target of malicious campaigns. As users turn to the platform, malicious actors do the same but in a different way.
There are many campaigns spreading trojans that fall to the category of Zoom virus and phishing campaigns that use the name of the platform to mimic the legitimacy and deliver wanted remote tools and infect the machine with different malware. Due to more common research and analysis, it got revealed that hackers manage to hack this program and can proliferate various attacks using flaws in the service.
Zoom-bombing also is a huge issue that even government institutions note users all over the world. There are various ways how you can get exposed to malicious content or even encounter hackers during the video conference on the Zoom platform, but there are also ways to avoid such exposure and keep yourself safe while studying or working remotely online.
Mimicking the legitimate page and providing users with malware is typical behavior of malicious actors, so such a version of the Zoom virus was released when the platform started to gain recognition. However, additional campaigns surfaced when quarantine in the bigger part of countries was announced, and people started to work, study and live online.
Social engineering is the method that allows criminals to spread their phishing sites and other versions of Zoom virus. When the person believes that the page is a legitimate platform and manages to register the needed account the victim gets exposed.
The name, email address, phone number, location, credit card credentials, and other private details are revealed during the account setup. In most cases, this information is automatically collected, the person is not getting any Zoom services, and data gets used by third-party companies yr criminals in later campaigns, targetted attacks.
Another issue that people may be frustrated about and look for ways to remove Zoom virus is direct video conference hijacking and bombing that hackers may start. Phishing links or even remote hacking triggering hyperlinks can get dropped directly in the chat.
Also, hackers can show various material in hijacked conference calls and expose kids and minors to pornographic content. This is one of the few flaws in the platform itself that can get exploited by malicious people.
There is nothing malicious about the Zoom platform, but you need to consider these possibilities to get a virus installed instead of the machine yourself but not paying enough attention.
Also, some of the security flaws that the service has might get exploited, but you can manage the safety and control your connections, ensure the security of the internet and maintain the device, so there are fewer ways for the hackers to end up on the computer.
These recent Zoom virus campaigns focus on people that are at home during the COVID-19 quarantine, so make sure to keep yourself safe and pay more attention online than before. Criminals try to take advantage of various people that turn to shop sites online and use platforms like Netflix and Hulu, rely on social media more than before.
Don't lose your attention span during the lockdown and try to stay calm and protect your privacy with professional AV tools and tools like that can provide an area of optimization ad repair functions.
From our report of Apr 2020 · not reviewed since
Zoom malware variations depending on criminals' goals
Zoom virus version was noticed to spread around via fake application installers and sites that supposedly delivers the Zoom program.
The executable file of the installer named zoom-us-zoom.exe with variations of additional characters for identification is launched via InstallCore installer which then installs the software. This is how adware, browser hijackers, and other programs like trojans or ransomware land on the computer.
It is known that such Zoom applications are used to spread info-stealing malware and get distributed around via fake Zoom websites. The number of similar domains registered with Zoom name rising every day. In most cases, disguised as official third-party sites pages claim to offer free downloads of the legitimate app. Once the user falls for the scam and allows the download, the person receives malicious content.
These phishing Zoom virus sites also use methods that allow stealing passwords directly from the website when people register their accounts with names, emails, credit card information links banking account details. Malicious installers and pages can resemble the legitimate platform because actors use official logos, colors, claims that the company has on the official domains and installer setups. The only official site of the free ZOOM platform is zoom.us.
Do not fall for any promotional ads that offer free services or suggest to install the app. You may install the Zoom virus without noticing it. Always rely on official sites, App Stores, and software providers that state all the important information in their Privacy Policy where you can read about the company and the product.
Take note of sites that claim to provide Zoom application that also has:
You may notice that zoom.us is listed as the developer or that the program is certified wy Windows OS or macOS providers, developers. There are many claims that malicious actors can use to trick you into installing the rogue app or trojan, so you will need to perform Zoom virus removal in the future without knowing that the malware is on the PC.
- advertisements of various different products or unrelated sites;
- creates redirects, pop-ups with ads;
- a domain that includes more than the name of a company or app;
- encourages to allow or agree to additional content or triggers the download right away.
From our report of Apr 2020 · not reviewed since
Ways to keep yourself safe online
These campaigns that deliver malware can go various ways because paying attention to sources where you download programs and use the service can determine the security and ensure privacy.
Use only official sources, providers' sites, and real EULA and other statements. Do not reveal your personal data on sites that you are not sure about and avoid clicking on any links and files attached to suspicious emails.
Since emails can contain malicious file attachments and hyperlinks to direct phishing pages, you need to pay attention to senders, avoid clicking on any suspicious notifications, do not open the email that is not expected. Clean the email box more often and pay attention to anything that appears on the screen out of nowhere.
Additional tips for your virtual meetings:
- use private meeting options and do not allow other people to get on the conference;
- share the link to meeting directly to participants only;
- limit screen sharing to avoid unwanted content appearing on the screen;
- make sure to update software and tools to avoid any bugs.
From our report of Apr 2020 · not reviewed since
More from our earlier report on Zoom virus
- You should go through the system folders with too, so any virus damage or additional malware traces and changes get fixed.
- Alterations in such parts of the device can affect the performance significantly
How to check the PC for Zoom virus
- File:
zoom-us-zoom.exe
How to remove Zoom virus
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Check where zoom-us-zoom.exe runs from and stop it
In Task Manager (Ctrl + Shift + Esc) find
zoom-us-zoom.exeon Processes, right-click it and choose Open file location before ending anything.Windows' own files live in
C:\Windows\System32; the same name in%AppData%, %Temp% or C:\Users\Public is an impostor. If the folder is wrong, right-click the process again, choose End task and delete the file.If it starts again within seconds, a task or another process restarts it, so run the scan step in Safe Mode. Task Manager works the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 2: Delete scheduled tasks that bring it back
Programs like Zoom virus add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Zoom virus, its publisher or created on the day the problem started.Delete those folders, and check
C:\Program FilesandC:\Program Files (x86)too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 5: Scan the PC, then run the offline scan
A scan finds the parts of Zoom virus that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 6: Change passwords from another device and sign out other sessions
Zoom virus can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Apr 2020 · not reviewed since
Get rid of any traces of the Zoom virus or another threat with AV tools
You should consider that your machine is affected by the Zoom virus if you encounter any strange activities and notice that the machine is not running as it supposed to.
The full cleaning process with or can detect all the threats that manage to affect your device, including trojans and other programs that run in the background.
Zoom virus removal is the process that anti-malware tools are designed for, so when the program finds the malware and suggest to delete that from your computer or even mobile device - do so. Follow the suggested sets and eliminate any possibly dangerous intruders. This method works for rogue tools and for ransomware infections.
To remove Zoom virus from the mobile device, you only need to get an official AV tool from the App store that is compatible with your OS. After all these malware termination procedures, run for the double-checking and virus damage repair. Follow the guide for additional tips.
[GI=method-1]You can reboot the machine in Safe Mode with Networking, so your AV tools can properly run on the machine and remove Zoom virus
[GI=method-2]System Restore allows the user to recover the machine in a previous state when the malware was not present
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed an unfamiliar process called zoom-us-zoom.exe in Task Manager, a sign of a program that could read browser data, the clean-up is only half of the work.
The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
Questions about Zoom virus
What is zoom-us-zoom.exe and why is it running?
Every process is started by something:
- a program you installed
- a Windows service
- a scheduled task
- a startup entry
To learn why zoom-us-zoom.exe runs, find its file with Open file location in Task Manager, then look for an entry pointing to that file in Settings > Apps > Startup and in Task Scheduler.
Sort Installed apps by date to see what arrived when the process first appeared. Once you know the owner, you can decide whether to keep it, switch it off at startup or uninstall it completely.
zoom-us-zoom.exe keeps coming back. What should I do?
A process that returns after you end it has a restart mechanism, and that is a reason to treat zoom-us-zoom.exe as unwanted. Check Settings > Apps > Startup, Task Scheduler and the Services list for entries pointing to its folder, and disable them.
Look in Installed apps for anything added the same day and uninstall it. Then delete the folder and run a Microsoft Defender Offline scan, which works before Windows starts and can remove files that are locked or hidden while the system is running.
Is zoom-us-zoom.exe a virus?
If it sits outside the Windows and Program Files folders and your antivirus links it to Zoom virus, yes. zoom-us-zoom.exe is the file name used by this trojan. Some trojans borrow the names of real Windows components, so the name alone does not decide it:
- right-click the process in Task Manager
- choose Open file location
- look at the folder and the publisher under Properties > Details
A file in a user folder with no publisher is the trojan. Do not delete it by hand while it runs; use the offline scan in the plan above.
Do I need to reinstall Windows to get rid of Zoom virus?
Usually not. A thorough clean-up is enough when the offline scan finds nothing afterwards and you do not see an unfamiliar process called zoom-us-zoom.exe in Task Manager again. A reset is the safer choice if an attacker had remote control, if security tools were switched off, or if detections come back after every clean-up.
Windows 11 can reset itself without a USB stick under Settings > System > Recovery > Reset this PC. Copy documents and photos out first and scan the copies. A reset does not change passwords or undo stolen data, so the account steps still apply.
My antivirus was on. How did a trojan get past it?
Antivirus programs see a file only when it is written or run, and criminals test each new build against popular scanners before release. Detection catches up within hours or days, which is often after the first victims ran it.
Archives with passwords, installers that fetch the malware later, and scripts run through PowerShell make the job harder. That is why behaviour such as downloading cracks or pasting commands matters more than any setting. Keep Windows and Defender updated, and turn on Reputation-based protection in App & browser control.
Should I check my other computers too?
Yes, it takes little time and removes doubt. Zoom virus itself usually stays on one PC, but the download that carried it may have been copied to other computers, shared drives may hold the same installer, and an attacker who had access could have tried saved passwords on other devices.
Run a full scan on every Windows PC in the home or office, check shared folders for the original download, and change Wi-Fi and router passwords if they were stored on the infected machine.
Should I report Zoom virus?
Report it if you lost money, if accounts were taken over, if you are a business, or if the trojan came through a scam call. A police or national cybercrime report gives you a reference number for your bank and insurer and helps link cases.
You do not need to report a trojan that antivirus blocked before it ran. Before reporting, write down the dates, the detection name, file names and any messages or transactions linked to the attack; screenshots of antivirus alerts are useful evidence. The country list is in the report section above.
How do I know if my PC has Zoom virus?
Often you do not, which is the point of a trojan. Possible signs are an antivirus alert naming Zoom virus or a generic trojan detection, unknown programs or scheduled tasks, processes with random names in Task Manager, browser extensions you did not add, security settings turned off, slower performance, or account alerts about logins from unknown places.
The reliable check is a full scan followed by Microsoft Defender's offline scan. If you recently ran a crack, a fake installer or a command a website told you to paste, scan even without symptoms.
I found AnyDesk or ScreenConnect that I did not install. Is that Zoom virus?
Not necessarily Zoom virus, but it is a warning sign. These are legitimate remote support tools, and criminals use them as ready-made backdoors, especially after tech support scams or fake invoice calls.
If you did not install it and no one you trust set it up, uninstall it, change passwords from a clean device and check your bank account. If someone connected to your PC through it, follow the steps for remote access trojans and consider a Windows reset. Installed apps sorted by date shows when it appeared.
Will Fortect remove Zoom virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Zoom virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- BBC: Coronavirus: Zoom under increased scrutiny as popularity soars (read October 7, 2026)
- USAtoday: Zoom issues: People hijacking streams, possible security flaws (read October 7, 2026)
- Twitter: Zoom chat allows you to post links (read October 7, 2026)
- Theguardian: 'Zoom is malware': why experts worry about the video conferencing platform (read October 7, 2026)
- VirusTotal: malicious installer analysis (read October 7, 2026)