Uninstallation via a Script

The following command line may be of interests to administrators who wish to uninstall Trend silently via a script. This allows you to embed the uninstallation password.

msiexec /x Trend.msi uninstall_password=abcdefg

Where "abcdefg" is the password needed to remove Trend OfficeScan client from you machine.

Manual Uninstallation

This process was provided by Johnny Zhang. Please forward any feedback to trend@sfu.ca.

Perform manual uninstallation only if you encounter issues when uninstalling from the web console or after running the uninstallation program.

Please do the following:

1.   Log on to the client computer using an account with Administrator privileges.

2.   Use default method, try to uninstall OfficeScan.  

     If prompted for a password, specify the unload password and then click OK.  Continue this process only if the normal uninstallation method fails.

     Note: You can disable the password on computers where the client will be unloaded. For details, see Client Privileges and Other Settings on pages 4-9 of the Administrator's Guide.  

3.   Launch services.msc, stop these services:

     •    OfficeScan NT Listener

     •    OfficeScan NT Firewall

     •    OfficeScanNT RealTime Scan

     •    OfficeScan NT Proxy Service

     •    Trend Micro Unauthorized Change Prevention Service (if the computer runs an x86 type platform)

Note: for some instances, the service could not be stopped (all buttons are grayed). In this case, launch taskmgr.exe, kill the specific process. If the process could not be killed, contact Trend Micro.

4. Use this VBScript to remove Trend Micro keys from the Registry and then jump to step 9, or launch regedit.exe and follow steps 5-8 manually.

     Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

5.   Delete the following registry keys:

     If there are no other Trend Micro products installed on the computer:

     •    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro

     For 64-bit computers:

     •    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro

     If there are other Trend Micro products installed on the computer:

     •    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC

     •    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog

     For 64-bit computers:

     •    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\TrendMicro\OfcWatchDog

     •    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp

     •    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\TrendMicro\PC-cillinNTCorp

6.   Delete the following registry keys/values:

     • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT

     •    OfficeScanNT Monitor (REG_SZ) under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Please go into each key under "..\Uninstall" and locate the one key with "DisplayName" is "Trend Micro OfficeScan Client", delete this key. In one instance, the key is "{ECEA7878-2100-4525-915D-B09174E36971}"

Please go into each key under "HKLM\SOFTWARE\Classes\Installer\Products" and locate the one key with "ProductName" is "Trend Micro OfficeScan Client", delete this key. In one instance, the key is "8787AECE0012525419D50B19473E9617"

7.   Delete all instances of the following registry keys in the following locations:

     Locations:

     •    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

     •    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services

     •    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services

     •    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services

     Keys:

     •    ntrtscan

     •    tmcfw

     •    tmcomm

     •    TmFilter

     •    Tmlisten

     •    tmpfw

     •    TmPreFilter

     •    TmProxy

     •    tmtdi

     •    VSApiNt

     •    tmlwf (For Windows Vista/2008 computers)

     •    tmwfp (For Windows Vista/2008 computers)

     •    tmactmon

     •    TMBMServer

     •    tmevtmgr

8.   Close the Registry Editor.

9.   Launch devmgmt.msc, click View > Show hidden devices.   

10.  Within the Device Manager, expand "Non-Plug and Play Drivers" and then uninstall the following devices:

     •    tmactmon

     •    tmcomm

     •    tmevtmgr

     •    Trend Micro Filter

     •    Trend Micro PreFilter

     •    Trend Micro TDI Driver

     •    Trend Micro VSAPI NT

     •    Trend Micro Unauthorized Change Prevention Service

     •    Trend Micro WFP Callout Driver (For Windows Vista/2008 computers)   

11.  For each the network interface, right click and get to its properties dialog box, uninstall the following "Driver" from the general tab:

     "Trend Micro Common Firewall Driver"    

     "Trend Micro NDIS 6.0 Filter Driver"

12.  Restart the client computer.

13. Delete the following folders:

     "Trend Micro OfficeScan Client" on Start Menu

     For 32-bit system: C:Program Files\Trend Micro

     For 64-bit computers: C:\Program Files (x86)\Trend Micro

     If some of the files/folders could not be deleted, please double check to see if there are any errors in any of the above steps.

This document is based on:

http://esupport.trendmicro.com/solution/en-us/1039283.aspx

Composed by Johnny Zhang (johnny@sfu.ca) - 2011.10.24