Wednesday, September 30, 2009

Forcefully Remove Trend OfficeScan Client 10.0

You have a corrupt trend install and when you try and reinstall it you get:

The OfficeScan client is already installed on this computer.



To resolve this problem manually remove trend by performing the following process:

1. Stop the following services:
• Officescan NT Realtimescan
• Officescan NT Listener
• Officescan NT Firewall (if enabled)
• Officescan NT Proxy Service

2. Run regedit.exe
Locate and then delete the following keys belonging to the following: (Always create a backup before modifying the registry) HKLM\System\CurrentControlSet\Services:
• Ntrtscan
• Tmcfw
• TmFilter
• Tmlisten
• TmPfw
• TmPrefilter (for Windows 2003)
• TmProxy
• VsapiNt

3. HKLM\Software\TrendMicro (or HKLM\Software\Wow6432Node\TrendMicro for 64-bit clients):
• OfcWatchDog
• Pc-cillinNT Corp or OfficescanCorp (depending on client)
• Remote agent

4. HKLM\Software\Microsoft\Windows\CurrentVersion\Run:
• Officescan NT Monitor

5. HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
Officescan NT

6. Right-click My Computer, click Manage.
Go to Device Manager then Show Hidden Devices Right-click each of these devices and click Uninstall (Note: Do not reboot at this point)
• tmcomm
• Trend Micro Filter
• Trend Micro PreFilter (for Windows 2003)
• Trend Micro TDI Driver
• Trend Micro VSAPI NT

7. Delete the Officescan Program group in the Programs’ Start Menu
Then restart the computer Go to \Program Files\Trend Micro and delete the Officescan client folder

Once uninstalled reboot then try installing trend again.

Also see my post for forcefully unintalling Trend ServerProtect:

http://clintboessen.blogspot.com/2010/01/forcefully-uninstall-trend.html

Related Posts:

http://clintboessen.blogspot.com/2009/09/trend-micro-find-trend-server.html

http://clintboessen.blogspot.com/2010/01/trend-micro-client-packager.html

16 comments:

  1. Hey thanks for the info, I have Vista 64-bit and am trying to get rid of trend (don't have the uninstall password). I think I followed all the directions here and on Trend Micro's site, but it still shows up in Add/Remove Programs (just with a white icon, no other info) and won't let me install another version of Trend.

    Any suggestions?

    ReplyDelete
  2. Are you using the corporate version of trend micro or are you using the home Trend Micro Internet security? This howto was for the corporate version that is deployed to multiple computers in a companies internal network.

    For the home version there is an uninstall tool called TIStool.exe that you can give a go. Get it from:

    http://www.support.antivirus.co.uk/trendmicro/kbresolution.jsp?hmid=2530&serviceId=1

    Let me know if this fixes your problem, if not we will go from there.

    ReplyDelete
  3. There is one other tool that may help (this may be similar, not sure):

    common uninstall tool to remove the Officescan client. You may download the tool at this link below:

    ftp://ftp-download.trendmicro.com.ph/1-1-278323757/
    username: ftpuser
    password: ftp-trend

    ReplyDelete
  4. The link above has a .ph for the top level instead of .com Unless trend has offices in the Philippines then this is scammers link.

    ReplyDelete
  5. Every Trend Micro support person I have ever talked to is Filipino, so it wouldn't surprise me if the link was valid.

    ReplyDelete
  6. hey clint....your solution save my day!!!

    You rocks man!

    ReplyDelete
  7. Cool! It worked for me. But I had to start in Safe Mode for the last step of deleting the OfficeScan CLient folder.

    There is still a PccNTMon.exe icon in the task bar setup (it doesn't show, but there is the option to have it show notifications, etc.) Any idea how to get rid of that?

    Regardless, it works! Thanks!

    ReplyDelete
  8. Thank you..Works Fine!!

    ReplyDelete
  9. Thanks..... The above steps were a life saver... :-)

    ReplyDelete
  10. Hello Clint,
    In my company, we have two different versions of OfficeScan (8.0 & 10.5).
    The goal is to migrate to FEP
    I have the uninstall tools for each version but to script the uninstallation, we would need to detect the installed version.

    Are you aware of such a tool or command line ?

    Thanks in advance for your help ..
    Br,
    Sylvain

    ReplyDelete
  11. Thanks for the information and detailed guide. Very helpful!

    ReplyDelete
  12. Thank you for posting this.

    ReplyDelete
  13. Above steps flaked out at step 1. The options to stop the services are greyed out when I attempt to execute them.

    ReplyDelete
  14. great notes , thank for sharing you again rocks..PCEF on the Client Device

    ReplyDelete
  15. Merci like we say in french :)

    ReplyDelete