Uninstall Trend Micro Officescan without a Password

Ran into a slight problem today.  I had to add a couple of older computers to a  new Domain.  Pretty easy to do normally but these workstations had a version of Trend Micro’s Officescan from their previous domain that needed to be removed so that the new version could be installed.

I couldn’t just uninstall the client (which would be the best solution) as that requires a password and no one in the office could remember the old password.  (As a side note, when you install network versions of antivirus programs, make notes of the install details and file them away.  It will help you out in the future.)  Doing a bit of “Bing-ing”  ( :lol: , yes I used Bing ) I found this information on how to change the password from Computing.Net:

To remove / reset the uninstall password for Trend Micro OfficeScan

Edit Ofcscan.ini file. (Do a search.)

On Windows.95/98/XP machines it is usually in C:\Windows\Ofcscan.ini

On Windows.NT/2K machines it is usually in C:\WINNT\Ofcscan.ini

Open the Ofcscan.ini file using notepad search for the [INI_CLIENT_SECTION]

Find the line reading Uninstall_Pwd= and type a # at the beginning of the line to comment it out.

Insert a new line saying Uninstall_Pwd=70

Save the Ofcscan.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’.

Sadly though, this method did not work for me as there was no Ofcscan.ini file to be found anywhere on these workstations.  Therefore I was forced to do some manual removal of the client.  This took a little digging into the Registry.  Here are the steps I went through that worked for me:

First, you need to stop all the Officescan Services. To do that

  1. Go to Control Panel —> Administrative Tools —-> Services — and stop these services:
    • OfficeScanNT Listener
    • OfficeScanNT RealTimeScan
    • OfficeScanNT Personal Firewall (this one may not be enabled – don’t worry if you don’t see it)
  2. Run Registry Editor. Click Start —> Run —> then type ‘regedit.exe’
  3. Find this registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
  4. Delete these keys:
    • Ntrtscan
    • Tmlisten
    • TmFilter
    • VSApiNt
    • TMPreFilter
    • TM_CFW
    • OfcPfwSvc
  5. Now find this Registry key:
    HKEY_LOCAL_MACHINE \SOFTWARE\TrendMicro
  6. Delete the following keys:
    • OfcWatchDog
    • Pc-cillinNTCorp
    • RemoteAgent
    • PC-cillin
  7. Next Find this registry key:
    HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft\Windows\CurrentVersion\Run
  8. Delete the OfficeScanNT Monitor key.
  9. Now find the following registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  10. Delete the OfficeScanNT key.
  11. Delete the OfficeScan program group (Trend Micro OfficeScan Client) from the Windows Start menu.
  12. Restart your computer.
  13. Delete the directories that contain the OfficeScan Client program files, normally located inside Program Files folder.

The above steps worked for me on a version 6 client of the Trend Micro Officescan client. If you are trying to remove an early version of the client, these Registry keys and services may not be the same.  Please use the above instructions carefully and at your own risk.  Also, remember anytime you intend to edit the Registry make a backup BEFORE you started editing and/or deleting keys.

© 2009, Robert Owen. All rights reserved.

Related Posts Plugin for WordPress, Blogger...

Comments

  1. Kiki Rizki says

    I can’t use the ofcscan.ini path to work, I don’t know anything about the Registry Editor and what to do.

    Can you make a video tutorial of this? I really wanted to delete Trend Micro Officescan but I don’t know the password

    Please reply ASAP! Thank you :)

  2. Nag says

    it didn’t worked for me.. :(
    Tried editing Ofcscan.ini file and wen i tried to uninstall it was not accepting 1 as password.
    and i’m unable to stop the services as all the options to stop in services.msc for officescan files are grayed out.

    office scan version: 10.6.1062

    I didn’t try editing registry…

    • says

      Try this, I found it at Majorgeeks

      You can just close explorer and then delete it. That’s what I do.

      Before you close explorer open a command prompt (windows+r->”cmd”). Then simple hit ctrl-alt-delete and press end task for explorer.exe. Now go to the still opened command prompt. And type “del tmdshell.dll”. Once you’re done just type “explorer” and press return, and it will reload explorer and bring back all the gui stuff.

      Of course before typing “del tmdshell.dll” make sure you’re in the correct DIR.

  3. Eric says

    Thanks for the info.

    My ini was under program files

    I searched for section and found password fields labeled !crypt! and changed to 70

    I changed uninstall entries from 0 to 1 and then the uninstall program in add/remove programs worked.

Leave a Reply

Your email address will not be published. Required fields are marked *

CommentLuv badge