Ran into a slight problem today. I had to add a couple of older computers to a new Domain. Pretty easy to do normally but these workstations had a version of Trend Micro’s Officescan from their previous domain that needed to be removed so that the new version could be installed.
I couldn’t just uninstall the client (which would be the best solution) as that requires a password and no one in the office could remember the old password. (As a side note, when you install network versions of antivirus programs, make notes of the install details and file them away. It will help you out in the future.) Doing a bit of “Bing-ing” ( 😆 , yes I used Bing ) I found this information on how to change the password from Computing.Net:
To remove / reset the uninstall password for Trend Micro OfficeScan
Edit Ofcscan.ini file. (Do a search.)
On Windows.95/98/XP machines it is usually in C:\Windows\Ofcscan.ini
On Windows.NT/2K machines it is usually in C:\WINNT\Ofcscan.ini
Open the Ofcscan.ini file using notepad search for the [INI_CLIENT_SECTION]
Find the line reading Uninstall_Pwd= and type a # at the beginning of the line to comment it out.
Insert a new line saying Uninstall_Pwd=70
Save the Ofcscan.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’.
Sadly though, this method did not work for me as there was no Ofcscan.ini file to be found anywhere on these workstations. Therefore I was forced to do some manual removal of the client. This took a little digging into the Registry. Here are the steps I went through that worked for me:
First, you need to stop all the Officescan Services. To do that
- Go to Control Panel —> Administrative Tools —-> Services — and stop these services:
- OfficeScanNT Listener
- OfficeScanNT RealTimeScan
- OfficeScanNT Personal Firewall (this one may not be enabled – don’t worry if you don’t see it)
- Run Registry Editor. Click Start —> Run —> then type ‘regedit.exe’
- Find this registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services- Delete these keys:
- Ntrtscan
- Tmlisten
- TmFilter
- VSApiNt
- TMPreFilter
- TM_CFW
- OfcPfwSvc
- Now find this Registry key:
HKEY_LOCAL_MACHINE \SOFTWARE\TrendMicro- Delete the following keys:
- OfcWatchDog
- Pc-cillinNTCorp
- RemoteAgent
- PC-cillin
- Next Find this registry key:
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft\Windows\CurrentVersion\Run- Delete the OfficeScanNT Monitor key.
- Now find the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall- Delete the OfficeScanNT key.
- Delete the OfficeScan program group (Trend Micro OfficeScan Client) from the Windows Start menu.
- Restart your computer.
- Delete the directories that contain the OfficeScan Client program files, normally located inside Program Files folder.
The above steps worked for me on a version 6 client of the Trend Micro Officescan client. If you are trying to remove an early version of the client, these Registry keys and services may not be the same. Please use the above instructions carefully and at your own risk. Also, remember anytime you intend to edit the Registry make a backup BEFORE you started editing and/or deleting keys.
© 2009, Robert Owen. All rights reserved.
THANK YOU VERY MUCH FOR ALL THIS INFO. IT REALLY WORKED FOR ME.
Thank you very much, worked very well. Top quality information!
Glad it helped you! 🙂
Wow, awesome method, Worked great!…after many time attempts….thanks a lot… : 0 ; )
Thanks
No problem! Glad it helped.
thaks it worked for me ….
wow, this is interesting. but isn’t dangerous if you make registry changes ?
It is absolutely dangerous to make changes to the registry. That is why you should always make a backup first! 🙂
nothing of the above is working on my system
What version are you trying to remove?
I can’t use the ofcscan.ini path to work, I don’t know anything about the Registry Editor and what to do.
Can you make a video tutorial of this? I really wanted to delete Trend Micro Officescan but I don’t know the password
Please reply ASAP! Thank you 🙂
it didn’t worked for me.. 🙁
Tried editing Ofcscan.ini file and wen i tried to uninstall it was not accepting 1 as password.
and i’m unable to stop the services as all the options to stop in services.msc for officescan files are grayed out.
office scan version: 10.6.1062
I didn’t try editing registry…
how od you do it if you are not administrator?
I’m not sure you can without having Administrator access..
You are Great i got finally rid of Tren Micro OS…. THnks a lot
Thanks a Lott Dude………. It Works…… but still showing tmdshell.dll cannot remove
Try this, I found it at Majorgeeks
Thanks for the info.
My ini was under program files
I searched for section and found password fields labeled !crypt! and changed to 70
I changed uninstall entries from 0 to 1 and then the uninstall program in add/remove programs worked.
Yes! Finally someone writes about Trend Micro.
thanks a lot, its working! but however, i still cant delete/uninstall the folder in the program file. Any suggestion ?