Ran into a slight problem today. I had to add a couple of older computers to a new Domain. Pretty easy to do normally but these workstations had a version of Trend Micro’s Officescan from their previous domain that needed to be removed so that the new version could be installed.
I couldn’t just uninstall the client (which would be the best solution) as that requires a password and no one in the office could remember the old password. (As a side note, when you install network versions of antivirus programs, make notes of the install details and file them away. It will help you out in the future.) Doing a bit of “Bing-ing” ( 😆 , yes I used Bing ) I found this information on how to change the password from Computing.Net:
To remove / reset the uninstall password for Trend Micro OfficeScan
Edit Ofcscan.ini file. (Do a search.)
On Windows.95/98/XP machines it is usually in C:\Windows\Ofcscan.ini
On Windows.NT/2K machines it is usually in C:\WINNT\Ofcscan.ini
Open the Ofcscan.ini file using notepad search for the [INI_CLIENT_SECTION]
Find the line reading Uninstall_Pwd= and type a # at the beginning of the line to comment it out.
Insert a new line saying Uninstall_Pwd=70
Save the Ofcscan.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’.
Sadly though, this method did not work for me as there was no Ofcscan.ini file to be found anywhere on these workstations. Therefore I was forced to do some manual removal of the client. This took a little digging into the Registry. Here are the steps I went through that worked for me:
First, you need to stop all the Officescan Services. To do that
- Go to Control Panel —> Administrative Tools —-> Services — and stop these services:
- OfficeScanNT Listener
- OfficeScanNT RealTimeScan
- OfficeScanNT Personal Firewall (this one may not be enabled – don’t worry if you don’t see it)
- Run Registry Editor. Click Start —> Run —> then type ‘regedit.exe’
- Find this registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services- Delete these keys:
- Ntrtscan
- Tmlisten
- TmFilter
- VSApiNt
- TMPreFilter
- TM_CFW
- OfcPfwSvc
- Now find this Registry key:
HKEY_LOCAL_MACHINE \SOFTWARE\TrendMicro- Delete the following keys:
- OfcWatchDog
- Pc-cillinNTCorp
- RemoteAgent
- PC-cillin
- Next Find this registry key:
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft\Windows\CurrentVersion\Run- Delete the OfficeScanNT Monitor key.
- Now find the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall- Delete the OfficeScanNT key.
- Delete the OfficeScan program group (Trend Micro OfficeScan Client) from the Windows Start menu.
- Restart your computer.
- Delete the directories that contain the OfficeScan Client program files, normally located inside Program Files folder.
The above steps worked for me on a version 6 client of the Trend Micro Officescan client. If you are trying to remove an early version of the client, these Registry keys and services may not be the same. Please use the above instructions carefully and at your own risk. Also, remember anytime you intend to edit the Registry make a backup BEFORE you started editing and/or deleting keys.
© 2009, Robert Owen. All rights reserved.
