Manual uninstallation of the Security Agent (SA) in Worry-Free Business Security (WFBS)

Support
Solution ID Last Updated
1056867 May. 06, 2014 1:49 AM (PST)


Product / Version Platform
Worry-Free Business Security Standard/Advanced - 7.0, 8.0, 9.0;
Windows - 2003 Datacenter Server, 2003 Datacenter Server Edition 64-bit, 2003 Enterprise Server, 2003 Home Server, 2003 Small Business Server, 2003 Standard Server Edition, 2003 Standard Server Edition 64-bit, 2003 Storage Server, 2003 Web Server Edition, 2008 Datacenter Server, 2008 Datacenter Server Edition 64-bit, 2008 Enterprise Server, 2008 Enterprise Server Edition 64-bit, 2008 Essential Business Server, 2008 Small Business Server, 2008 Standard Server Edition, 2008 Standard Server Edition 64-bit, 2008 Storage Server, 2008 Web Server Edition, 2008 Web Server Edition 64-bit, 7 32-bit, 7 64-bit, Vista 32-bit, Vista 64-bit, XP Home, XP Professional, XP Professional 64-bit

Problem Description

Learn how to manually uninstall the WFBS SA.

Solution

Choose your program version below for instructions on how to manually uninstall your program:
[ Expand All ]

 

WFBS 9.0

To manually uninstall WFBS 9.0:
  1. Open the Services console and then stop the following services:
    • Trend Micro Security Agent Listener
    • Trend Micro Security Agent Personal Firewall
    • Trend Micro Security Agent RealTime Scan
    • Trend Micro Security Agent NT Proxy Service (Win7 and below)
    • Trend Micro Unauthorized Change Prevention Service
    • Trend Micro Common Client Solution Framework
  2. Open the Task Manager and make sure the following processes are not running:
    • Ntrtscan.exe
    • PccNTMon.exe
    • TMBMSRV.exe
    • TmCCSF.exe
    • TmListen.exe
    • Tmproxy.exe
    • Pccntupd.exe
    • xpupg.exe
  3. Open the command prompt using administrator privileges and execute the following commands one by one:
    For 32-bit
    regsvr32 /u /s "C:\program files\trend micro\Security Agent\tmdshell.dll"
    taskkill /F /IM explorer.exe
    start explorer.exe
    For 64-bit
    regsvr32 /u /s "C:\program files (x86)\trend micro\Security Agent\tmdshell_64x.dll"
    taskkill /F /IM explorer.exe
    start explorer.exe
  4. Open the Registry Editor to delete registry keys that belong to WFBS.
    Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems. Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.
    1. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete the following registry keys:
      • Ntrtscan
      • Tmactmon
      • TMBMServer
      • TmCCSF
      • TMCFW (Windows XP)
      • Tmcomm
      • TMEBC
      • Tmeevw (Windows 8)
      • tmevtmgr
      • TmFilter
      • Tmlisten
      • TMLWF(Windows Vista and later)
      • TmPfw
      • TMPreFilter
      • TmProxy (Windows 7 and below)
      • Tmtdi (Windows 7 and below)
      • Tmusa (Windows 8)
      • tmwfp (Windows Vista and later)
      • VSApiNt
    2. Locate and delete the following registry keys:
      For 32-bit
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeScan Monitor
      For 64-bit
      HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\
      Run\OfficeScan Monitor
    3. Locate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and delete the following registry keys:
      HKLM\Software\Microsoft\windows\currentversion\uninstall\Wofie
      For 32-bit
      HKLM\Software\Microsoft\windows\currentversion\uninstall\{C1F6E833-B25E-4C39-A026-D3253958B0D0}
      For 64-bit
      HKLM\Software\Microsoft\windows\currentversion\uninstall\{A38F51ED-D01A-4CE4-91EB-B824A00A8BDF}
    4. Locate and delete the following registry keys:
      For 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\
      AEGIS
      AMSP
      ClientStatus
      NSC
      Osprey
      Pc-cillinNTCorp
      Wofie
      For 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\
      AEGIS
      AMSP
      NSC
      Osprey
      Wofie
    5. Locate and delete the following keys from the HKEY_CLASSES_ROOT\Installer\ registry hive:
      For 32-bit
      "HKEY_CLASSES_ROOT\Installer\Features\338E6F1CE52B93C40A623D5293850B0D
      "HKEY_CLASSES_ROOT\Installer\Products\338E6F1CE52B93C40A623D5293850B0D
      "HKEY_CLASSES_ROOT\Installer\Upgradecodes\8A88AE84D667B304CB368C99791A74A6
      For 64-bit
      HKEY_CLASSES_ROOT\Installer\Features\DE15F83AA10D4EC419BE8B420AA0B8FD
      HKEY_CLASSES_ROOT\Installer\Products\DE15F83AA10D4EC419BE8B420AA0B8FD
      HKEY_CLASSES_ROOT\Installer\Upgradecodes\8A88AE84D667B304CB368C99791A74A6
  5. Locate the following and delete the SA folder:
    ...\Trend Micro\BM
    ...\Trend Micro\Security Agent
  6. Delete the program group Trend Micro Worry-Free Business Security Agent from the Windows Start menu.
  7. Go to Control Panel > Network Connections > Select a NIC > Properties > Remove Trend Micro Common Firewall Driver or Trend Micro NDIS 6.0 Filter Driver.
  8. Repeat Step 7 for each NIC until all Trend Micro Common Firewall Driver or Trend Micro NDIS 6.0 Filter Driver are removed.
  9. Restart the machine.

 

WFBS 8.0

To manually uninstall WFBS 8.0:
  1. Open the Services console, and then stop the following services:
    • Trend Micro Security Agent Listener
    • Trend Micro Security Agent Personal Firewall
    • Trend Micro Security Agent RealTime Scan
    • Trend Micro Security Agent NT Proxy Service (Win7 and below)
    • Trend Micro Unauthorized Change Prevention Service
  2. Open the Registry Editor to delete registry keys that belong to WFBS.
    Important: Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues.  Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.
    1. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete the following registry keys:
      • Ntrtscan
      • Tmactmon
      • TMBMServer
      • TMCFW (Windows XP)
      • Tmcomm
      • TMEBC
      • Tmeevw (Windows 8)
      • tmevtmgr
      • TmFilter
      • Tmlisten
      • TMLWF(Windows Vista and later)
      • TmPfw
      • TMPreFilter
      • TmProxy (Windows 7 and below)
      • Tmtdi (Windows 7 and below)
      • Tmusa (Windows 8)
      • tmwfp (Windows Vista and later)
      • VSApiNt
    2. Locate and delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeScan Monitor
    3. Locate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and delete the following registry keys:
      • Wofie
      • For 64-bit: {19D84BB4-35C9-4125-90AB-C2ADD0F9A8EC}
      • For 32-bit: {8456195C-3BA3-45A4-A6A7-30AE7A62EADB}
    4. Locate either of the following:
      Important: Do not delete the entire ..\TrendMicro registry hive if the Security Server (SS) is also installed on the same machine. You may just delete ..\Pc-cillinNtCorp key under TrendMicro.
      • For 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\
      • For 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\
  3. Locate the following and delete the SA folder:
    ..\Program Files (x86)\Trend Micro\Security Agent
  4. Restart the machine.

 

WFBS 7.0

To manually uninstall WFBS 7.0:
Notes:
  • The uninstallation of the WFBS Agent can be controlled via the WFBS server console. Click Security Settings > Client/Server group or individual Client/Server Security Agent > Remove.
  • If the actual uninstall password is missing, the administrator can set a new one and apply this to all Client/Server Security Agents. Click Preferences > Global Settings > Desktop/Server.
  1. If you already installed the Trend Micro Toolbar or Trend Micro Anti-Spam Toolbar, remove them via the CSA main console > Tools tab. Otherwise, go to Step 2.
  2. If the agent has been started, do the following:
    1. Right-click the tray icon and select Exit Worry-Free Business Security.
    2. Wait for the CoreServiceShell.exe and CoreFrameworkHost.exe processes to exit.
      If these processes do not exit, restart into safe mode and continue the next steps.
  3. Open the Registry Editor (regedit.exe) and go to the HKLM\System\CurrentControlSet\Services registry hive.
    Important: Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues.  Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.
  4. Locate and delete the registry keys under the following (if available):
    • AMSP
    • Tmactmon
    • Tmcomm
    • tmevtmgr
    • Tmlisten
    • Tmtdi
  5. Go to HKLM\Software\TrendMicro and delete the keys under the following (if available):
    • AEGIS
    • AMSP
    • NSC
    • UniClient
    • Vizor
    • Wofie
  6. Go to HKLM\Software\Microsoft\WINDOWS\CurrentVersion\Run and delete the "Trend Micro Client Framework" registry key.
  7. Delete HKLM\Software\Microsoft\WINDOWS\CurrentVersion\Uninstall\Wofie folder.
  8. Delete these registry keys (if available):
    • HKEY_CLASSES_ROOT\Installer\Features\717E70A0D5BB99B448B0C6D5DE252B77
    • HKEY_CLASSES_ROOT\Installer\Products\717E70A0D5BB99B448B0C6D5DE252B77
    • HKEY_CLASSES_ROOT\Installer\UpgradeCodes\8A88AE84D667B304CB368C99791A74A6
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall \{0A07E717-BB5D-4B99-840B-6C5DED52B277}
  9. Delete the program group Trend Micro Worry-Free Business Security Agent on the Windows Start menu.
  10. Go to Control Panel > Network Connections > Select a NIC > Properties.
  11. Remove Trend Micro Common Firewall Driver or Trend Micro NDIS 6.0 Filter Driver.
  12. Repeat Step 10 for each NIC until all drivers are removed.
  13. Run the command:
    regsvr32 /u /s "%INSTALL_ROOT%UniClient\UiFrmwrk\tmdshell.dll"
    taskkill /F /IM explorer.exe
  14. Restart the computer.
  15. Delete the following folders:
    • C:\Program Files\Trend Micro\AMSP
    • C:\Program Files\Trend Micro\Security Agent
    • C:\Program Files\Trend Micro\UniClient
    Note: Do the following only if there are no other Trend Micro products installed in the machine.
    Open a command prompt with Administrator privilege and enter the following commands:
    cd \programdata
    rmdir /S "Trend Micro"
  16. Remove the offline SA from the Security Server:
    1. Log in to the WFBS console.
    2. Click Security Settings.
    3. Select the offline SA from the Client Management Tree.
    4. Click Remove.
    5. Select Remove the selected inactive agent(s) and click Apply.
If you need further technical assistance, contact Trend Micro Technical Support.


Rate this Solution
Did this article help you?

Please provide your comments to help us improve this solution.

 
  *This form is an automated system. General questions, technical, sales and product-related issues submitted through this form will not be answered.
 
 

Connect with us on