How to uninstall the OfficeScan 10.

x client

Solution ID: EN-1039283

Product: Core Protection Module - 1.0, 1.5, 1.6; OfficeScan - 10.0, 10.5
Operating System: Windows - 2000 Advanced Server, 2000 Server, 2003 Enterprise Server, 2003
Standard Server Edition, 2008 Enterprise Server, Vista 32-bit, XP Home
Published: 12/3/2010 12:33 AM

Problem These procedures are applicable to you, if you want to:

:
1. Uninstall the Officescan clients
2. You want to make sure the Officescan client components are all remove from the computer.
3. Troubleshooting.
4. Uninstall the OfficeScan client before installing Core Protection Module

Solution Public
:

There are different ways to uninstall the OfficeScan programs from the clients:
• Uninstalling the Client from the Web Console
• Running the Client Uninstallation Program
Note: If uninstallation fails using the above methods, manually uninstall the client.
• Manual uninstallation

Uninstalling the client from the web console

Important: Uninstalling the client program also removes security risk protection on selected
clients.
Please do the following:
1. Log on to the OfficeScan web console.
2. Go to Networked Computers > Client Management.

3. In the client tree, select the clients that you want to uninstall OfficeScan from and then click
Tasks > Client Uninstallation.

4. On the Client Uninstallation screen, click Initiate Uninstallation. The server then sends a
notification to the clients.

5. Check the notification status and verify if there are clients that did not receive the
notification.
a Click Select Un-notified Computers and then Initiate Uninstallation to immediately
. resend the notification to the clients.
b Click Stop Uninstallation to prompt OfficeScan to stop notifying clients. Clients which are
. already notified and performing uninstallation will ignore this command.
Back to top

Running the Client Uninstallation Program

If you granted users the privilege to uninstall the client program, ask them to run the client
uninstallation program from their computers.

This procedure requires users to specify the uninstallation password. Make sure that you share
the password only to users who will run the uninstallation program and change it immediately has
it been divulged to other users. You can also disable the password on computers where the client
will be uninstalled.

Please do the following:

1. On the Windows Start menu, perform any of the two options:
• Go to Programs > Trend Micro OfficeScan Client > Uninstall OfficeScan Client.
• Click Control Panel > Add or Remove Programs and then look for Trend Micro
OfficeScan Client and then click Change. Follow the on-screen instruction to finish the
uninstallation.

2. If prompted, type the uninstallation password. OfficeScan will notify you of the progress and
completion. You do not need to restart the client computer to complete the uninstallation.
 Back to top

Manually Uninstalling the Client

Perform manual uninstallation only if you encounter issues when uninstalling from the web
console or after running the uninstallation program.

Please do the following:

1. Log on to the client computer using an account with Administrator privileges.

2. Right-click on the OfficeScan client icon on the system tray and then select Unload
Officescan.

If prompted for a password, specify the unload password and then click OK.

Note: You can disable the password on computers where the client will be unloaded. For
details, see Client Privileges and Other Settings on pages 4-9 of the Administrator's Guide.

3. If the unload password was not specified, stop the following services from the Microsoft
Management Console:
• OfficeScan NT Listener
• OfficeScan NT Firewall
• OfficeScanNT RealTime Scan
• OfficeScan NT Proxy Service
• Trend Micro Unauthorized Change Prevention Service (if the computer runs an x86 type
platform)
4. Go to Start > Programs and then right-click on Trend Micro OfficeScan Client then click
Delete.

5. Open the Registry Editor.

Important: Always back up the whole registry before making any modifications. Incorrect
changes to the registry can cause serious system problems.
6. Delete the following registry keys:

If there are no other Trend Micro products installed on the computer:

• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro
For 64-bit computers:
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro

If there are other Trend Micro products installed on the computer:

• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC
• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog
For 64-bit computers:
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\TrendMicro\OfcWatchDog
• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\TrendMicro\PC-cillinNTCorp
7. Delete the following registry keys/values:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeSca
nNT
• OfficeScanNT Monitor (REG_SZ) under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

8. Delete all instances of the following registry keys in the following locations:

Locations:
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services

Keys:
• ntrtscan
• tmcfw
• tmcomm
• TmFilter
• Tmlisten
• tmpfw
 • TmPreFilter
• TmProxy
• tmtdi
• VSApiNt
• tmlwf (For Windows Vista/2008 computers)
• tmwfp (For Windows Vista/2008 computers)
• tmactmon
• TMBMServer
• tmevtmgr

9. Close the Registry Editor.

10 Go to the Control Panel and then double-click on System.

.

11 Click the Hardware tab and then click Device Manager > View > Show hidden devices.
.

12 Expand Non-Plug and Play Drivers and then uninstall the following devices:
.
• tmcomm
• tmactmon
• tmevtmgr
• Trend Micro Filter
• Trend Micro PreFilter
• Trend Micro TDI Driver
• Trend Micro VSAPI NT
• Trend Micro Unauthorized Change Prevention Service
• Trend Micro WFP Callout Driver (For Windows Vista/2008 computers)

13 Uninstall the Common Firewall Driver.

.
a Right-click My Network Places and then click Properties.
.

b Right-click Local Area Connection and then click Properties.

.

c. On the General tab, select Trend Micro Common Firewall Driver and then click
Uninstall.

On Windows Vista computers, do the following:

a Right-click Network and then click Properties > Manage network connections.
.
b Right-click Local Area Connection and then click Properties.
.
c. On the Networking tab, select Trend Micro NDIS 6.0 Filter Driver and then click
Uninstall.
14 Restart the client computer.
.

Important:
• If there are no other Trend Micro products installed on the computer, delete the Trend Micro
installation folder.
By default: C:Program Files\Trend Micro

For 64-bit computers: C:\Program Files (x86)\Trend Micro

• If there are other Trend Micro products installed, delete the following folders:
§ {client installation folder}
§ The BM folder under the Trend Micro installation folder (by default located in C:\Program
Files\Trend Micro\BM)