Views:

To resolve this:

Reboot into recovery mode to disable SIP (temporary limitation by Apple).
Run in terminal.app (You may run either with root and non-root user):
1. systemextensionsctl reset
2. systemextensionsctl uninstall E8P47U2H32 com.trendmicro.icore.es and systemextensionsctl uninstall E8P47U2H32 com.trendmicro.icore.netfilter
User will be prompted for credential for each command.
Kill the process in the Activity Monitor.

After resetting, it is highly recommended to reboot macOS, as:

A workaround to a bug in Network Extension framework
A change to enable SIP

For additional reference in configuring SIP, refer to this Apple Developer article .

Com.trendmicro.icore.es process continues to run on macOS after uninstalling agent in Cloud One - Workload Security

Product / Version includes:

Cloud One - Endpoint and Workload SecurityAll

Last updated: 2023/04/27

Solution ID: KA-0014431

Category: Troubleshoot

Summary

After uninstalling the Workload Security agent in macOS, com.trendmicro.icore.es process is still showing in the Activity Monitor.

To resolve this:

Reboot into recovery mode to disable SIP (temporary limitation by Apple).
Run in terminal.app (You may run either with root and non-root user):
1. systemextensionsctl reset
2. systemextensionsctl uninstall E8P47U2H32 com.trendmicro.icore.es and systemextensionsctl uninstall E8P47U2H32 com.trendmicro.icore.netfilter
User will be prompted for credential for each command.
Kill the process in the Activity Monitor.

After resetting, it is highly recommended to reboot macOS, as:

A workaround to a bug in Network Extension framework
A change to enable SIP

For additional reference in configuring SIP, refer to this Apple Developer article .

Was this article helpful?