Manual removal of the Security Agent - Worry-Free Business Security

Manually uninstalling Worry-Free Business Security (WFBS) 7.0's Security Agent with Anti-Malware Solution Platform (AMSP) 1.5

- Updated:
- 1 Aug 2013
- Product/Version:
- Worry-Free Business Security Standard/Advanced 7.0
- Platform:
- Windows 2000 Server
- Windows 2000 Small Business Server
- Windows 2003 Datacenter Server
- Windows 2003 Datacenter Server Edition 64-bit
- Windows 2003 Enterprise Server
- Windows 2003 Home Server
- Windows 2003 Small Business Server
- Windows 2003 Standard Server Edition
- Windows 2003 Standard Server Edition 64-bit
- Windows 2003 Storage Server
- Windows 2003 Web Server Edition
- Windows 2008 Datacenter Server
- Windows 2008 Datacenter Server Edition 64-bit
- Windows 2008 Enterprise Server
- Windows 2008 Enterprise Server Edition 64-bit
- Windows 2008 Essential Business Server
- Windows 2008 Small Business Server
- Windows 2008 Standard Server Edition
- Windows 2008 Standard Server Edition 64-bit
- Windows 2008 Storage Server
- Windows 2008 Web Server Edition
- Windows 2008 Web Server Edition 64-bit
- Windows 7 32-bit
- Windows 7 64-bit
- Windows Vista 32-bit
- Windows Vista 64-bit
- Windows XP Home
- Windows XP Professional
- Windows XP Professional 64-bit

To manually uninstall the WFBS Security Agent with AMSP:

Unload WFBS. Right-click the Security Agent icon, then select Exit Worry Free Business Security.
Enter the unload password.
If you do not have the unload password:
1. Set the Trend Micro Solution service to "Disabled".
2. Reboot the computer.
Open Task Manager, then kill the uiWatchDog.exe process.
Open a command prompt, then issue the following commands:
1. Stop the Security Agent services and drivers:
  sc stop tmactmon
  sc stop tmevtmgr
  sc stop tmcomm
  sc stop tmtdi
  sc stop amsp
  sc stop tmlisten
  
  For Windows 7, Vista and 2008:
  sc stop tmlwf
  sc stop tmwfp
2. Delete SA services and drivers:
  sc delete tmactmon
  sc delete tmevtmgr
  sc delete tmcomm
  sc delete tmtdi
  sc delete amsp
  sc delete tmlisten ( WFBS )
  
  For Windows 7, Vista and 2008:
  
  sc delete tmlwf
  sc delete tmwfp
Uninstall the Firewall component from the TCP/IP Properties of the Network Interface Card (NIC).

For Windows 7, Vista and 2008:
Open the Registry Editor ( regedit.exe ) and remove the following registry keys:
Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro
\AEGIS
\AMSP
\AMSPStatus
\NSC
\Uniclient { UniClient }
\Visor { UniClient }
\Wofie { UniClient }

[ Services ]

If the following hives are still present, delete them:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Amsp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmactmon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmcomm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmevtmgr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmListen
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmtdi
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmcfw

For Windows 7, Vista and 2008:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmlwf
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmwfp

[ Uninstall Section ]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0A07E717-BB5D-4B99-840B-6C5DED52B277}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wofie

[ AutoRun ]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
“Trend Micro Client Framework”

[ Additional ]

HKEY_CURRENT_USER\Software\TrendMicro
HKEY_CLASSES_ROOT\Installer\Features\717E70A0D5BB99B448B0C6D5DE252B77
HKEY_CLASSES_ROOT\Installer\Products\717E70A0D5BB99B448B0C6D5DE252B77
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\8A88AE84D667B304CB368C99791A74A6
Delete the following folders:
[ Shortcut link ]

C:\Documents and Settings\All Users\Start Menu\Programs\Trend Micro Worry-Free Business Security Agent

[ Program Folder ]

C:\Program Files\Trend Micro\
C:\Program Files\Trend Micro\AMSP
C:\Program Files\Trend Micro\UniClient { Product }
C:\Program Files\Trend Micro\Security Agent { Product }

If for some reason, you are NOT permitted because TmdShell.dll is still loaded, you can unregister it by following these steps:
1. Open a command prompt window.
2. Go to C:\Program Files\Trend Micro\UniClient\UiFrmwrk.
3. Type "regsvr32 /u /s tmdshell.dll".
4. Type "taskkill /F /IM explorer.exe".
There may be instances when some folders have “READ-Only” attribute. In such cases, reset the folder permission to remove the "read-only attribute", and then try to delete the folder again.

If this still fails, reboot the computer and then continue to delete the remaining folder before you proceed with the succeeding steps.
Delete the following files:
C:\Windows\system32\drivers\tmactmon.sys
C:\Windows\system32\drivers\tmcomm.sys
C:\Windows\system32\drivers\tmevtmgr.sys
C:\Windows\system32\drivers\tmtdi.sys
C:\Windows\system32\drivers\tmcfw.sys

For Windows 7, Vista and 2008:

C:\Windows\system32\drivers\tmlwf.sys
C:\Windows\system32\drivers\tmwfp.sys
Restart the computer.

Need More Help?

Manually uninstalling Worry-Free Business Security (WFBS) 7.0's Security Agent with Anti-Malware Solution Platform (AMSP) 1.5