Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Manually uninstalling the Security Agent (SA) in Worry-Free Business Security (WFBS)

    • Updated:
    • 15 Dec 2015
    • Product/Version:
    • Worry-Free Business Security Standard/Advanced 7.0
    • Worry-Free Business Security Standard/Advanced 8.0
    • Worry-Free Business Security Standard/Advanced 9.0
    • Platform:
    • Windows 2003 Datacenter Server
    • Windows 2003 Datacenter Server Edition 64-bit
    • Windows 2003 Enterprise Server
    • Windows 2003 Home Server
    • Windows 2003 Small Business Server
    • Windows 2003 Standard Server Edition
    • Windows 2003 Standard Server Edition 64-bit
    • Windows 2003 Storage Server
    • Windows 2003 Web Server Edition
    • Windows 2008 Datacenter Server
    • Windows 2008 Datacenter Server Edition 64-bit
    • Windows 2008 Enterprise Server
    • Windows 2008 Enterprise Server Edition 64-bit
    • Windows 2008 Essential Business Server
    • Windows 2008 Small Business Server
    • Windows 2008 Standard Server Edition
    • Windows 2008 Standard Server Edition 64-bit
    • Windows 2008 Storage Server
    • Windows 2008 Web Server Edition
    • Windows 2008 Web Server Edition 64-bit
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Home
    • Windows XP Professional
    • Windows XP Professional 64-bit
Summary

This article describes how to manually uninstall the SA in WFBS versions 7.0, 8.0, and 9.0.

Details
Public

To manually uninstall the WFBS SA:

To manually uninstall SA in WFBS 9.0:

  1. Open the Microsoft Windows Services console and stop the following services:
    • Trend Micro Security Agent Listener
    • Trend Micro Security Agent Personal Firewall
    • Trend Micro Security Agent RealTime Scan
    • Trend Micro Security Agent NT Proxy Service (Win7 and below)
    • Trend Micro Unauthorized Change Prevention Service
    • Trend Micro Common Client Solution Framework
  2. Open the Task Manager and make sure the following processes are not running:
    • Ntrtscan.exe
    • PccNTMon.exe
    • TMBMSRV.exe
    • TmCCSF.exe
    • TmListen.exe
    • Tmproxy.exe
    • Pccntupd.exe
    • xpupg.exe
  3. Open the Command Prompt using administrator privileges and execute the following commands one by one:
    • For 32-bit:
      • regsvr32 /u /s "C:\program files\trend micro\Security Agent\tmdshell.dll"
      • taskkill /F /IM explorer.exe
      • start explorer.exe
    • For 64-bit:
      • regsvr32 /u /s "C:\program files (x86)\trend micro\Security Agent\tmdshell_64x.dll"
      • taskkill /F /IM explorer.exe
      • start explorer.exe
  4. Open the Registry Editor to delete registry keys that belong to WFBS.
     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
    1. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete the following registry keys:
      • Ntrtscan
      • Tmactmon
      • TMBMServer
      • TmCCSF
      • TMCFW (Windows XP)
      • Tmcomm
      • TMEBC
      • Tmeevw (Windows 8)
      • tmevtmgr
      • TmFilter
      • Tmlisten
      • TMLWF(Windows Vista and later)
      • TmPfw
      • TMPreFilter
      • TmProxy (Windows 7 and below)
      • Tmtdi (Windows 7 and below)
      • Tmusa (Windows 8)
      • tmwfp (Windows Vista and later)
      • VSApiNt
    2. Locate and delete the following registry keys:
      • For 32-bit:
        • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeScan Monitor
      • For 64-bit:
        • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\
          Run\OfficeScan Monitor
    3. Locate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and delete the following registry keys:
      • HKLM\Software\Microsoft\windows\currentversion\uninstall\Wofie
      • For 32-bit:
        • HKLM\Software\Microsoft\windows\currentversion\uninstall\{C1F6E833-B25E-4C39-A026-D3253958B0D0}
      • For 64-bit:
        • HKLM\Software\Microsoft\windows\currentversion\uninstall\{A38F51ED-D01A-4CE4-91EB-B824A00A8BDF}
    4. Locate and delete the following registry keys:
      • For 32-bit:
        • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\
        • AEGIS
        • AMSP
        • ClientStatus
        • NSC
        • Osprey
        • Pc-cillinNTCorp
        • Wofie
      • For 64-bit:
        • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\
        • AEGIS
        • AMSP
        • NSC
        • Osprey
        • Wofie
    5. Locate and delete the following keys from the HKEY_CLASSES_ROOT\Installer\ registry hive:
      • For 32-bit:
        • "HKEY_CLASSES_ROOT\Installer\Features\338E6F1CE52B93C40A623D5293850B0D
        • "HKEY_CLASSES_ROOT\Installer\Products\338E6F1CE52B93C40A623D5293850B0D
        • "HKEY_CLASSES_ROOT\Installer\Upgradecodes\8A88AE84D667B304CB368C99791A74A6
      • For 64-bit:
        • HKEY_CLASSES_ROOT\Installer\Features\DE15F83AA10D4EC419BE8B420AA0B8FD
        • HKEY_CLASSES_ROOT\Installer\Products\DE15F83AA10D4EC419BE8B420AA0B8FD
        • HKEY_CLASSES_ROOT\Installer\Upgradecodes\8A88AE84D667B304CB368C99791A74A6
  5. Locate the following and delete the SA folder:
    • ...\Trend Micro\BM
    • ...\Trend Micro\Security Agent
  6. Delete the program group Trend Micro Worry-Free Business Security Agent from the Windows Start menu.
  7. Go to Control Panel > Network Connections > Select a NIC > Properties > Remove Trend Micro Common Firewall Driver or Trend Micro NDIS 6.0 Filter Driver.
  8. Repeat Step 7 for each NIC until all Trend Micro Common Firewall Driver or Trend Micro NDIS 6.0 Filter Driver are removed.
  9. Restart the machine.

To manually uninstall SA in WFBS 8.0:

  1. Open the Microsoft Windows Services console and stop the following services:
    • Trend Micro Security Agent Listener
    • Trend Micro Security Agent Personal Firewall
    • Trend Micro Security Agent RealTime Scan
    • Trend Micro Security Agent NT Proxy Service (Win7 and below)
    • Trend Micro Unauthorized Change Prevention Service
  2. Open the Registry Editor to delete registry keys that belong to WFBS.
     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
    1. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete the following registry keys:
      • Ntrtscan
      • Tmactmon
      • TMBMServer
      • TMCFW (Windows XP)
      • Tmcomm
      • TMEBC
      • Tmeevw (Windows 8)
      • tmevtmgr
      • TmFilter
      • Tmlisten
      • TMLWF(Windows Vista and later)
      • TmPfw
      • TMPreFilter
      • TmProxy (Windows 7 and below)
      • Tmtdi (Windows 7 and below)
      • Tmusa (Windows 8)
      • tmwfp (Windows Vista and later)
      • VSApiNt
    2. Locate and delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeScan Monitor
    3. Locate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and delete the following registry keys:
      • Wofie
      • For 64-bit: {19D84BB4-35C9-4125-90AB-C2ADD0F9A8EC}
      • For 32-bit: {8456195C-3BA3-45A4-A6A7-30AE7A62EADB}
    4. Locate either of the following:
      • For 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\
      • For 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\
       
      Do not delete the entire ..\TrendMicro registry hive if the Security Server (SS) is also installed on the same machine. You may just delete ..\Pc-cillinNtCorp key under TrendMicro.
  3. Locate ..\Program Files (x86)\Trend Micro\Security Agent and delete the SA folder.
  4. Restart the machine.

To manually uninstall SA in WFBS 7.0:

  • The uninstallation of the WFBS Agent can be controlled via the WFBS server console. Click Security Settings > Client/Server Group or Individual Client/Server Security Agent > Remove.
  • If the actual uninstall password is missing, the administrator can set a new one and apply this to all Client/Server Security Agents. Click Preferences > Global Settings > Desktop/Server.
  1. If you already installed the Trend Micro Toolbar or Trend Micro Anti-Spam Toolbar, remove them via the CSA main console > Tools tab. Otherwise, go to Step 2.
  2. If the agent has been started, do the following:
    1. Right-click the tray icon and select Exit Worry-Free Business Security.
    2. Wait for the CoreServiceShell.exe and CoreFrameworkHost.exe processes to exit.
      If these processes do not exit, restart into safe mode and continue the next steps.
  3. Open the Registry Editor (regedit.exe) and go to the HKLM\System\CurrentControlSet\Services registry hive.
     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  4. Locate and delete the registry keys under the following (if available):
    • AMSP
    • Tmactmon
    • Tmcomm
    • tmevtmgr
    • Tmlisten
    • Tmtdi
  5. Go to HKLM\Software\TrendMicro and delete the keys under the following (if available):
    • AEGIS
    • AMSP
    • NSC
    • UniClient
    • Vizor
    • Wofie
  6. Go to HKLM\Software\Microsoft\WINDOWS\CurrentVersion\Run and delete the "Trend Micro Client Framework" registry key.
  7. Delete the HKLM\Software\Microsoft\WINDOWS\CurrentVersion\Uninstall\Wofie folder.
  8. Delete these registry keys (if available):
    • HKEY_CLASSES_ROOT\Installer\Features\717E70A0D5BB99B448B0C6D5DE252B77
    • HKEY_CLASSES_ROOT\Installer\Products\717E70A0D5BB99B448B0C6D5DE252B77
    • HKEY_CLASSES_ROOT\Installer\UpgradeCodes\8A88AE84D667B304CB368C99791A74A6
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall \{0A07E717-BB5D-4B99-840B-6C5DED52B277}
  9. Delete the program group Trend Micro Worry-Free Business Security Agent on the Windows Start menu.
  10. Go to Control Panel > Network Connections > Select a NIC > Properties.
  11. Remove Trend Micro Common Firewall Driver or Trend Micro NDIS 6.0 Filter Driver.
  12. Repeat Step 10 for each NIC until all drivers are removed.
  13. Run the following commands:
    • regsvr32 /u /s "%INSTALL_ROOT%UniClient\UiFrmwrk\tmdshell.dll"
    • taskkill /F /IM explorer.exe
  14. Restart the computer.
  15. Delete the following folders:
    • C:\Program Files\Trend Micro\AMSP
    • C:\Program Files\Trend Micro\Security Agent
    • C:\Program Files\Trend Micro\UniClient
     
    Do the following only if there are no other Trend Micro products installed in the machine.
  16. Open a command prompt with Administrator privilege and enter the following commands:
    • cd \programdata
    • rmdir /S "Trend Micro"
  17. Remove the offline SA from the Security Server:
    1. Log in to the WFBS console.
    2. Click Security Settings.
    3. Select the offline SA from the Client Management Tree.
    4. Click Remove.
    5. Select Remove the selected inactive agent(s) and click Apply.

If you need further technical assistance, contact Trend Micro Technical Support.

Premium
Internal
Rating:
Category:
Uninstall
Solution Id:
1056867
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.