Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Manually uninstalling the Security Agent (SA) in Worry-Free Business Security (WFBS)

    • Updated:
    • 15 Sep 2021
    • Product/Version:
    • Worry-Free Business Security Advanced 10.0
    • Worry-Free Business Security Advanced 9.5
    • Worry-Free Business Security Standard 10.0
    • Worry-Free Business Security Standard 9.0
    • Worry-Free Business Security Standard 9.5
    • Platform:
Summary

This article describes how to manually uninstall the SA of WFBS 10.0.

Details
Public

To manually uninstall the Security Agent:

  1. Open the Microsoft Windows Services console and stop the following services:

    • Trend Micro Security Agent Listener
    • Trend Micro Security Agent Firewall
    • Trend Micro Security Agent RealTime Scan
    • Trend Micro Unauthorized Change Prevention Service
    • Trend Micro Common Client Solution Framework
     
    If the mentioned services cannot be stopped, ensure that the Security Agent Self-Protection is deactivated by unloading the agent. For instructions, refer to Unloading the Security Agent (SA) of Worry-Free Business Security (WFBS).
     
  2. Open the Task Manager and make sure the following processes are not running:

    • Ntrtscan.exe
    • PccNT.exe
    • PccNTMon.exe
    • Pccntupd.exe
    • TMBMSRV.exe
    • TmCCSF.exe
    • TmListen.exe
    • Tmpfw.exe
    • xpupg.exe
  3. Open the Command Prompt using administrator privileges and execute the following commands one by one:

    • For 32-bit:

      • regsvr32 /u /s "C:\program files\trend micro\Security Agent\tmdshell.dll"
      • taskkill /F /IM explorer.exe
      • start explorer.exe
    • For 64-bit:

      • regsvr32 /u /s "C:\program files (x86)\trend micro\Security Agent\tmdshell_64x.dll"
      • taskkill /F /IM explorer.exe
      • start explorer.exe
  4. Open the Registry Editor to delete registry keys that belong to WFBS.

     
    • Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
    • In case a registry entry is not found, proceed to the next item.
     
    1. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete the following registry keys:

      • Ntrtscan
      • Tmactmon
      • TMBMServer
      • TmCCSF
      • Tmcomm
      • Tmeevw
      • tmevtmgr
      • TmFilter
      • Tmlisten
      • Tmlwf
      • TmPfw
      • TMPreFilter
      • tmpreflt
      • tmumh
      • Tmusa
      • tmwfp
      • tmwscsvc
      • VSApiNt
    2. Locate and delete the following registry keys:

      • For 32-bit:

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeScanNT Monitor

      • For 64-bit:

        HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ Run\OfficeScanNT Monitor

    3. Locate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and delete the following registry keys:

      • HKLM\Software\Microsoft\windows\currentversion\uninstall\Wofie
      • For 32-bit:

        HKLM\Software\Microsoft\windows\currentversion\uninstall\{33BEF4B8-AFD3-4AF0-BD20-42F70A417266}

      • For 64-bit:

        HKLM\Software\Microsoft\windows\currentversion\uninstall\{1FF9FE5E-27A3-45F1-979B-85903EB3CFF1}

    4. Locate and delete the following registry keys:

      • For 32-bit:

        • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\
        • AEGIS
        • AMSP
        • AMSPStatus
        • ClientStatus
        • NSC
        • Osprey
        • Pc-cillinNTCorp
        • Wofie
      • For 64-bit:

        • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\
        • ClientStatus
        • NSC
        • Pc-cilinNTCorp
    5. Locate and delete the following keys from the HKEY_CLASSES_ROOT\Installer\ registry hive:

      • For 32-bit:

        • "HKEY_CLASSES_ROOT\Installer\Features\8B4FEB333DFA0FA4DB02247FA0142766
        • "HKEY_CLASSES_ROOT\Installer\Products\8B4FEB333DFA0FA4DB02247FA0142766
      • For 64-bit:

        • HKEY_CLASSES_ROOT\Installer\Features\E5EF9FF13A721F5479B95809E33BFC1F
        • HKEY_CLASSES_ROOT\Installer\Products\E5EF9FF13A721F5479B95809E33BFC1F
  5. Locate the following and delete the SA folder:

    • ...\Trend Micro\BM
    • ...\Trend Micro\Security Agent
     
    If the folders was not able to be deleted, make sure that the processes mentioned in #2 was stopped.
     
  6. Delete the program group Trend Micro Worry-Free Business Security Agent from the Windows Start menu.
  7. Go to Control Panel > Network Connections > Select a NIC > Properties > Remove Trend Micro NDIS 6.0 Filter Driver.
  8. Repeat Step 7 for each NIC until all Trend Micro Common Firewall Driver or Trend Micro NDIS 6.0 Filter Driver are removed.
  9. Restart the machine.

If this procedure fails, contact Trend Micro Technical Support for help in uninstalling the Security Agent.

Premium
Internal
Partner
Rating:
Category:
Uninstall
Solution Id:
1056867
Feedback
Did this article help you?

Thank you for your feedback!


*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.