Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Manually uninstalling the OfficeScan (OSCE) client on Windows 8 or Windows 2012

    • Updated:
    • 24 Nov 2016
    • Product/Version:
    • OfficeScan 10.6
    • Platform:
    • Windows 2012 Enterprise
    • Windows 8 32-bit
    • Windows 8 64-bit

There are instances where you have to do a manual uninstallation of the OSCE client on a Windows 8 or Windows 2012 machine. Learn how to completely remove the OSCE client from these platforms.


To manually uninstall the OSCE client:

  1. Log on to the client computer using an account with Administrator privileges.
  2. Go/Switch to Desktop Mode.
  3. Right-click the OfficeScan client icon on the system tray and select Unload OfficeScan. If prompted for a password, specify the unload password then click OK.
  4. If the unload password is not specified, stop the following services from Microsoft Management Console:
    • OfficeScan NT Listener
    • OfficeScan NT Firewall
    • OfficeScan NT RealTime Scan
    • Trend Micro Unauthorized Change Prevention Service
  5. Remove the OfficeScan client shortcut from the Start menu on Windows 8 and Windows Server 2012:
    1. Switch to desktop mode.
    2. Move the mouse cursor to the bottom right corner of the screen and click Start from the menu that appears. The Home screen appears.
    3. Right-click Trend Micro OfficeScan.
    4. Click Unpin from Start
  6. Open the Registry Editor (regedit.exe).
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  7. Delete the following registry keys:
    • If there are no other Trend Micro products installed on the computer:
      • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro For 64-bit computers: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro
    • If there are other Trend Micro products installed on the computer, delete the following keys only:
      • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog For 64-bit computers: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro\OfcWatchDog
      • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp For 64-bit computers: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro\PC-cillinNTCorp
  8. Delete the following registry keys/values:
    • For 32-bit systems:
      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT
      • OfficeScanNT Monitor (REG_SZ) underHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • For 64-bit systems:
      • HKEY_LOCAL_MACHINE\SOFTWARE\ Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT
      • OfficeScanNT Monitor (REG_SZ) underHKEY_LOCAL_MACHINE\SOFTWARE\ Wow6432Node\Microsoft\Windows\CurrentVersion\Run
  9. Delete all instances of the following registry keys in the following locations:
    • Locations:
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
    • Keys:
      • NTRtScan
      • tmcfw
      • tmcomm
      • TmFilter
      • TmListen
      • tmpfw
      • TmPreFilter
      • VSApiNt
      • tmlwf
      • tmwfp
      • tmactmon
      • TMBMServer
      • TMebc
      • tmevtmgr
      • tmeevw
      • tmusa
      • Tmproxy
      • Tmtdi
      • Tmccsf
  10. Manually delete the Trend Micro drivers using a command line editor using the following commands:
    • sc delete tmcomm
    • sc delete tmactmon
    • sc delete tmevtmgr
    • sc delete tmfilter
    • sc delete tmprefilter
    • sc delete tmwfp
    • sc delete vsapint
    • sc delete tmeevw
    • sc delete tmusa
    • sc delete tmebc
    • sc delete tmproxy
    • sc delete tmtdi
    • sc delete tmccsf
  11. Uninstall the Common Firewall Driver.
    1. Right-click My Network Places and click Properties.
    2. Right-click Local Area Connection and click Properties.
    3. On the General tab, select Trend Micro Common Firewall Driver and click Uninstall.
    4. Right-click Network and click Properties.
    5. Click Manage network connections.
    6. Right-click Local Area Connection and click Properties.
    7. On the Networking tab, select Trend Micro NDIS 6.0 Filter Driver and click Uninstall.
  12. Restart the client computer.
  13. If there are no other Trend Micro products installed on the computer, delete the Trend Micro installation folder (typically, C:\Program Files\Trend Micro). For 64-bit computers, the installation folder can be found under C:\Program Files (x86)\Trend Micro.
  14. If there are other Trend Micro products installed, delete the following folders:
    • C:\Program Files\Trend Micro\OfficeScan Client C:\Program Files\Trend Micro (x86)\OfficeScan Client
    • The BM folder under the Trend Micro installation folder (typically,C:\Program Files\Trend Micro\BM for 32-bit systems and C:\Program Files (x86)\Trend Micro\BM for 64-bit systems)
Solution Id:
Did this article help you?

Thank you for your feedback!

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.