Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Manually uninstalling Deep Security Agent, Relay, and Notifier from Windows

    • Updated:
    • 29 May 2019
    • Product/Version:
    • Deep Security 10.0
    • Deep Security 10.1
    • Deep Security 10.2
    • Deep Security 10.3
    • Deep Security 11.0
    • Deep Security 9.5
    • Deep Security 9.6
    • Platform:
    • Windows 2003 Enterprise
    • Windows 2003 Enterprise 64-bit
    • Windows 2003 Standard
    • Windows 2003 Standard 64-bit
    • Windows 2008 Enterprise
    • Windows 2008 Enterprise 64-bit
    • Windows 2008 Server R2
    • Windows 2008 Standard
    • Windows 2008 Standard 64-bit
Summary

Perform a manual uninstallation when you are having issues uninstalling the Deep Security Agent, Relay, and Notifier.

Details
Public

To manually uninstall the Deep Security Agent, Relay and Notifier:

  1. Disable the agent self-protection feature from the Deep Security Manager (DSM).
    If you cannot connect to Deep Security Manager, disable self-protection from command line.
  2. Stop the following services:
    • Trend Micro Deep Security Agent
    • Trend Micro Deep Security Monitor
    • Trend Micro Deep Security Notifier
    • Trend Micro Solution Platform
  3. Go to Local Area Network Properties and uninstall the following items:
    • Trend Micro Deep Security Agent Filter Driver (For Windows 2003)
    • Trend Micro LightWeight Filter Driver (For Windows 2008)

    Uninstall Trend Micro LightWeight Filter Driver

  4. Open the command prompt and run the following commands to stop and delete the services:
    • sc stop tmactmon
    • sc stop tmevtmgr
    • sc stop tmcomm
    • sc stop tmumh
    • sc stop tmebc
    • sc stop tbimdsa
    • sc delete ds_agent
    • sc delete ds_monitor
    • sc delete ds_notifier
    • sc delete Amsp
    • sc delete tmactmon
    • sc delete tmevtmgr
    • sc delete tmcomm
    • sc delete tmumh
    • sc delete tmebc
    • sc delete tbimdsa

    Note that some service deletions may fail due to access denied and you can just skip it because Step 5 will completely delete the services after reboot.

  5. Delete the following registry entries:

     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AEGIS
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSP
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSPStatus
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Deep Security Agent
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\WL
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Amsp
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ds_agent
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ds_monitor
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ds_notifier
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tbimdsa
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmactmon
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmcomm
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmevtmgr
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TMEBC
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmumh
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Deep Security Agent
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System\tbimdsa\

    (Agent 32-bit)

    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\ and search "Deep Security" and delete the folder containing it.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\
      689D08D76B5A47A4FB59D97D2C4B9308\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\
      689D08D76B5A47A4FB59D97D2C4B9308\
    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and search "Deep Security" and delete the folder containing it.

    (Agent 64-bit)

    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\ and search "Deep Security" and delete the folder containing it.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\
      689D08D76B5A47A4FB59D97D2C4B9308\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\
      689D08D76B5A47A4FB59D97D2C4B9308\
    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and search "Deep Security" and delete the folder containing it.

    (Relay 32-bit)

    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\ and search "Deep Security" and delete the folder containing it.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\
      9595A43D099883B49B6A1D3194B54E48\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\
      9595A43D099883B49B6A1D3194B54E48\
    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and search "Deep Security" and delete the folder containing it.

    (Relay 64-bit)

    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\ and search "Deep Security" and delete the folder containing it.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\
      9595A43D099883B49B6A1D3194B54E48\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\
      9595A43D099883B49B6A1D3194B54E48\
    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and search "Deep Security" and delete the folder containing it.

    (Notifier 32-bit)

    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\ and search "Deep Security" and delete the folder containing it.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\
      FD7DF71DF377E464F8F59FDA68339BD0\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\
      FD7DF71DF377E464F8F59FDA68339BD0\
    • Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and search "Deep Security" and delete the folder containing it.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
      Deep Security Notifier (string / REG _ SZ)
  6. Restart the machine.
  7. Delete the following files and folders:
    • C:\WINDOWS\System32\Drivers\tbimdsa.sys
    • C:\WINDOWS\System32\Drivers\tmactmon.sys
    • C:\WINDOWS\System32\Drivers\tmcomm.sys
    • C:\WINDOWS\System32\Drivers\tmevtmgr.sys
    • C:\WINDOWS\System32\Drivers\TMEBC64.sys
    • C:\WINDOWS\System32\Drivers\TMEBC32.sys
    • C:\WINDOWS\System32\LogFiles\ds_agent\
    • C:\Program Files\Trend Micro \AMSP\
    • C:\Program Files\Trend Micro \Deep Security Agent
    • C:\Program Files\Trend Micro \Deep Security Notifier
    • C:\ProgramData\Trend Micro\AMSP\
    • C:\ProgramData\Trend Micro\Deep Security Agent\
    • C:\ProgramData\Trend Micro\Deep Security Notifier\
    • C:\ProgramData\Microsoft\Windows\Start Menu \Programs\Trend Micro\
      Deep Security\Trend Micro Deep Security Notifier (for Windows 2008)
    • C:\Documents and Settings\All Users\Start menu\programs\Trend Micro\
      Deep Security\Trend Micro Deep Security Notifier (for Windows 2003)
Premium
Internal
Rating:
Category:
Uninstall
Solution Id:
1096150
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.