Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Manually removing Trend Micro Endpoint Encryption Full Disk Encryption from a Windows machine

    • Updated:
    • 4 Oct 2019
    • Product/Version:
    • Endpoint Encryption 6.0
    • Platform:
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows 8.1
    • Windows 10
Summary
Manually remove FDE on Windows 7 after unsuccessful uninstallation.
Details
Public

Before following the procedure below, make sure that the disk is fully decrypted.

To manually uninstall FDE:

 
Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  1. Stop the DrAService Windows service using the Microsoft Management Console (MMC) service or running the following commands on the command line:
    C:\>net stop DrAService

    The following should appear:

    The DrAService service is stopping.

    The DrAService service was stopped successfully.

  2. On the Windows Task Tray, right-click the DA icon and select Remove Icon.
  3. Using the Windows Task Manager, ensure that the DrAService.exe and TMFDE.exe processes are no longer running.
  4. Delete the following DA installation directory:
    %PROGRAMFILES%\Trend Micro\TMFDE
  5. Remove the following registry entries:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TMFDE
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DrAService
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DrAService
  6. For SW Encryption, do the following:
    1. Remove the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MAWHDD registry entry.
    2. Go to HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Control\Class\{D36E967-E325-11CE-BFC1-08002BE10318} and remove the "MAWHDD" string from the "UpperFilters" key. Below are the original parameters:
      • UpperFilters = PartMgr MAWHDD
      • After editing, the parameter should be like this:
      • UpperFilters = PartMgr
  7. If there are no other Endpoint Encryption products (such as PolicyServer MMC) installed on the same machine, remove the following registry hives:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Mobile Armor
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MobileArmor
  8. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products and delete the registry hives containing the following strings:

    ECAB71DB675FF4A960F5F29ABEDDAE

    If there are no other Endpoint Encryption products installed, delete also the registry hives containing the following strings:

    • {B3A99BF36E4EC48A915AF1E0350BE1}
    • {AD5F5BBC88B80148961FC495A54A828} (For 64-bit systems only)
  9. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components and delete the registry hives containing the following strings:
    • TMFDE
    • CredentialManagement.dll
    • MAGina.dll
    • MASSO.dll
    • MASSOFixedLogon.dll

    If there are no other Endpoint Encryption products installed, remove also the registry hive containing the following string:

    • MAFIPS
  10. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products and remove the registry hives with the following strings:
    • ECAB71DB675FF4A960F5F29ABEDDAE

    If there are no other Endpoint Encryption products installed, remove also the registry hives containing the following strings:

    • {B3A99BF36E4EC48A915AF1E0350BE1}
    • {AD5F5BBC88B80148961FC495A54A828} (For 64-bit systems only)
  11. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and delete the registry hives with the following strings:
    • {BACE08-76BD-4FF5-9A06-5F2FA9EBDDEA}

    If there are no other Endpoint Encryption products installed, remove also the registry hives containing the following strings:

    • {BA3B37-E63F-4CE4-A819-A51F0E53B01E} (For 32-bit systems only)
    • {BBF5D9A-B88C-4108-9816-CF94A5458A82} (For 64-bit systems only)
  12. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and make sure that the "AutoAdminLogon" registry key is set to "0".
    • For Windows XP, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and change the value of "GinaDLL" registry key to "msgina.dll".
    • For Windows Vista or Windows 7, delete the following registry hives:
      • HKEY_CLASSES_ROOT\CLSID\{AF65-B1B6-417b-A1E0-A05B2837A752}
      • HKEY_CLASSES_ROOT\CLSID\{DEE953-2EEE-435c-9A71-291463101571}
      • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authenticatio n\Credential Provider Filters\{AF65-B1B6-417b-A1E0-A05B2837A752}
      • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{AF65-B1B6-417b-A1E0-A05B2837A752}
      • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{DEE953-2EEE-435c-9A71-291463101571}
  13. Reboot the machine.
  14. Delete the following files:
    • Hidden MAKernel file from the system partition's root (For SW Encryption only)
    • Encryption engine and helper files, which are the MAFips.dll and MAFipsHelper.dll, located on the following:
      • For 32-bit Windows OS: %windir%\System32
      • For 64-bit Windows OS: %windir%\System32 and %windir%\SysWOW64
    • DA HDD device driver MAWHDD.sys located on %windir%\System32\drivers\directory (For SW Encryption only)
    • DA for Single Sign-On (SSOO) modules located on the %windir%\System32 directory:
      • CredentialManagement.dll
      • MAGina.dll
      • MASSO.dll
      • MASSOFixedLogon.dll
Premium
Internal
Rating:
Category:
Uninstall
Solution Id:
1099658
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.