Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Uninstalling Worry-Free Business Security Services (WFBS-SVC) Agents

    • Updated:
    • 16 Aug 2017
    • Product/Version:
    • Worry-Free Business Security Services 6.0
    • Worry-Free Business Security Services 6.1
    • Worry-Free Business Security Services 6.2
    • Platform:
    • Windows 10 32-bit
    • Windows 10 64-bit
    • Windows 2000 Professional
    • Windows 2000 Small Business Server
    • Windows 2003 Home Server
    • Windows 2003 Server R2
    • Windows 2003 Small Business Server
    • Windows 2003 Small Business Server R2
    • Windows 2003 Standard
    • Windows 2008 Essential Business Server
    • Windows 2008 Server Foundation
    • Windows 2008 Server R2
    • Windows 2008 Small Business Server
    • Windows 2008 Standard
    • Windows 2011 Small Business Server Standard
    • Windows 7 32-Bit
    • Windows Vista 32-bit
    • Windows XP Home
    • Windows XP Professional
    • Windows XP Tablet PC
    • Windows Phone 8.0
    • Windows Phone 8.1
Summary

Use the procedures in this article to:

  • Uninstall the WFBS-SVC Security Agent.
  • Remove WFBS-SVC Security Agent components from the computer.
  • Troubleshoot problems encountered while removing the WFBS-SVC Security Agent.

Details
Public

The following are the options for uninstalling the Security Agent from Windows devices:

 
Uninstalling the Security Agent leaves endpoint devices vulnerable to malware threats.
 
The following files will remain in the computer when you apply this procedure while Internet Explorer is open on the target PC. The files will be automatically removed after rebooting:
  • TmIEplg.dll/TmIEplg32
  • TmProxy.dll/TmProxy32.dll

To uninstall the Security Agent using the web console:

  1. Log on to the WFBS-SVC web console.
  2. Go to the Devices tab and look for the Security Agent/s by either using the Search box or finding it manually in the Agent tree.
  3. Tick the checkbox to select the Security Agent/s.

    Select the Security Agent

    Click image to enlarge

  4. Click More > Uninstall Agent.

    Uninstall the Agent

    Click image to enlarge

The WFBS-SVC server will then send the command to the Security Agent. This may take a few minutes.

Perform manual uninstallation only if you encounter issues while uninstalling from the web console or Windows Control Panel. If so, do the following:

  1. Log on to the computer using an account with Administrator privileges.
  2. Unload/Exit the Security Agent. Refer to the KB article Unloading the Security Agent of Worry-Free Business Security Services (WFBS-SVC).

     

    You can disable the unload/exist password of the Security Agent by doing the followng:

    1. Log on to the WFBS-SVC web console.
    2. Go to Administration > Global Settings > Agent Control tab.
    3. Under Security Agent Exit/Unlock Password, select Does not require password then click Save.
    4. On the target Security Agent, right-click on the icon on the system tray then click Update Now.
  3. Open the Services console and stop the following services:

     
    Refer to Using the Microsoft Windows Services console for the steps to open the Services console.
    • Trend Micro Client/Server Security Agent
    • Trend Micro Common Client Solution Framework
    • Trend Micro Endpoint Application Control Agent Service (For WFBS-SVC 6.2 or newer)
    • Trend Micro Security Agent
    • Trend Micro Security Agent Listener
    • Trend Micro Security Agent Firewall
    • Trend Micro Security Agent NT Proxy Service (For Windows XP, Vista/2008 computers or older)
    • Trend Micro Security Agent RealTime Scan
    • Trend Micro Unauthorized Change Prevention Service
  4. Open the Task Manager and make sure the following processes are not running:

    • AcAgentService.exe (For WFBS-SVC 6.2 or newer)
    • AcAgentUI.exe (For WFBS-SVC 6.2 or newer)
    • HostedAgent.exe
    • Ntrtscan.exe
    • PccNtMon.exe
    • PccNTUpd.exe
    • TMBMSRV.exe
    • TMCPMAdapter.exe (For WFBS-SVC 6.1 or newer)
    • TmCCSF.exe
    • TmListen.exe
    • TmPfw.exe
    • TmProxy.exe (For Windows XP, Vista/2008 computers or older)
    • logWriter.exe
    • svcGenericHost.exe
    • XPUpg.exe
  5. Open the command prompt using administrator privileges and execute the following commands one by one:

    • For 32-bit:

      regsvr32 /u /s "C:\Program Files\Trend Micro\Client Server Security Agent\TmdShell.dll"
      taskkill /F /IM explorer.exe
      start explorer.exe

    • For 64-bit:

      regsvr32 /u /s "C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmdShell_64x.dll"
      taskkill /F /IM explorer.exe
      start explorer.exe

  6. Open the Registry Editor to delete registry keys that belong to WFBS-SVC.

     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  7. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete the following registry keys:

    • AcAgentService (For WFBS-SVC 6.2 or newer)
    • AcDriver (For WFBS-SVC 6.2 or newer)
    • AcDriverHelper (For WFBS-SVC 6.2 or newer)
    • ntrtscan
    • SvcGenericHost
    • tmactmon
    • TMBMServer
    • TmCCSF
    • tmcfw (For Windows XP or older)
    • tmcomm
    • tmebc
    • tmeevw (For Windows 7/2008 R2 computers or newer)
    • tmeext (For Windows XP or older)
    • tmel (For Windows 8, Windows Server 2012, or newer)
    • tmevtmgr
    • TmFilter
    • tmlisten
    • tmlwf (For Windows Vista/2008 computers or newer)
    • TmPfw
    • TmPreFilter
    • TmProxy (For Windows XP, Vista/2008 computers or older)
    • tmtdi (For Windows XP, Vista/2008 computers or older)
    • tmumh (For WFBS-SVC 6.1 or newer)
    • Tmusa (For Windows 7/2008 R2 computers or newer)
    • Tmwfp (For Windows Vista/2008 computers or later versions)
    • VSApiNt
  8. Locate and delete the following registry keys:

    • For 32-bit:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeScanNT Monitor

    • For 64-bit:

      HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OfficeScanNT Monitor

  9. Locate HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and delete the following registry keys:

    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wofie
    • For 32-bit:

      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1F6E833-B25E-4C39-A026-D3253958B0D0}
      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BED0B8A2-2986-49F8-90D6-FA008D37A3D2}
      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HostedAgent
    • For 64-bit:

      • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{A38F51ED-D01A-4CE4-91EB-B824A00A8BDF}
      • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{BED0B8A2-2986-49F8-90D6-FA008D37A3D2}
      • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HostedAgent
  10. Locate and delete the following registry keys:

    • For both 32-bit and 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\

      • AEGIS
      • AMSP
      • Endpoint Application Control Agent (For WFBS-SVC 6.2 or newer)
      • NSC
      • Osprey (For Windows 7/2008 R2 computers or newer)
      • Wofie
    • For 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\

      • ClientStatus
      • CPM (For WFBS-SVC 6.1 or newer)
      • OEM
      • OfcWatchDog
      • Pc-cillinNTCorp
      • WFBSSUpdater
    • For 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\

      • AEGIS
      • ClientStatus
      • CPM (For WFBS-SVC 6.1 or newer)
      • NSC
      • OEM
      • OfcWatchDog
      • Osprey (For Windows 7/2008 R2 computers or newer)
      • Pc-cillinNTCorp
      • WFBSSUpdater
  11. Locate and delete the following keys from the HKEY_CLASSES_ROOT\Installer\ registry hive:

    • For 32-bit:

      • HKEY_CLASSES_ROOT\Installer\Features\338E6F1CE52B93C40A623D5293850B0D
      • HKEY_CLASSES_ROOT\Installer\Products\338E6F1CE52B93C40A623D5293850B0D
      • HKEY_CLASSES_ROOT\Installer\Upgradecodes\8A88AE84D667B304CB368C99791A74A6
      • HKEY_CLASSES_ROOT\Installer\Products\2A8B0DEB68928F94096DAF00D8733A2D
    • For 32-bit:For 64-bit:

      • HKEY_CLASSES_ROOT\Installer\Features\DE15F83AA10D4EC419BE8B420AA0B8FD
      • HKEY_CLASSES_ROOT\Installer\Products\DE15F83AA10D4EC419BE8B420AA0B8FD
      • HKEY_CLASSES_ROOT\Installer\Upgradecodes\8A88AE84D667B304CB368C99791A74A6
      • HKEY_CLASSES_ROOT\Installer\Products\2A8B0DEB68928F94096DAF00D8733A2D
  12. Reboot the Computer.

This tool was designed to forcibly uninstall a corrupted WFBS-SVC Security Agent. Due to security considerations, contact Trend Micro Technical Support directly to obtain it.

Premium
Internal
Rating:
Category:
Troubleshoot; Uninstall
Solution Id:
1117997
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.