Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

How to manually uninstall iServices of Apex One

    • Updated:
    • 12 Jul 2020
    • Product/Version:
    • Apex One All.All
    • Platform:
    • N/A N/A
Summary

This article provides a step-by-step uninstallation guide for different iServices of Apex One.

Details
Public
  1. Stop the Trend Micro Advanced Threat Assessment Service (or just simply run sc stop AtasService command).
  2. Launch the Command Prompt as administrator and execute the following command to delete iATAS service:

    sc delete AtasService

  3. Open the Registry Editor and delete the following hive:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\iATAS

  4. Open IIS Manager and delete the iATAS server instance (in the following order):

    officescan_iatas virtual directory
    OfficeScan_iATAS_AppPool

  5. Navigate to the Apex One directory and delete the iATAS program installation folder ...\Trend Micro\Apex One\iServiceSrv\iATAS\.
  1. Log on to the endpoint with administrator privileges.
  2. Unload the Apex One Security Agent.
  3. Terminate the AtasAgent.exe process using Task Manager or Process Explorer if it exists.
  4. Delete the iATAS service instance via the Command Prompt:

    sc delete atasagent

  5. Open the Registry Editor and delete the following hive:

    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\iATASAgent

  6. Navigate to Trend Micro directory and delete the iATAS Agent program installation folder ...\Trend Micro\iService\iATAS\.
  1. Stop Trend Micro Endpoint Sensor Service.
  2. Launch the Command Prompt as administrator and execute the following command to uninstall iES service:

    "...\Trend Micro\Apex One\PCCSRV\Admin\Utility\iServicePackage\iES\Setup\Setup.exe" -uninstallation -uninstall IsKeepDatabase

    IsKeepDatabase indicates whether the user wants to drop the database or keep it. (0: drop database/1: keep database).

  1. Log on to the endpoint with administrator privileges.
  2. Unload the Apex One Security Agent.
  3. Terminate the ESClient.exe, ESEServiceShell.exe, and ESEFrameworkHost.exe processes using Task Manager or Process Explorer if they exist.
  4. Delete the iES service instances via the Command Prompt:

    sc delete TMESC
    sc delete TMESE
    sc delete TMESCORE
    sc delete TMESFLT
    sc delete TMESUTIL

  5. Delete the iES drivers under "%windir%\System32\drivers\":

    tmescore.sys
    tmesflt.sys
    tmesutil.sys

  6. Open the Registry Editor and delete the following hives:

    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ESC
    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ESE
    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ESEStatus
    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\TMESD
    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\WL
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TMESC
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TMESE
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TMESCORE
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TMESFLT
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TMESUTIL

  7. Navigate to the Trend Micro directory and delete the iES Agent program installation folder ...\Trend Micro\iService\iES\.
  8. Delete the "%windir%\System32\config\systemprofile\AppData\Roaming\Trend Micro\ESE" folder.
  1. Stop the Trend Micro Application Control Service (or just simply run sc stop TMiACSvc command).
  2. Launch the Command Prompt as administrator and execute the following command to delete iAC service:

    sc delete TMiACSvc

  3. Open the Registry Editor and delete the following hive:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\iAC

  4. Open IIS Manager and delete the iAC server instance (in the following order):

    officescan_iac\osf (virtual directory)
    officescan_iac (virtual directory)
    OfficeScan_iAC_AppPool

  5. Navigate to the Apex One directory and delete the iAC program installation folder ...\Trend Micro\Apex One\iServiceSrv\iAC\.
  6. Reboot the Apex One server.
  1. Log on to the endpoint with administrator privileges.
  2. Unload the Apex One Security Agent.
  3. Terminate the TMiACAgentSvc.exe process using Task Manager or Process Explorer if it exists.
  4. Delete the iAC service instances via the Command Prompt:

    sc delete tmiacagentsvc
    sc delete acdriver
    sc delete acdriverhelper

  5. Open the Registry Editor and delete the following hive:

    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\iACAgent

  6. Navigate to the Trend Micro directory and delete the iAC Agent program installation folder ...\Trend Micro\iService\iAC\.
  1. Stop the Trend Micro Vulnerability Protection Service.
  2. Launch the command prompt as administrator and execute the following command:

    "...\Trend Micro\Apex One\iServiceSrv\iVP\uninstall.exe" –q -VisIISDefaultSite=false -VdeleteDatabase=true -Dinstall4j.alternativeLogfile="C:\iVP_uninstall.log"
    -q (Silent mode)
    -VisIISDefaultSite=false (true for installing IIS on Default Web Site)
    -VdeleteDatabase=true
    -Dinstall4j.alternativeLogfile="<The uninstall log saved path>"

  1. Log on to the endpoint with administrator privileges.
  2. Unload the Apex One Security Agent.
  3. Terminate the iVPAgent.exe process using Task Manager or Process Explorer if it exists.
  4. Delete the iVP service instance via the Command Prompt:

    sc delete iVPAgent

  5. Delete the iVP driver under "%windir%\System32\drivers\":

    tbimdsa.sys

  6. Navigate to "%windir%/inf" directory and check all oem#.inf files.

    There should be “tbimdsa” information in one of the oem#.inf files.

  7. Launch the Command Prompt and execute the following command to delete it:

    "pnputil -f -d oem#.inf"

    e.g.: If you find “tbimdsa” information under oem100.inf, then run the command as “pnputil -f -d oem100.inf”.

  8. Navigate to the Trend Micro directory and delete the iVP Agent program installation folder ...\Trend Micro\iService\iVP\.
Premium
Internal
Partner
Rating:
Category:
Uninstall
Solution Id:
1122946
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.