Manually Uninstalling the OfficeScan Client Parent topic

Perform manual uninstallation only if you encounter problems uninstalling the OfficeScan client from the web console or after running the uninstallation program.


  1. Log on to the client computer using an account with Administrator privileges.
  2. Right-click the OfficeScan client icon on the system tray and select Unload OfficeScan. If prompted for a password, specify the unload password then click OK.
    Disable the password on computers where the OfficeScan client will be unloaded. For details, see Configuring Client Privileges and Other Settings.
  3. If the unload password was not specified, stop the following services from Microsoft Management Console:
    • OfficeScan NT Listener
    • OfficeScan NT Firewall
    • OfficeScan NT RealTime Scan
    • OfficeScan NT Proxy Service
    • Trend Micro Unauthorized Change Prevention Service
  4. Click StartPrograms, right-click Trend Micro OfficeScan Client, and click Delete.
  5. Open Registry Editor (regedit.exe).
    The next steps require you to delete registry keys. Making incorrect changes to the registry can cause serious system problems. Always make a backup copy before making any registry changes. For more information, refer to the Registry Editor Help.
  6. Delete the following registry keys:
    • If there are no other Trend Micro products installed on the computer:
        For 64-bit computers:
        HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro
    • If there are other Trend Micro products installed on the computer, delete the following keys only:
      • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog
        For 64-bit computers:
        HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro\OfcWatchDog
      • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp
        For 64-bit computers:
        HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\Trend Micro\PC-cillinNTCorp
  7. Delete the following registry keys/values:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT
    • OfficeScanNT Monitor (REG_SZ) under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  8. Delete all instances of the following registry keys in the following locations:
    • Locations:
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
    • Keys:
      • NTRtScan
      • tmcfw
      • tmcomm
      • TmFilter
      • TmListen
      • tmpfw
      • TmPreFilter
      • TmProxy
      • tmtdi
      • VSApiNt
      • tmlwf (For Windows Vista/Server 2008/7 computers)
      • tmwfp (For Windows Vista/Server 2008/7 computers)
      • tmactmon
      • TMBMServer
      • tmevtmgr
  9. Close Registry Editor.
  10. Click StartSettingsControl Panel and double-click System.
  11. Click the Hardware tab and then click Device Manager.
  12. Click ViewShow hidden devices.
  13. Expand Non-Plug and Play Drivers and then uninstall the following devices:
    • tmcomm
    • tmactmon
    • tmevtmgr
    • Trend Micro Filter
    • Trend Micro PreFilter
    • Trend Micro TDI Driver
    • Trend Micro VSAPI NT
    • Trend Micro Unauthorized Change Prevention Service
    • Trend Micro WFP Callout Driver (For Windows Vista/Server 2008/7 computers)
  14. Uninstall the Common Firewall Driver.
    1. Right-click My Network Places and click Properties.
    2. Right-click Local Area Connection and click Properties.
    3. On the General tab, select Trend Micro Common Firewall Driver and click Uninstall.
      The following steps only apply to Windows Vista/Server 2008/7 operating systems. Clients using all other operating systems skip to step 15.
    4. Right-click Network and click Properties.
    5. Click Manage network connections.
    6. Right-click Local Area Connection and click Properties.
    7. On the Networking tab, select Trend Micro NDIS 6.0 Filter Driver and click Uninstall.
  15. Restart the client computer.
  16. If there are no other Trend Micro products installed on the computer, delete the Trend Micro installation folder (typically, C:\Program Files\Trend Micro). For 64-bit computers, the installation folder can be found under C:\Program Files (x86)\Trend Micro.
  17. If there are other Trend Micro products installed, delete the following folders:
    • The BM folder under the Trend Micro installation folder (typically, C:\Program Files\Trend Micro\BM for 32-bit systems and C:\Program Files (x86)\Trend Micro\BM for 64-bit systems)