[UPDATE] If you need these instructions for OfficeScan 10.6, please reference the article uninstall OfficeScan 10.6 without a password.
Nothing is quite as frustrating in my line of work as trying to install new anti-virus only to find that the previous antivirus won’t allow you to uninstall it without a password. I recently had to uninstall Trend Micro OfficeScan 10.5 from a computer, but it was password protected. After asking almighty Google, the results I were turning up were all geared toward older versions of OfficeScan.
Finally I found the answer. Here are the steps:
1. In your favorite text editor, open the file Ofcscan.ini generally located at:
C:\Program Files\Trend Micro\OfficeScan Client\Ofcscan.ini
Note: Thanks to Lautaro’s comment below, please be aware that these files may also be in C:\Program Files(x86)\ directory.
2. Search for the line containing Uninstall_Pwd or Unload_Pwd, which should be under the section INI_CLIENT_SECTION. It will look like:
Uninstall_Pwd=!CRYPT!364EB27CAD126...
3. The password is encrypted, but you can simply remove the encrypted portion and replace it with your own MD5 hash. Generate your own password by visiting my MD5 hash generator. Simply enter the password you want and it will make the hash for you.
4. On the Uninstall_Pwd line, after the !CRYPT! section, enter 111 and then the hash you generated above. For example, you can change the password to “password” by changing the line to read:
Uninstall_Pwd=!CRYPT!1115f4dcc3b5aa765d61d8327deb882cf99
5. Save the Ofcscan.ini file and run the uninstaller again and use the new password you created.
This process worked like a champ for me and I was finally able to get Trend Micro OfficeScan 10.5 removed from the computer. Feel free to comment if you have any questions.
i have done the above but when i try save it it says access denied. please help!
Erick, You’re getting access denied when trying to save that file? If that’s the case, two things I’d try would be
a) Shutting down the OfficeScan services while you edit the file
and
b) Making sure you’re editing the file as an administrator. Depending on the OS, you may have to right click on Notepad while launching it and choose “Run as Administrator” and then from inside notepad, do File > Open and find the file to edit that way.
Give those a shot and let me know if you need more help from there.
u not need to save the file directly just create new same name file and copy the all text in a new file save that file to desktop then try to overwrite that file with ur file the done it will work
The second suggestion worked with me. Thank you so much.
I have done a terrible mistake, instead of changing the hash for UNINSTALL_PWD…. I changed it for the UNLOAD_PWD and saved as admin. I am afraid this is the reason why I still can’t uninstall this program. Is there anything you can tell me to help?
Abe, no need to worry about that. Change it in both locations and it should let you uninstall. The UNLOAD_PWD simply allows you to right click on the icon in the bottom right corner and unload it from running at the current time.
thank you so so much. what a bunch of nonsese that software is. holy moly.
Thank for the solution bro
It worked for me.
same problem is mine….
What is this? A solution that actually works? Unbelievable, man. Thanks a lot. Just to say that perhaps you can find the same file at “c:\Program files (x86)” sometimes…
Good point. I added a note to the post to reflect that. Thanks for the comment!
THANK YOU!!
This was great and it worked like a charm. It’s disgusting how the web is full of fake instructions about how to uninstall this program.
Thank you so much.
giulia tonelli
To say the web is polluted is VERY true. Hard to wade through the filth to get to the real answers. Glad I could help you out on this one!
You legend. Worked like a dream. Been trying to figure this out for so long
Happy to help!
It worked perfectly. Thank you very much!
this didn’t work for windows 8.. can u offer another solution pls.? i have a dell laptop.
Ankit, did you find the files in the paths shown above? Did you try using the MD5 Generator? If you did, try copying the line I have above with the generated hash in it already. If you made the changes in that file and just used the line in my post, the password should be password. Let me know how it goes.
Thanks a lot…
It worked without any trouble..
Hi, I was following your steps for removing trend micro client on windows 7, but did not find ofscan.ini in the directory suggested by you. Even searched the computer and it did not return any results.
Is it a hidden file? if so, how to unhide it and edit?
Thanks
asghar
Asghar, it shouldn’t be a hidden file and should just be in the main install path for Trend Micro. Do you see the rest of the files under the path listed in the article? If it isn’t there, it’s possible that it may be a different version. Can you confirm the product name and version as well?
Thanks for your prompt response.
Scrolling on the icon, it says: OfficeScan(online) Ptn:9.700.1001/10.571.00
I assume it is version 10.571.
All other files seem to be in the path: program Files(x86)\…
My computer search did return ofcscan.ini in users\bokhari\application data\temp\…
I modified as suggested but the password was not accepted.
asghar
Asghar, those are actually the virus pattern file versions unfortunately. Can you check under Programs and Features and on the line that shows Trend Micro, see what version number is listed.
got your post after lot searches and it worked nicely. Thanks for your help.
Cheers
Thanks. You are right. Under programs and features it shows version 10.6.1062.
Also I think I did not find the ini file because it is not a stand alone installation. I work for a university and we download and install software from a central location. The client normally updates itself automatically but for a few days now it did not do so and shows an outdated version. I talked to technical services and they asked me to reinstall the software which I tried. During the installation it wanted to remove the existing version but wanted password to do so.
This is when I started looking for a solution.
I can go back to technical services but they take a long time so if I cannot do it myself I shall have to go through them.
A colleague says the only way to remove it is to follow the manual method given on trend micro web.
Thanks for your assistance.
asghar
Asghar, yea, 10.6 is a lot more devious and there is no known work around that I know of. Sorry I couldn’t be more help for you!
For 10.6 Version:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.]
“Allow Uninstall”=dword:00000001
Chokpig – Can you direct me where I find I can access [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.]? I don’t go behind the scenes very often…
Thanks,
B.G.
BG – I’m not sure if this is what you mean, but regedit.exe is the way to go in and find that value. I’m not sure if that will truly let you uninstall version 10.6 as I’ve seen those registry keys usually only work when there isn’t a password. Using regedit though is how you’d find out!
Thanks, this one worked for me!
Many thanks.
That worked a treat for 10.6! I only had to unload it to run a test (don’t want it gone, lest I get shat upon by the powers-that-be) and the Unload_Pwd value is right in that reg key. 🙂
*laugh* That’s exactly the kind of use cases I understand. Glad to have helped.
I cannot uninstall version 11 even if i try the above steps. What have i missed.
After shutting down the agent, I was able to edit the “Allow Unistall” registry setting mentioned here and it worked! Just glad I knew the password to shutdown the agent otherwise I did not have edit capability to this registry setting. Thanks!
i cant find the crypt file
When you go to the file path listed above, you don’t see the Ofcscan.ini file? Are there other files in that directory?
i can find the ofscan.ini file just cant find the Uninstall_Pwd=!CRYPT!364EB27CAD126
file its no there
Inside the ofcscan.ini file, you should search for a section that looks like this:
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=0
Client_Allow_Unload=0
Uninstall_Pwd=!CRYPT!5239776BC25D4BD924ABF9DFDDF6F511F637CCF2D80A08B2A74E16847A1813266B91D6F4B8CCDAC583B1D377C39
Unload_Pwd=!CRYPT!5239776BC25D4BD924ABF9DFDDF6F511F637CCF2D80A08B2A74E16847A1813266B91D6F4B8CCDAC583B1D377C39
UnloadProtect=1
Client_LocalServer_Port=45767
If you find the [INI_CLIENT_SECTION] section, do you not see those entries?
Just a note, after the 111 in the MD5 hash just enter 900150983cd24fb0d6963f7d28e17f72
This is just abc I use this for a default on tests 😉 saves having to keep remembering where to generate MD5’s 🙂
That works as well! 🙂
Hi,
I follow the step you give, but on the uninstall there, they keep asking me to enter the installment password. Would you help me out on this?
YX, Just to make sure we’re on the same page, if you follow the above process, you should still get it asking you for a password, but the password should be password. Have you entered that? If you go to Add/Remove programs or Programs and Features, what version of Trend Micro Officescan do you have?
same case with me
in hash generator, i change into “atna” and i copy-paste the code to Uninstall_Pwd=!CRYPT!111…..
so the password that i should type in dialog box is “atna”right?
but the dialog box keep saying “please enter the uninstallation pasword again”
please helpp
This is super helpful! Works like a charm.
One thing i found out that i can not use my own password that generated with MD5. It failed. Then i tried to use ‘password’ like you did, it works! Any idea why?
Plus, i hope everyone here not forget about to put 111 in the beginning of the hash (Step no.4)
Many thanks Joseph
Oh btw Maybe you guys can save the original OFCSCAN.INI in other location first before making any changes in case the IT guy checking out and you can immediately restore their password 🙂
Glad to have helped! I’m actually not quite sure why it didn’t work with anything other than ‘password’. I tried various combinations and they worked well. You bring up a VERY good point though. Good to take a backup of ofcscan.ini before messing around with it. 🙂 Especially if you AREN’T the IT guy!
Thank you very much for this easy guide. I’ve been in contact with several computer gurus that could not help me, but you saved my day, hell you might have saved our company 🙂 I just inserted your hash for “password” and hey presto. Thanks again.
That’s great to hear! Your computer is free again and now you can get back to business. Thanks!
10.6.5162 dont work any more…
Yea, unfortunately with each major release, they tend to obscure how this can be done. 10.6 is just the latest iteration of that kind of change.
You should post chokpigs comment for 10.6!
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.]
“Allow Uninstall”=dword:00000001
Is where to enable uninstall for 10.6!
Damian, I’d definitely post that in the main article if someone can confirm that it works. I don’t have 10.6, and haven’t tested it and would want to confirm before posting.
chokpigs method works like a charm. 10.6 is being uninstalled right now, and it’s gone!
I just realized that this thread is actually new, my first real-time contribution to the software world! Thanks for your help guys.
Yes, the registry key uninstall hack below works for 10.6. Thanks for the help on this.
via chokpigs comment
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.]
“Allow Uninstall”=dword:00000001
Hey Joseph
Nice work man, helping us out here.
What I wanna know is, would the following thing give me the same result,i.e. disabling the officescan, or not?
taskkill /F /IM TmListen.exe
taskkill /F /IM PccNTMon.exe
taskkill /F /IM OfcPfwSvc.exe
taskkill /F /IM NTRtScan.exe
I believe you could run all of those, to disable the services in a more harsh way, yes, but ultimately you’d still have to edit the ofcscan.ini file to remove it.
Thanks to chokpig and others who validated the solution for 10.6, I setup a test lab, tested various parts of the solution, and posted an article for how to Uninstall OfficeScan 10.6 without a password. I’d love it if someone could read it and re-validate it for me. Thanks!
I had to set the unload password to the same as the uninstall pwd. Unloadprotect was set =1 i changed this to 0 and this solution worked for me as well. Thank you.
Awesome. I love hearing the variations people have to try to get it to work. It helps everyone. Thanks for the contribution!
Hi.. just for your information, i’ve been using this method for a few weeks. It works.
One thing i found out that the OFCSCAN.INI was back to default everytime i connected to my office domain network. Since this OfficeScan was installed automatically to any client computers that connected to our domain network by our IT department 🙂
Anyone having the same issue?
Samydla, That is definitely an intended behavior of the product when deployed properly through the IT department. Since I happen to be in this line of business, I don’t advocate these instructions as a way to uninstall what is intended by the corporation to be on the computers. 🙂
THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU , God bless you, i bought this computer ages ago and had never had the password. it freed so much unused space on my computer!
THANK YOU !
You’re VERY welcome! These are the kinds of comments guys like me live for; the ones where the hours we spend researching and writing the article mean someone got saved a massive long-term headache and commented to let us know. Thank YOU!
Thanks for your share. But I have problem when do it.
My version of OfficeScan that I installed is 10.93. And when I open file OFCSCAN.INI, the field Uninstall_Pwd is blank (only Uninstall_Pwd=), after I do as you guided, but when fill password at uninstall, it message invalid, please try again. I am sure password is true (as same as when generate MD5 code).
Hope you will help me, thanks!
Khoa, it sounds like you may have OfficeScan 10.0 installed, and I can’t remember exactly how it differs from 10.5 and 10.6. You may try entering the number 70 after Uninstall_Pwd= and then when you try to uninstall and it prompts for a password, enter the number 1. Give that a shot. If that doesn’t work, let me know. I can try working with it in my lab environment.
3 years ive been trying to do this, and you cracked it. Thank you so much!
Glad to have been of service. Thanks for sharing!
I can add another 3 to BEN38897’s 3.
Having developed a much more intricate set of batch commands that killed processes and deleted files, I’d lost all my notes from that effort, so I Googled to see if anyone else had found a fix.
You did it! You saved me countless hours of angst!
Thanks, Joseph!
Just wanted to let you know that this worked great. Thank you so much!
Thanks guys, I really appreciate the gratitude!
The .ini file consists of both unload_pwp and uninstall_pwp should I change both?
You only need to do it in the uninstall_pwp if you plan to uninstall it. The unload_pwp section allows you to remove the program from memory (stop it from running) but won’t allow you to uninstall.
Perfect – thanks!
I need some help. I keep trying, but I think I may have messed something up. Should I change both the Uninstall_Pwd and Unload_Pwd or just the first one?
You only need to do the Uninstall_Pwd one, though doing the other shouldn’t hurt anything. What version of Trend Micro OfficeScan is it?
Not completely sure which version. It says it was installed August 2013
It says it was installed august 2013
If you go to Programs and Features (or Add/Remove Programs in older versions of windows), and find Trend Micro Office Scan, it should have a version number listed somewhere on that line. Can you find that and let me know?
It is version 10.6.3205 service pack 2
Sorry Ty, the website has been having problems and is now back up again. For 10.6, follow the instructions here:
Uninstall OfficeScan 10.6 without a password
Hi JOSEPH,
I opened “ofcscan.ini” file from location “C:\Program Files (x86)\Trend Micro\OfficeScan Client”
I tried changing 2-3 new MD5 generated password, but its still saying “Incorrect password”
for amit MD5 is 0cb1eb413b8f7cee17701a37a1d74dc3
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=0
Client_Allow_Unload=0
Uninstall_Pwd=!CRYPT!1110cb1eb413b8f7cee17701a37a1d74dc3
Unload_Pwd=!CRYPT!1110cb1eb413b8f7cee17701a37a1d74dc3
UnloadProtect=1
Amit, can you confirm what version of OfficeScan you are using? I’m curious if it got upgraded to a newer version, so these settings aren’t working for you. Unload behavior is the same? Also, try setting Client_Allow_Uninstall and Client_Allow_Unload to =1. Let me know how it goes.
Dear Joseph,
I already try as per instruction, however, when i try to unload the apps, it mention, “unable to verify officescan password. Please reinstall officescan”
even tho the above massage come out, the apps still working. I only want to unload for a while. my version is 10.0 service pack 1.
Very good! It worked perfectly. Thanks mate! I’ve been waiting for this solution for many time!! Best regards!
Thank you Sir you are absolute genius
Thanks so much for this, save me endless time with Trend.
worked great on Officescan 11.0
thanks again!!!
Sweet! Good to know that as well. Happy to have helped.
Amazing! work great.
Thanks a lot!
Thank you so much, Joseph! Very helpful!
This worked perfectly for me. Thank you very much!
Hello M.Turley, I tryed all you explain and I don’t see the uninstall line and I don’t understand how to process to remove this ?%%$ of program …
Can you help me by teamviewer ?
Sincerly,
Mario
Mario, normally I’d do my best to jump on and do that, but right now I’m too slammed with work things to help. Sorry man.
Well maybe another time..
Mario, if you still need help let me know.
please Mr Joseph Turley i can’t uninstall trend micro office scan client without password in my windows 7-32 bits and my server 2008!! help me please
Nina, the first thing to note is what version of Trend Micro you have installed. Can you verify?
Solution:
Run this in a MACHINE policy on the client
“StartUpScriptMach.cmd”
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc. /v “Allow Uninstall” /t REG_DWORD /d 0x1 /f
Run this as administrator after a reboot.
“_uninstall.cmd”
@echo off
reg query HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc. /v “Allow Uninstall” | findstr “0x1”
if %errorlevel% EQU 0 (
echo * Good to go! Trendmicro is ready to be uninstalled.
) else (
echo * No go. Not able to uninstall Trendmicro … Try a reboot!
ping 127.0.0.1>nul
)
Excellent my friend…thank you so much you are my idol….greetings
Thank you very much. It works fantastic on Windows 7 64bit TM Clients. Really helpfull.
God bless you 😉
Hai, Joseph. I’m having a little bit trouble abit unload trend micro officescan ver 11.0.1454 if I’m not mistaken. I had tried all your trick in the past with older version. But now, the program is updated to the version that I’ve mentioned before. And when I see the ofscan.ini the part where there are uninstall_pwd and unload_pwd are blank. So what’s wrong with it? But still I can’t unload officescan and it keeps saying that an administrator password is required. Can you help me with this problem? Thnx a lot.
Chris, unfortunately I don’t yet have an answer for OfficeScan 11. Sorry!
I suggest using ‘password’ as your password. I tried a couple times using another password using the MD5 hash generator provided and it did not work. So you can just simply copy and paste the ‘password’ encryption equivalent provided over the digits in my OFCSCAN file and it worked.
Nice! Glad you got it working. It’s odd, but different people have reported various methods of getting it to work in their environments. I’m not sure what the variable is, but it may have to do with certain patch levels of the product. Thanks for sharing with everyone. No doubt it will help another internet traveler.
For OfficeScan 10.0 SP1 on Win 7 64-bit, changing ofcscan.ini didn’t work for me. I eventually was able to remove it following the instructions at http://esupport.trendmicro.com/Pages/Uninstalling-the-OfficeScan-10-client, BUT these two steps at least worked only in safe mode:
> If the unload password was not specified, stop the following services from the Microsoft Management Console:…
> Go to Start > Programs, right-click on Trend Micro OfficeScan Client (v10.x) or Agent (v11), and then click Delete…
Thank you sooo much for helping me uninstall that malware. You directions worked perfectly the first time!!!!
Excellent! Now you can enjoy your weekend.
Thank you so much…………..I was having trouble until I read about opening notepad as administrator
I have followed these steps exactly as pointed out. I have tried creating my own hash, I’ve tried using the one you past here.
I’ve even read through the comments and tried changing some of the other values and as well as the unload password hash. But no matter what I do, it keeps giving me the same message over and over again, “Please Enter the Unistallation Password Again”
I’m at a loss as to what to do next. I’m running Version 10.5.2 on a Windows 7 machine. I’m using the hidden administrator account.
Got it! After searching around a bit, I found the following solution.
In the registry, I adjusted HKEY_Local_machine\software\wow6432node\trendmicro\PC-cillinNTCorp\currentversion\misc\allow uninstall from “0” to “1”
The result is that TrendMicro skips the password check all together. I then ran the uninstall exe file directly from the TrendMicro folder (the same that you would find the .ini file mentioned in this guide) and 5 min later I was all good to go.
Thanks for sharing your working combination!
Perfect, thanks – Gotham needed you!
Worked like a charm! Tanks a lot!!!
Hi,
thank you so much for sharing this method but I have one slight problem,
I am a complete noob at computers, especially at text editors. Is there anywhere or anyhow you could explain how to use a text editor, or what editor I should use?
thank you , sorry for being of such trouble
No problem. I’d recommend using Notepad, which is included with Windows, or downloading Notepad++ (a way better text editor). Either of those should work. You can then use the Open… dialog in each program to find and open the file you need. Hope that helps!
For documentation sake, also works on Version 9.25.xxx
Thanks!
Mr. Turley,
I have followed your steps precisely, entered the new password and a warning box pops up prompting me to re enter the password. I then changed my MD5 code to what you had originally changed your to ‘password’ and copied the new hash and it still gives me the same pop up box prompting me to re enter the password. Any new advice would be greatly appreciated!
Best Regards,
T-
Tristram,
The first thing that comes to mind is making sure you definitely have OfficeScan 10.5. If you have 10.6, 11, etc. these instructions may not be what you’re looking for. Can you look at the About link somewhere in the product and confirm which version you have?
Really a fantastic procedure to uninstall a Trend micro scan 10.5 if u forget a password while uninstalling which was entered during root installation Thank you very much Mr.Joshep Turley
Really A fantastic help &procedure to uninstall a Trend micro scan without a password or forget the password while installed @root section initially.Thankyou
Thank you, It worked great
Hey Joseph. Before I uninstall, is it possible to backup the setup file and the license key or dat file? Thanks for the help.
That’s a good question. To be honest, I have no idea. I’m sure you can back up certain files or registry keys, but I’m unclear as to which ones they would be. Sorry.
outstanding ! Thanks for the tip, worked great
thank you, Thank You, THANK YOU!! I don’t even know when this got installed.
I have done exactly to do in three steps but it saying pl enter the unstalling password again.
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=0
Client_Allow_Unload=0
Uninstall_Pwd=!CRYPT!1115f4dcc3b5aa765d61d8327deb882cf99
Unload_Pwd=
UnloadProtect=1
Client_LocalServer_Port=59520
Filebase_Polling_Range=360
Show_Window_On_Multiple_Instances=1
ScanNetwork=0
ShellExtension=0
Client_Allow_Mobile=1
ForceUpdate=0
Interval=0
Client_Allow_Schedule_Update=0
Client_Allow_Update_Now=1
Client_Allow_Update_From_TMAU=1
Client_Allow_Update_From_OtherAU=0
Check_IP_Change_Interval=180
Client_Allow_Stop_Schedule_Scan=0
InstallCTA=0
RemoveCTA=0
Client_Security=0
ScheduleUpdateEnableDisable=0
NoProgramUpgrade=0
Enable_HIPS=1
Enable_HIPS_Popup_alert=1
RCS=0
EnableVirEmailWarning=1
AllowCfgNotification=0
EnableScheduleScanWarning=0
Client_Allow_Delay_Schedule_Scan=0
AllowPromptRebootForCleanup=1
Everything there looks ok to me. Can you confirm what version of OfficeScan you’re running? Also, try using my MD5 Hash Generator and using your own password. You may want to scan throught he comments below to see if anyone else had other suggestions on what worked for them.
Hey Joseph,
Thanks a lot.. its worked well for me
Looks like the registry change works for OfficeScan 11 too.
I needed to make the edit in Safe Mode, but it looks like it’s out.
Thankyou!
Hey Joseph,
Thank you for your article. I did as that but when I tried to uninstall it and type in “password” that I generated with MD5, the installation wizard said that “please enter a valid password”. Also, I cannot find Trend Micro OfficeScan from my start menu, but it is shown in the list of programmes where I want to uninstall a program. I am running windows 7, please help. Thank you!
To remove / reset the uninstall password for Trend Micro OfficeScan
Edit Ofcscan.ini file.
On Windows.95/98 machines it is usually in C:\Windows\Ofcscan.ini
On Windows.NT/2K machines it is usually in C:\WINNT\Ofcscan.ini
May also be in C:\Program Files\…
Open the Ofcscan.ini file using notepad search for the [INI_CLIENT_SECTION]
Find the line reading Uninstall_Pwd= and type a # at the beginning of the line to comment it out.
Insert a new line saying Uninstall_Pwd=70
Save the Ofcscan.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’.
Hey, thank you for your reply! That’s what I did but I still couldn’t uninstall it
Any solution for Officescan 11 11.0.1454 ?
Please help me…
Many thanks
You ROCK! Worked beautifully. Much appreciated.
Thanks man. Glad to be of service. 🙂
Worked liked a charm.
First try, 100% success!
Nice tutorial man! Now i’m gonna be able to fix some issues around here!
Thanks!
Thanks dude! your the man!
Worked like a champ. Thank you for the post.
Wow! That worked wonderfully well!
hey, Joseph i am using Windows 8 and OfficeScan version 11.0 1028. earlier i used your trick but it doesnot work. in this part “Unload_Pwd =” showing Blank part. please help me out. WAITING
<3 you!
My company's antivirus configuration is way too intrusive, and I suspect it interferes with my Windows 10 upgrade.
But now it's gone :-). Back to, I hope, a successful upgrade…
Joe,
Much obliged, I appreciate the tip!
Colin
Lovely, worked like a charm!!!
Awesome. Glad it worked for you.
thanks dude your a life saver
Nice trick…Thanks for the help 🙂
Thanks for saving me hours of digging. This post is still helping people banish unwanted TrendMicro software. Just ran factory restore on a pc and wanted to remove the TM security that came with and install security of my own choosing.
Thank you for these instructions !
They are straight to the point and they work ! 😀
Worked like a charm on an old computer with XP!
Thanks a lot and greetings from France.
You are my hero! thank you for sharing =)
This is how I got version 10.6 uninstalled on Win 7 64-bit OS, without knowing the unload and uninstall passwords:
– Rename OFCSCAN.INI found in the Trend program folder, and reboot PC
– After reboot, Trend automatically re-creates the ofcscan.ini file as it cannot find the original, new file contains some minimal default settings and nothing regarding unload or uninstall
– Uninstall Trend normally via Control panel, it doesn’t ask for password anymore.
I know this sounds ridiculously easy, but I noticed that nobody has tried this before in this chain, and it worked for me on 2 computers that I tried it on.
Wow, that’s a great find. Thanks for sharing!
You glorious bastard! I didn’t have to go through the trouble some in these comments did because I found this website right away.
Thanks so much!
*laugh* Loved the message. Happy to help.
Can you please help me uninstalling office scan v11 without password,i have tried the above method which did not work.Appreciate your quick reaponse.
I don’t really know how it works with version 11. Search the comments below as I believe someone mentioned how they did it.
How can I find my lost password ?
You can’t that I know of… You have to follow the steps in this article to make that password inconsequential.
Thank you so much…I had it for old version 8.9 and functioned just like you said.
Clever. I shut the Trend Micro start up line off, restarted and used REVO uninstaller, restarted and away I went with AVG. Thanks for the article
i had a situation where someone before be managed to have a version 11 client installed along with what appeared to be a version 10.5 client. to make matters worse there was an uninstall password which was unknown. long story short , i too a snapshot of server, searched registry for Trend and removed every entry. there as also a reg entry to device manager and there was a hidden device under non-plug and play devices for trend also, once i removed this a reboot was needed but when it rebooted i was able to install new client (without it asking for a password)
device driver was called TrendMico TDI Driver, there are also 3 other on my laptop now that im checking.
I cannot find the [INI_CLIENT_SECTION] in my ofcscan.ini file
All it says in that file is:
[INI_PROGRAM_VERSION_SECTION]
PccX64_BuildNum=1028
[INI_UNREACHABLE_NETWORK_SETTING_SECTION]
HeartbeatFrequency=10
PollingFrequency=60
UnreachableNetworkScopeCount=0
Oh my… Thank you so much! It worked perfectly fine for me.
Thanks this helped out a lot!!! finnaly got rid of this software!!
I had a similar issue trying to uninstall Office Scan Client 10 from about 100 PC’s after the Management Server had been removed. I knew the password to uninstall the client manually but wanted to create a logon script to automate the process.
I didn’t know of a way to insert the password in to the uninstall command and after lots of searching online and failed scripts I ended up here. I followed the advise above to change the password and it worked like a charm but still didn’t really solve my issue.
What I really wanted was a “blank” password but didn’t seem possible using http://www.josephturley.com/md5-hash-generator/ but just for the hell of it I thought i’d try clicking “calculate” with nothing entered.
To my surprise it returned the following d41d8cd98f00b204e9800998ecf8427e and again doubting anything would come of using it I figured I’d tried everything else.
To test it I opened Ofcscan.ini from “C:\Program Files\Trend Micro\OfficeScan Client\” and changed the “Client_Allow_Uninstall” from 0 to 1 and changed the MD5 Hash with the one I’d generated along with 111 and left everything else default.
Client_Allow_Uninstall=1
Uninstall_Pwd=!CRYPT!111d41d8cd98f00b204e9800998ecf8427e
I saved the file and tried to uninstall the client again from “Add Remove Programs” and when it prompted me for a password i just clicked on next and it worked !!! This gave me hope so I created a folder on a network share and placed a modified copy of Ofcscan.ini there and added a batch file with the following in Group Policy > Logon
@Echo Off
IF EXIST “C:\Program Files\Microsoft Security Client” EXIT
copy \\MyShare\ofcscan.ini “C:\Program Files\Trend Micro\OfficeScan Client\”
msiexec /x {ECEA7878-2100-4525-915D-B09174E36971} /quiet /norestart
EXIT
I had to use the “ProductCode” rather than “Product.msi” as it seems to generate a random file name for the .msi on each install. Thanks so much for posting the password solution I can only imagine how many hours it’s saved me 🙂 Hopefully this might be helpful to anyone else that ends up with a similar situation.
Fantastic! And thanks for sharing that new information with the group. Nice job with the group policy to help move things along. I’ve never toyed with doing this en mass, but that seems like an awesome way to do it. Congrats and well done.
hi Joseph,
I am not able to find crypt version of password in ofcscan.ini
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=0
Client_Allow_Unload=0
Uninstall_Pwd=70
Unload_Pwd=
UnloadProtect=1
Client_LocalServer_Port=47185
Filebase_Polling_Range=360
Show_Window_On_Multiple_Instances=1
ScanNetwork=0
ShellExtension=0
Client_Allow_Mobile=1
ForceUpdate=0
Interval=0
Client_Allow_Schedule_Update=1
Client_Allow_Update_Now=1
Client_Allow_Update_From_TMAU=1
Client_Allow_Update_From_OtherAU=0
Check_IP_Change_Interval=180
Client_Allow_Stop_Schedule_Scan=1
InstallCTA=0
RemoveCTA=0
Client_Security=1
ScheduleUpdateEnableDisable=1
NoProgramUpgrade=0
Enable_HIPS=1
Enable_HIPS_Popup_alert=1
RCS=0
EnableVirEmailWarning=1
AllowCfgNotification=0
EnableScheduleScanWarning=1
GCLCacheEnable=1
GCLCacheRebuildDays=28
OdscEnable=1
OdscCriteriaDays=60
OdscMaxExpiredDays=30
SP_EnableFileProtection=1
SP_EnableRegistryKeyProtection=1
SP_EnableProcessProtection=1
Please suggest any solution for this.
Your Uninstall_Pwd section says Uninstall_Pwd=70. That’s where you would set the hash that the article references.
Hi Jospeh,
I tried your steps, but I keep getting this popup
Please enter the uninstal password again.
Can you please help.
What version are you running and what is the Uninstall_Pwd section of your ini file looking like?
first method worked for me, no problems at all.
Many thanks
Happy to help Henry.
Worked. Thanks! That software conflicts with some other things we have installed here at work, and always causes me problems. Glad to have it gone. I have antivirus installed, but Trend Micro is just over the top.
Thanks a lot Joseph. Your advise saved me a lot of time and frustration.
after following every steps in registry editor it shows” can not edit Allow uninstall that error writing the value’s new contents”
If you can’t edit the registry, you’re still stuck on disabling the service that causes that locking. Check the instructions for that step and look at other comments here on it as well.
i did the same but it still showing that uninstallation password is not valid
Reboot and check and see if the text you replaced actually saved?
THANK YOU VEEERYYYY MUCHCHCHCHCHCHCH. it works on first time for me.
Good job!! Thank you Sir.
owwww thanks god , i had the version 11.0.4268 and this method worked for me :
open win +R ,and then : regedit
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.]
“Allow Uninstall”=dword:00000001
Thanks , works perfect Fajoui
Worked perfect able to remove a real old ver 9 that the computer vendor A(er had put on at the factory with some unknown pwd. It was either this fix or buy a newer version and hope it could overwrite the old.
Works for me!
Tnks!
Thank you so much!
It worked fine for me .-)
any of the method is not wrking for me.
Ive tried notepad edit as admin
I’ve tried registry edit.
But the main problem is the system is not allowing me to make changes.
It is asking to get the permission from the file owner.!!!!
..There is no option for sending you the picture. or else kindly reply me in email
Please help
Hi, I used the registry change with version 12.0.1340 and the method worked for me too.
Under Windows 10 had to reboot to command prompt mode and then use regedit there.
By default is loads an empty registry, so you need to load the local software hive from C:\Windows\System32\config\SOFTWARE, to a new key, I used *
then modified the following key.
[HKEY_LOCAL_MACHINE\*\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.]
“Allow Uninstall”=dword:00000001
Unload the hive, reboot and finally uninstall.