I’ve been a long time fan of Trend Micro, but when it comes down to it, you may need to uninstall it for several very legitimate reasons, such as purchasing an old laptop with it installed, taking over a client whose previous IT people used Trend Micro and didn’t hand over the passwords, etc. Back in August, I published a post called Uninstall OfficeScan 10.5 without a password. As it turns out, this has been one of the most popular posts on my entire site. In that post I’ve had several questions on how to uninstall OfficeScan 10.6 without a password. Thanks to a user named chokpig who helped us find the answer, and Damian and Wade who tested it, I’m happy to post it here for others to find.
NOTE: If you need to keep your antivirus installed, but want the ability to deactivate it when needed without a password, please instead check out my Unload OfficeScan 10.6 without a password article with steps provided by a commenter of this post.
After spending several hours today creating a Trend Micro OfficeScan 10.6 lab, I finally got it installed so I could vet out this solution and get the screen shots I needed as well as the exact steps, and hangups. Here goes.
- Because Trend Micro’s 10.6 product includes a service that helps protect the registry from being edited by malicious programs (or users), you can’t actually begin editing the registry until you disable the services that protect it. I tried several methods, including trying to stop the services (which won’t work because they are protected), killing the active processes (which won’t work because they too are protected) and deactivating the OfficeScan client using the icon in the bottom right corner of the screen. None of these methods worked for me.What did work however was disabling a key service, the Trend Micro Unauthorized Change Prevention Service. It took a bit of research before I figured out the trick to this, but the key is to stop the service before it has a chance to launch by disabling it and then quickly moving on to step two to edit the registry. To do this, open a command prompt and type in services.msc. In this window, find the Trend Micro Unauthorized Change Prevention Service.
The service should not be running if you’re doing this right after a reboot. Quickly double click on it and change it to disabled and click Apply.
This disabled the protection of the registry and allowed me to make the change in the next step. If this service is allowed to start, you will have a bit of a time getting it to let you edit the registry. - Edit the registry key to allow uninstall by running the registry editor (regedit.exe) and browsing to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
Set the value to of Allow Uninstall to 1.
- After the registry key is successfully edited, go to Programs and Features, or Add/Remove Programs, depending on your operating system, and uninstall Trend Micro OfficeScan 10.6 client as you would any other program. After a brief pause, you should start to see progress uninstalling.
With that, you should be on your way! If you have any questions or comments, feel free to leave a comment below. If nothing else, let me that it worked for you!
It worked for me… Thank you very much… I am stunned by your professionalism… Every step was correct…
It took me several hours of setting up a lab and playing with it, but I’m glad to hear that the steps were correct. Just what I needed, and happy to help!
hello sir
i’m going through the same problem
i’m not following your procedure
kindly help
thanks.
Awesome..!! thank you so much for taking the time to post this. You rock 🙂
thanks
I went into safe mode and did the registry edit. The uninstall worked perfect. Thanks for the info!!
Stunning success – brilliant – THANKS!
You’re very welcome. 🙂
Brilliant!
Thank you very much for making this great tutorial. I was searching high and low for a way to uninstall it and your tutorial was correct to the smallest detail! Thank you yet again as this has helped me in a major way.
Go safemode to disable the services –> change registry and uninstall. It will be very easy
Thanks Joseph, for putting this together. I was really starting to dislike Trend. I recently acquired several off lease PC’s that all use Trend but have no PW’s of any kind. The machine I am working on now is a Lenovo Thinkpad X130e and I wanted to pass on that the list of services did not pull up as described (services.msc) so I was unable to select Trend Micro Unauthorized Change Prevention Service. However, I was able to change the registry which allowed me to uninstall Trend. Thanks again, sir. I have searched high and low and found nothing that came close to working…until now. Cudos!
Awesome. Thanks for sharing your variation for others to benefit from. Trend really is a good product, and making it hard to remove is part of what they HAVE to do, but it’s good to know when you legitimately need to remove it that you can without too much fuss. Enjoy!
Got to say, I love this guide format, very easy to understand even for novices like myself. I was able to follow everything fairly easy, however I was unable to disable the change prevention service before it started running (i tried rebooting several times, every time it would start before i could get there in time.) – Is there something Im am missing here?
I dont believe i am competent enough to figure out how to edit the registry with that still active :P.
For me, trend has blocked several programs/sites that i know to be safe that i want to use. In particular, i just bought a game, Elder Scrolls Online – and it blocks the patcher, so i cant fully download it. So…i really want to get rid of it, otherwise a game Ive waited on for over a year will be unplayable :(. Ive tried to edit the allowed program list, however it still apparently is blocking the patch source or something.
I have it cause when i was in the dorm a couple years back when i first got this, it was required for dorm internet, however we were never given serial numbers or passwords for uninstalling it, so any help in that matter would be much appreciated.
its an hp pavilion dv6, windows 7 64 bit. Any other info that would be of use in figuring out what is wrong, let me know and i cant try to find it out.
Thanks!
If you can’t stop the service before it starts, I’d recommend one of two things.
1) Try setting all of the Trend Micro services to disabled and then reboot the computer and see if it stays.
2) Try booting into safe mode and disable the services and possibly even try the steps above from safe mode, or at least editing the registry from safe mode.
Let me know how you fare with either one of those options and we’ll go from there. We certainly can’t have you NOT playing ESO. 🙂
First method didnt work, was fairly sure it wouldnt since the one by itself had kept resetting back to manual from disable.
Second one, on the other hand…Im pretty sure that did the trick. It took me a bit to get to safe mode (i usually use a fingerswipe to log in on my computer, so actually forgot the password lol, thats why it took so long to try this method). Once i got on though, was able to do the regular steps easily. It still shows up on my programs list, but apparenlty not as an active, and its not on my toolbar icons anymore.
And right as i was typing this, i realized a better way to confirm then waiting for the ESO patcher, went to a formerly blocked (yet still confident its safe from other times on it) website, and its now availible, so it must have worked, thanks a lot! Specially for the super fast response, much better than what i got from trend (called them awhile back, first they sent me to an affiliate company, then that company told me theyd email me, which i never got…tried again today, but they arent open sunday, which is a little more excusable xd).
And yeah, been playing elder scrolls since morrowind, love the series, when i heard it was going to be an mmo, well im not a huge mmo fan but i definetly wanted to try it. For some odd reason trend never touched the betas (ive been in a few of them), but it blocked the real release xd.
Anyway, thanks again! Id looked in the past for another reason, but it was less pressing so i let it drop when things got annoying – the timing of this article is immaculate for me xd. If there is anyway i can like, rate, or in some way positively rate your site, let me know, id like to give back in some way xd.
Happy to help! And you bet. If you can share it socially through LinkedIn, Facebook, or otherwise, it always helps Google see my site as a quality one and helps others find these articles. Thanks!
Go to the folder where is the service and remove the file that start the service, you can find the folder in the services list, properties of the service. Then, restart and change in the registry the variable to allow unnistalation. It worked for me by this way.
That’s a great idea. Thanks for sharing.
Thanks a ton!!!!! Worked perfectly!!! 😀
Thank you sooo much. I was getting very frustrated with a very unhelpful IT department because I was using an old laptop. You changed everything. It worked so very well and for a novice you made it easy.
Cheers
Sue
So glad I could help you, Sue! Nothing quite as frustrating as IT not helping your cause.
can you do the same for the version 11.0.1028
Sorry, I don’t yet have an answer for version 11…
Can I install it back whenever just in case the IT checks?
Thanks
Unfortunately, it’s not generally that simple. There are a bunch of settings that get pushed out to the installer. If it’s not installed, IT is likely going to know about it very quickly as the system will tell them you aren’t checking in, getting updates, etc. Just keep in mind, this article wasn’t written to help you evade IT but rather to help people remove it when IT is no longer in the picture. 🙂
Hi, i check my trend micro scan and the version is 10.6
I already follow all the step, but when i want to change value data on registry editor it said “cannot edit Allow Unistall: Error writing the value’s new contents.
please help
Thanks 🙂
Atna, this can happen for 2 reasons that I know of. First, you don’t have administrative permissions on your computer to change the registry. Second, and potentially the most likely, is that the Trend Micro Unauthorized Change Prevention Service mentioned above isn’t stopped. It’s job is to protect those registry keys. Follow the steps above for disabling that service and then try again and let me know!
How do you get administative permissions to your computer then? If i try to change the password for the administrator it says that the user is blocked when i try to log in.. The IT guys at my school are very annoying.. Thanks 🙂
Never mind i got it to work 🙂 I am just a novice who didn’t see that the service had started but i fixed it with the sollution you gave William Hodel 🙂
Thanks a bunch! 🙂
Glad the post was able to help! And don’t be too hard on the IT guys. It’s their job. 🙂
Works like a champ, hat off to you. Thank you so much.
Could you add instructions on how to unload Trend Micro without a password? The steps start out the same but the registry key changed is different. These are the steps I followed but confirmation that they work on other computers would be good.
1) Reboot computer
2) Log in QUICKLY and run services.msc as fast as possible
3) Set “Trend Micro Unauthorized Change Prevention Service” to DISABLED
4) Run regedit
5) Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
6) Change the value of the Unload_Pwd key to: !CRYPT!523F7DC2E525044E2800FCDEA7E5D78B70C0A4165387060525E3EE66D5D2D2F460EA361E712B5F871FD473C7A6C
7) Right-click on the Trend Micro OfficeScan icon in your task manager and choose Unload
8) Enter the password “test” without quotes and hit enter
9) Wait about a minute (mine took ~20 seconds but there’s no indicator so slower computers could take longer) and you will see the Trend Micro icon disappear from the taskbar
Thanks for getting me pointed in the right direction. Couldn’t do anything till I disabled the service.
Done! I actually created a link near the top of this article to a new post that includes the details you provided. Thanks for contributing!
I did this in “safe mode” and it worked absolutely perfect. Thank you Joseph for doing this guide.
Regards from Sweden.
NOTHING WORKS
A much much easier way i’ve found is to use the ntrmv.exe program which is located in the OfficeScan Client directory.
If you use the special switches of -331 -980223, it will silently uninstall the application and won’t prompt you for a password.
These switches are obtained from the autopcc.ini file which lives on the OfficeScan server.
So, for example, to execute a remote removal of the client:
psexec \\computername “C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrmv.exe” -331 -980223 -u .\Administrator -p supersecretpassword
Hope this helps 🙂
Wow. Now THAT is an answer I have never heard of before. Vedant, give that a shot and let me know how it goes. It’s great to add yet another way and I appreciate you taking the time to share that Matt!
#epicwin !
Just need Admin rights on PC and, vóilà!
The best soluton EVER!
As a plus, you explained from where those obscure numbers came… so, we can change them from default ones ;D
This worked for me – using ntrvm with all the numbers. I had no luck trying to change unload or uninstall pwd on 10.6
Thank you — I was able to get most of the other stuff working but because I remote into a system for those who can’t help, I’m unable to reboot into safe mode and have them help. This solution is a lifesaver, thanks!
I will just say…
Hallelujah!!!
Really, thanks a lot: I’ve to change the antivirus from Office Scan 10.6 to another product in about 200 servers. Again, thanks!
thanks a lot. I com from Taiwan,How to uninstall OfficeScan 10.6 without a password is a big problem to trouble me for a long time. I have been searching the answer on the internet until I found out this webpage,I see the dawn of hope .
Thank you for your sharing such helpful method that solved my problem.thank you.
Thanks for taking the time to share on a weekend. Happy to have helped.
I tried to disable the service to install it from one of the machines, the “Trend Micro Unauthorized Change Prevention Service.” however this has been grayed out for the Ofsc 10.6.
Also even after changing the the registry dword value from 0 to 1 unistallation is not working.
Any suggestions would be appreciated
Thank you so much. This really saved the day with a corrupt install that hadnt registered to the console.
I had to go in via Safe Mode (as the services dont start) edit the reg key, then boot up normally and uninstall.
Thanks again
Ahh, that’s a great use case. Thanks for pointing that out and happy to have helped.
i did follow your instruction, but i’m not able to change the Dword value,
Mohd, if your timing isn’t right, the protection service starts up again and keeps you from editing the value. Open up the registry editor and go to that key and then stop the service right before editing it if you can.
i m using windows xp. when i try to change value from 0 to 1, got error like: “cannot edit alow uninstall the value’s new contents”.
sir the stepin which we have to choose the disable option…kee that dialogue box open…when u try to edit the value from 0 to 1, just at that moment click on that trend microsoft unauthorized thing and choose stop and quickly change the value
Sir you are a LIFE SAVER. I just wanna punch microsoft in the face….i mean…what kind of bullcrap is this ? i own this pc and i cannot uninstall an antivirus ? thats disastrous. thank you sir.
I couldn’t change 0 to 1 in Allow Uninstall step. It says the following error – “Cannot Edit Allow Uninstall: Error writing the value’s new contents.
Please help. Thanks in advance.
Rahul and tarun, being unable to change the registry value means that the Unauthorized Change Prevention Service I mentioned in the article is still running or restarted itself. You will need to fully disable this service before you will be able to change those values.
Just Change the registry and then it works. Super Mr. Turley and I learned some thing new from you today.
Thanks & Regards
Edd Anderson
APPLE & Windows Sr. Technician
Happy to have helped!
Awesome!!!!!
Thank you very much. It worked.
thanks
This is AWESOME! Thanks a lot.
Can you also give the solution to Bypass “Trend Micro InterScan Web Security Event” thing???
Hi, I struggled with a slow pc to get to services in time, to get around this I created a .bat file and place it on the desktop, then just double click it as soon as you’re logged on.
Here is the code.
sc config tmbmserver start= disabled
pause
That’s a great work around. Thanks for sharing!
Thank you. Worked for me.
FYI. I “found” another way around. It also works with the registry tweak without stopping service. by editing HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc\Uninstall_Pwd key to what ever u want.
e.g. from the 10.5 Manual
“password” by changing the line to read:
Uninstall_Pwd=!CRYPT!1115f4dcc3b5aa765d61d8327deb882cf99
thx for your great work.
it works! thank you sir. i love u 🙂
Good to find your solution, it worked! After all my efforts, issue solved now. Thank you!
Thank you! I did have to reboot the machine after the first step. Also, the registry edit was not in:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc but rather in:
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
Thanks again for putting this up.
Sir I facing some problems regarding trendmicro officescan client pc’s, such pc’s trendmicro corrupted i try to unistall but password not accepted and there is no folders show in registry like as “trendmicro” , only show in controll panel-programs & features, pl suggests some steps to unistall then install trendmicro AV.
If there isn’t a Trend Micro registry key, I’m not sure what can be done as it wouldn’t appear to be a typical TrendMicro install. I believe if you google manual TrendMicro removal, there are steps to remove the program manually by removing files and keys. I’d probably suggest trying that?
Excellent and fully functional with the latest version!
Thanks, this saved a lot of time for me 🙂
Excellent and useful for me.
thanks. worked fine 🙂
So many thanks! Finally managed to get this crap out of my computer!
Today I tried again but it didn’t work..My computer didn’t allow me to change the value from 0 to 1 after I finished the step 1..><"
Thanks it worked.
Great solution. Worked great. I bought an ex-corporate laptop with out of date Trend, was considering a system reinstall until I found your solution. Perfect.
Thanks
Jim
Guys, i found a better way, just reinstall WIndows. Worked for me instantly.
*laugh* That’s amusing. And a totally viable answer, though I’m not sure it’s a “better” way. Thanks for sharing.
In order to change the value “allow uninstall” in regedit, you must start in F8 “safe mod”. The tmbm service will be desactivated.
Thank you!!!
This worked great. Thank you!
It even worked on my version which was OfficeScan 11.0.1.1028
I have tried other methods over the last few days and nothing worked. I think the real key is to get that service disabled as fast as possible. Thanks again
Thanks a lot!
I had issues stopping the service due to the speed of startup with my OS on a SSD. I ended up using ‘msconfig’ to disable the service. I had to boot into safe mode, otherwise, I was not able to edit the registry. I booted normally and I was then able to uninstall add / remove programs. Very nice. Thank You.
You are awesome.Now I am free of that tool’s intruption again and again!!!!!
Thanx it really works!!!!!!!!!!!!!!!!!!!!!!!!
Great! Your clear solution works! Thank you
many thanks it works 🙂
Worked perfectly. We are going through a migration off our parent company and some of the decoupling isn’t going as planned. Trend is one of them. You have saved me so much time and effort as I can push this through Altiris.
That’s awesome. That makes it worth writing the article then.
With the service protected in Windows (even as an admin), a quick reboot into safe mode automatically disabled the service which freed the registry key to be modified. Changed the 0 to a 1 and I could uninstall without rebooting.
Fantastic article. Thank you.
Awesome work my friend. Worked like a charm on Windows 10 as well! Thank you!
Thank you very much!
Thank you, it worked like a charm in SAFE MODE.
After I changed the value from 0 to 1 and pressed OK, an error message pops up. I already disabled the registry and followed all the steps and I don’t know why this is happening. Maybe it’s because my agent version is 11.0.1028 and not 10.6?? Please help.
worked like a charm!! Thanks!!
Help!!! there are message error: Cannot edit Allow Uninstall. i use Trend micro 11.0
Thanks Before
Very useful ! Thankyou very much.
IT WORKED!!!!!!!! Yay!!!!!!!! Thank you very much, you’ve made me one happy man!
You’re my brand new flashing idol!!! Worked as a charm, after long years of disappointment and resignation! Thank you so, so, SO much!!!
Awesome! Glad it’s still useful. 🙂
Gracias amigo desde Colombia! Desinstalé el programa rapida y sencillamente!
De nada Alex!
This works for V11!
THIS WORKED! Thumbs up. No… 2 thumbs up!
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
Set value to 1
This worked for me
It works a charm !!! thanks a lot Joseph
Thank you very much, worked very well 🙂
Awesome! Worked like a charm! Thank You Sir!!!!
Man Awesome 🙂 God Bless U !
I want Kiss you , Great Post .
Bro Hats Off dude. I was so frustrated by this but u came along. Thanks a Lot.
This works perfect I tried in version 10.6, thank you so much
Worked for me. TM wasn’t appearing in Add/Remove Programs. So had to stop some background services in Task Manager before deleting the “Trend Micro” folder.
Thanks a lot. It’s 2019 and one of my office pc have this and nobody has any idea how to get rid of it.
It’s a bit of a race before that ‘started’ status of the prevention service appear and you have to reboot again
Exactly. That bit can really throw people who don’t understand how the startup process works. Glad you were able to get it solved.
Thx A Lot For this Tuto !
You Saved me.
Happy to save the day. 🙂 Enjoy.
Hi,
I do not have any fil “Allow”, only “Standard” (Reg_SZ)
How do I go about it?