Removing/Reseting Trend Micro OfficeScan Password

To remove / reset the uninstall password for Trend Micro OfficeScan

Edit Ofcscan.ini file. (Do a search.)

On Windows.95/98/XP machines it is usually in C:\Program Files\Trend Micro\OfficeScan ClientOfcscan.ini

On Windows.NT/2K machines it is usually in C:\WINNT\Ofcscan.ini

Open the Ofcscan.ini file using notepad search for the [INI_CLIENT_SECTION]

Find the line reading Uninstall_Pwd= and type a # at the beginning of the line to comment it out.

Insert a new line saying Uninstall_Pwd=70

Save the Ofcscan.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’.

Good Luck!
UPDATE – Thx to Chaos in the comments:

I also had a !crypt! uninstall password and the normal =70 trick did not work.

Found another solution that works perfectly.

set the uninstall password to:
!CRYPT!523D617DF57CBF0E9ACD37611537EBB612F9B6F1C471EB529B89772E71AD9D2431BC212ACF23B7767831E317364

then the uninstall password will be “test”

Advertisements

143 Responses to “Removing/Reseting Trend Micro OfficeScan Password”

  1. Ravi Says:

    This is outdated procedure and doesn’t work.

  2. Kenny Blewett Says:

    Ravi, I beg to differ.

    The procedure is a very primative one, that I will agree with. However, there are not many ways of fooling the system into thinking that a user has rights to remove software.

    As for your comment relating to the procedure not working… You obviously have not tried it and if you did, then I suggest you try again. Follow my instructions carefully.

    I have used this many times at client sites and will back up my claims.

  3. Sandeep Says:

    The method is not working..

    Can you please suggest some other way..

  4. N.Rosario Says:

    it worked perfect after my first try, thanks man

  5. DA Says:

    Thanks, it works with version 8.0 — my office IT staff installed it on my personal laptop without my permission 😦

  6. shaun Says:

    perfect!

  7. Cliffton Says:

    It did not work for me, because the password is CRYPT. Any other methods?

  8. Carlos Says:

    Can u make a screenshot for us?

    Or don’t work or I made some mistake.

    thx. 😉

  9. Carlos Says:

    I search in other forum and now I did it perfectly.

    [INI_CLIENT_SECTION]
    ……………………….
    ……………………….
    #Uninstall_Pwd=….
    Uninstall_Pwd=70
    …………………..
    …………………..

  10. sonothollywood Says:

    I copied my Ofcscan.ini file after i modified it, i just got done uninstalling here goes: 😀


    [INI_CLIENT_SECTION]
    Client_Use_HTTP=1
    Client_Allow_Uninstall=1
    Client_Allow_Unload=1
    Uninstall_Pwd=70
    Unload_Pwd=70
    UnloadProtect=0
    Client_LocalServer_Port=33333
    Filebase_Polling_Range=360
    Show_Window_On_Multiple_Instances=1
    ScanNetwork=0
    ShellExtension=0
    Client_Allow_Mobile=0
    ForceUpdate=0
    Interval=0
    Client_Allow_Schedule_Update=0
    Client_Allow_Update_Now=1
    Client_Allow_Update_From_TMAU=0
    Client_Allow_Update_From_OtherAU=0
    Check_IP_Change_Interval=180
    Client_Allow_Stop_Schedule_Scan=0
    InstallCTA=0
    RemoveCTA=1
    Client_Security=0

  11. Mike Huff Says:

    Worked great for me. thanks!

  12. Ashish Says:

    It works. After making the changes as mentioned in this thread, save the file and restart the system. After restarting try to uninstall trend micro officescan. It will ask for a password and enter ‘1’ there. It will remove it from the system.

    But the problem I am encountering now is whenever I start my computer, Officescan setup starts on its own and try to re-install it again. I don’t know how it is happening as I have searched for it in system and I did not find any setup or any other file of this software. The software is also removed from Add/Remove programs and Start Menu but it still run the setup on start-up. How is it Possible and what is happening here? Please advice.

  13. Joel Says:

    For those having trouble, you may need to go offline for this procedure to work. I modified the file, but the client/server reset the password to the correct one, presumable since it was online. I unplugged and it worked like a champ.

  14. Bubba19 Says:

    Worked perfectly for me once i found the correct ini file. And it is my fault for skimming through and not reading all the directions. Appreciate the help……….

    C:\windows\Ofcscan.ini
    For me no reboot required……

  15. sameer Says:

    thanks, kenny belwet i uninstall trend micro office,
    once again thanks

  16. xpower125 Says:

    worked like a doll!!!!!!

    only trouble was finding the file. after it was a breeze

  17. Jeremy Says:

    Hey guys,

    Just a few questions. I can see it’s working for some and other’s it’s not. I’m one of those others.

    We had version 8.0 installed and I uninstalled it wrongly and now it won’t install the new version saying there’s a version already installed etc.

    So I located the OFCscan.ini file under C:/Porgram Files/Trend Micro/OfficeScan Client/

    and there was another under Documents and Setting buried in there.

    Anyway I did the edit to both of them and restarted and tried it and no go.

    I’m just wondering, is it because I didn’t uninstall it correctly in the first place? Are you guys doing this when it’s installed and working correctly?

    Cheers.

  18. Paul Bester Says:

    Jeremy,

    This is done before you uninstall Office Scan. It is also just done on the INI file in the Program Files folder. I dont know if its only for certain versions though.

    Hope you come right.

  19. Gary Says:

    Thanks, worked for me first time!

  20. Brian Says:

    Worked great and much simplier than all the reg hacks and file deletions posted on other sites. If you are experiencing a re-install after you log back into the network, your IT group is pushing the install in the login script. Not much you can do in this case. You can try to disable the services, but they may be able to reset them in the login script.

  21. Paul Bester Says:

    Brains,

    Thanks for the information. I didnt even think about adding that.

  22. Guy Says:

    worked for me, thanks!

  23. Rama Says:

    It went fine thanks

  24. Paul Bester Says:

    Thats great to hear 🙂

  25. DFox Says:

    My I/T pushes a new ini file each login/reboot. We had version 8.0 and I updated the ini and unloaded every time I rebooted by doing the above. However last weekend they did an update and this hack quit working. I checked the version and it’s still 8.0 but with service pack 1. I suspect they probably now load the ini into memory rather than reading it from disk each time. Because my I/T pushes a new ini each time I suspect it’s their pushed version that gets used. I might be able to stop the pushing of a new ini by stopping a service but they may also push service parameters too. I haven’t figured out yet how to bypass this but it looks like they’ve closed this hole.

  26. DFox Says:

    Well, I made the change (=70) in the ini and turned off all the network services that load a new ini when I reboot. After rebooting I checked the ini and it was still (=70) and then I tried to unload and got the same password mismatch error. Apparently this hole has been plugged with version 8.0 SP1. They’re apparently no longer using the local ini at least for passwords any more.

  27. Kenny Blewett Says:

    DFox, thanks for the update.
    I have the weirdest feeling that the other users that had the same problem, regarding the Removal/Reset, were running under a similar environment to you.
    In typical Myth Buster fashion, I just completed a download of a new Trend Client (SP1). I will post any info that I find!

  28. Sheeraz Says:

    Worked great….Thanks a million

  29. Ramiro Says:

    Los que no pudieron hacerlo son retrasados. Anda a la perfeccion muchas gracias.

  30. Paul Bester Says:

    Its all a pleasure.

  31. SideshowMel Says:

    This DOES, in fact, work with the latest TrendMicro running under Vista x64. I have full rights to my workstation, but I was convinced by our internal support to install this TrendMicro VIRUS. (yes, I said it… it’s nearly as bad as a virus).

    Anyways, they had it locked down so I couldn’t uninstall despite having full rights. Thanks for this post, it was quite helpful.

    I’m going CLAMWIN! Yeah!

  32. David Says:

    Works fine for Trend Micro Client Server Agent 3.x series. I just swapped the crypt string for ’70’, saved file and continued with uninstall.

  33. sherry Says:

    Wow! This works great for people who have left the corporate environment but their personal machine is held hostage by the Trend Micro Officescan Client enterprise software.

  34. SM411 Says:

    Thank you so much. Finaly i got rid of that awfull AW.

  35. Corey Says:

    This trick works great. Use it!

  36. eugene lau Says:

    works like a charm! even for vista! just change the password string to “70” as mentioned and save!

  37. abadon Says:

    I also had to comment the Master_Pwd string in the [INI_SERVER_SECTION] (I had to clean a server installation) and change to =70.

  38. vinger Says:

    As Dfox mentioned earlier, this vulnerability in their software has been fixed with the service pack 1. However my persistence at pursuing a solution to this problem paid off. For those of you with client version 8.0, service pack 1, here is what I did to uninstall:

    1.) Changed the ofcscan.ini as mentioned above, changing the password to 70 and trying to uninstall. This did not work, as this is the vulnerability that service pack 1 fixes.

    2.) Tried disabling my internet connection and re-booting my computer as earlier suggestions indicated. Did not work.

    3.) Tried different things for several hours playing with the registry and .ini/.inf files, I would change things back to the way they were when it didn’t work so I didn’t screw up my registry. Nothing seemed to work until I changed this key:

    4.) HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc

    Change the AllowUninstall value to 1, and then try uninstalling. It didn’t even ask me for a password, and just started working all of a sudden. It did come up with an error message halfway through it saying something about “Install failed” but I just clicked ok and it kept going. As of right now, I don’t see any traces of it on my system. I’ll have to see if my network IT tries to re-install it once I go back to work tomorrow, but I’m thinking it might help if I install another program like McAfee or some other 3rd party program that would prevent new program installs on my computer without prompting me if it’s ok.

    Hope this helps!

  39. DFox Says:

    vinger Says: …

    Thank you vinger. Periodically I’d check to see if there was a solution. Yours works with Ver 8 SP1. I considered looking for an unload entry because I didn’t want to completely uninstall on my work PC. I thought one of the registry entries EnableDisable might give an unload access but I went ahead and uninstalled so now I don’t have it to play with. There isn’t an obvious “AllowUnload” that I could see.

    I changed all the “Allow]” entries to “1” in a sledge hammer approach. I did not encounter the error you spoke of. I clicked the uninstall and it immediately started and completed without a hitch.

    Our I/T pushes a lot but so far after a couple reboots it hasn’t come back. If it does I’ll play around to see if I can find an entry that allows an unload.

    Thanks for your research! It worked perfectly.

    • paxcom Says:

      Thanks Vinger, that worked perfectly!

    • IHgirl Says:

      Thanks DFOX and Vinger. I changed all the Allow… entries to “1” in the registry and the uninstall completed without any errors. Great efforts!

    • Lives2Sail Says:

      To allow unloading of Trend Micro Office Scan 8 SP 1 set the following registry key to “1” and then right click the taskbar icon and select “Unload Officescan” HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc\NoPwdProtect.

      • Saleh Says:

        I tried that and it brought up a pop up message saying “cannot edit Allow Uninstall: Error writing the value’s new contents.” Please see if you can help me on this. Thanks.

  40. Paul Bester Says:

    thank you guys. This works perfectly. Thank you for the contribution to this post.

  41. Rich Says:

    Thanks a million vinger the reg fix finaly solved it

  42. Rudra Says:

    This works absolutely fine & not very difficult either. Works just great.

  43. moga Says:

    works great, thanks

  44. shakti Kumar Says:

    thanks, it’s working.

  45. I'm Sorry Who? Says:

    PERFECT! I’ve been trying to get rid of this awful software on my work laptop forever, (and I actually work for Trend Micro)

    Just changing the AllowUninstall value to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc

    Worked just fine!
    Thanks so much!!!

  46. Asif Says:

    Thanks m8!! it worked!!!

  47. mok Says:

    hey guys,

    anybody knows how to bypass or reset the trend micro officescan management console ?

  48. Chris Says:

    Edit Ofcserver.ini file.
    C:\Program Files\Trend Micro\OfficeScan\PCCSRV\Private
    Find the line reading Master_Pwd= and type a # at the beginning of the line to comment it out.
    Insert a new line saying Master_Pwd=70
    Save the Ofcserver.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’

  49. Rohan Says:

    yes i had done it.

    thankx

  50. ExiOST Says:

    Wow great, thanks for info guys… this is usefull

  51. Neelesh Says:

    IT REALLY WORKED FOR ME.. GREAT THANKS TO Kenny Blewett AND ALL IN THIS GROUP.

    [INI_CLIENT_SECTION]
    Client_Use_HTTP=1
    Client_Allow_Uninstall=0
    Client_Allow_Unload=0
    #Uninstall_Pwd=!CRYPT!52310E99A873AEA526DD49161845BE8AACC9D632264C1CA4E270FB624CF9F48676B42556AFB41B031704438236E
    Uninstall_Pwd=70
    Unload_Pwd=!CRYPT!52310E99A873AEA526DD49161845BE8AACC9D632264C1CA4E270FB624CF9F48676B42556AFB41B031704438236E
    UnloadProtect=1
    Client_LocalServer_Port=16776
    Filebase_Polling_Range=360

  52. Berlic Says:

    Just changing the AllowUninstall value to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc

    did the trick! Thanks

  53. toysouth Says:

    I have tried your solution without success; listed below is my client section of the ofcscan.ini file
    [INI_CLIENT_SECTION]
    Client_Use_HTTP=1
    Client_Allow_Uninstall=0
    Client_Allow_Unload=0
    #Uninstall_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
    Uninstall_Pwd=70
    Unload_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
    UnloadProtect=1
    Client_LocalServer_Port=24890
    Filebase_Polling_Range=999
    Show_Window_On_Multiple_Instances=1
    ScanNetwork=0
    ShellExtension=0
    Client_Allow_Mobile=0
    ForceUpdate=0
    Interval=0
    Client_Allow_Schedule_Update=1
    Client_Allow_Update_Now=1
    Client_Allow_Update_From_TMAU=1
    Client_Allow_Update_From_OtherAU=0
    Check_IP_Change_Interval=10
    Client_Allow_Stop_Schedule_Scan=1
    InstallCTA=0
    RemoveCTA=0
    Client_Security=1
    ScheduleUpdateEnableDisable=1
    NoProgramUpgrade=0
    Enable_HIPS=1
    Enable_HIPS_Popup_alert=1
    RCS=0
    Client_Allow_Delay_Schedule_Scan=0
    AllowCfgNotification=0
    EnableScheduleScanWarning=0
    EnableVSTWarning=0
    EnableVirEmailWarning=0

  54. Paul Bester Says:

    Do you have the correct version mentioned above?

  55. toysouth Says:

    Paul. my version

    Product version: 8.0
    Description:
    Language: English
    Engine version: 8.320
    Signatur version: 4.751.00
    Producer: Trend Micro

  56. Mat Says:

    Funny, can anyone confirm the following that happened on my machine?

    Change the following key:
    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc\NoPwdProtect from 0 to 1 allows UNLOAD operation without any passwords?

  57. hashish Says:

    Thank you Kenny.

    It works for me (XP PRO SP2)

    I was about to give up on Ravi says… But u’re reply was sincere and I tried it 🙂

    Exit OfficeScan.
    Welcome “NO ANTIVIRUS”

  58. hashish Says:

    FYI: i came from “bypass officescan password” (google)

  59. redrocket Says:

    im kind off computr stupid and i stumbled upon this forum. what is the purpose of Removing/Reseting Trend Micro OfficeScan Password? just wondering if it would do me any good

  60. Dan Says:

    Awesome, worked first time, ive been trying to get rid of this for ages, thanks!!!

  61. JP Says:

    It worked for me,

  62. Hinry Says:

    You have to set these two lines to 1, otherwise you won’t be able to uninstall or unload it

    Client_Allow_Uninstall=1
    Client_Allow_Unload=1

  63. Vinger Says:

    Back on October 3rd, I submitted a comment explaining how I discovered to remove Trend Micro OfficeScan from your computer if you have the Service Pack 1 version, for which the editing of the .ini file does not work. To do this, simply edit this registry value:

    HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc

    Change “AllowUninstall” value to 1, and then use the uninstall feature of the program. (This would be either in your “Add/Remove Programs” list in the Control Panel or you can probably find it in your “Start/All Programs” list.

    I would like to follow-up on this by sharing some learning experiences I’ve had since then. There is a file called “tmlisten.exe” that is not removed when you do this uninstall. If you are using a company laptop or computer that has the Trend Micro OfficeScan coming back after you uninstall it, you probably have “tmlisten.exe” running in your background. This executable opens up a port on your computer that allows for program updates and remote commands, such as commands initiated by the administrator of your network. (AKA those IT guys that work for your company…)

    Here is what I have done to eliminate this problem. I downloaded a process blocker, (google process blocker), and once you read up on the program and learn how to use it, you’ll find that you have to add programs you want to block in a text file. Open the text file with Notepad or whatever, and add the following lines to block programs:

    tmlisten.exe
    pccntmon.exe
    ntrtscan.exe

    These are all programs associated with Trend Micro OfficeScan. Blocking these will prevent further problems. You should also delete them from your computer once they stop running. This program is also useful for blocking common Trojans or other unwanted programs from running, such as “helper.dll” or “sysguard.exe”.

    The other recommendation I would make would be to get another anti-malware program on your computer to replace OfficeScan; I use Malwarebytes.

    These are the two programs I run on my laptop now and I am completely satisfied with them. I feel like my laptop is secure and protected, while not feeling like Big Brother is watching me with that Trend Micro OfficeSpy crap.

    Hope this helps!

    • khalid babur Says:

      Vinger Thanks for the wonderfull solution for unloading officescan adn reinstalling.
      what I need to know is how we can clear up the Real Time Monitor screen once office scan founds a virus or spyware.

      I treid to clean logs but Real Time kept on showing last virus found information.

  64. Phineas Mc Fissh Says:

    The Registry fix works!
    The ini fix no longer works
    Its gone now..
    hoooraay

  65. kakaus Says:

    dude.its work!
    thanx buddy!

  66. mp3dewd Says:

    For people wanting to stop/unload OfficeScan, but not unistall it, go to ‘HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc’ and change ‘NoPwdProtect’ from ‘0’ to ‘1’. It will then allow you to unload OfficeScan at any time.

  67. mp3dewd Says:

    Forgot to mention, have tested the above on ver 8 SP1 and it works

  68. Kenny Blewett Says:

    Hey guys!

    I am proud to announce that our new site is 110% functional!!

    Please pay us a visit at http://blog.lpfsystems.com/

    Look forward to hearing from you all!

    Kenny

  69. khim Says:

    thnx 4 the help!!!!it works a lot…

    • Kenny Blewett Says:

      Glad that we were able to help! Please feel free to refer back to us for future issues 🙂 check out the new site though, this one is a bit outdated… The new site is – http://blog.lpfsystems.com/

      • khalid babur Says:

        Kenny Thanks for the wonderfull solution for unloading officescan adn reinstalling.
        what I need to know is how we can clear up the Real Time Monitor screen once office scan founds a virus or spyware.

        I treid to clean logs but Real Time kept on showing last virus found information.

  70. John Says:

    Thank You!

  71. Khalid Says:

    Bad News: New version of office scan has just arrived 8.950 and now you cant change your registry settings.
    can anyone confirm this? Atleast on my laptop its not allowing to change registry settings of trend micro.

    • Mou Says:

      try this…
      1. Open “OFCSCAN.INI” from the install path.
      2. Go to INI_CLIENT_SECTION and look up Unload_Pwd key.
      3. The value is something of the sort !CRYPT!#####################… (This value is decrypted internally and the resulting decrypt, which is md5 hash, is stored on the stack.)
      To change it to password of your choice:
      4. Choose your own password. Say “abcdefgh”. Find MD5 hash of it. There are many online tools for your help. For example: http://www.fileformat.info/tool/hash.htm
      MD5 of “abcdefgh” is e8dc4081b13434b45189a720b77b6818
      5. Copy md5 string of the password of your choice.
      6. Replace the Unload_Pwd key with the following pattern:
      Unload_Pwd=!CRYPT!111################… where ####… is your hash string.
      For example:- !CRYPT!111e8dc4081b13434b45189a720b77b6818
      Note: 111 is dummy text. Internally the code truncates it. Due to flawed algorithm, OfficeScan ends up not decrypting it and truncates with hashvalue of our choice written to the stack.
      7. Save OFCSCAN.ini.

      That’s it. Right click on OfficeScan tray icon. Choose Unload and give your password “abcdefgh”. This value is internally MD5 hashed and checked against value read and decrypted from the ini file. They will match and OfficeScan unloads.

    • Raj Says:

      Worked on version 10 ! AWESOME !!!!!! Thanks a ton !

  72. Yasser Says:

    Thanks, it working properly. My Office scan client have been protected by IT administrator but I have already uninstalled it from my notebook. Thanks

  73. Jim552255 Says:

    Hey Guys,
    I have the latest upadated version of TM (as of this message), and the registry key solution worked. This thread was very helpfull ! Thanks Vinger and All !

  74. Ajtih Says:

    vinger … thank you so much i have been working on this for last few days ..

  75. Radu_Gabri3l Says:

    Hey guys,

    this little baby worked perfectly :

    ‘HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc’ and change ‘NoPwdProtect’ from ‘0′ to ‘1′.

    good job

    By the way, I was wondering is there a possibility to make full rights on a limited user ( by the IT guys ) without accessing the Admin account ? just curious …

  76. Edwin Says:

    This works like a charm! Thanks!

  77. Warren Says:

    Mou’s text from Jan 1, 2010 worked for me! Awesome.

  78. Mou Fan Says:

    Mou, your MD5 hash was the ONLY thing that worked for me. Brilliant!

  79. Seemo Says:

    Thank you
    it is working fine 😉

  80. Tee Says:

    how do you get internal errors to stop popping on the babydow website when you do certain things with the baby such as putting them to bed??!
    please help!

    • Kenny Blewett Says:

      Tee, I really have no idea. I would presume you should look for any Trend addons that could be running in your internet browser. Try disabling them. It is not advisable of course, but it is the only way I could think it may help.

  81. Samuel Haddad Says:

    As some of the other users have mentioned this hole seems to have been plugged in newer versions. If you are still having trouble try following my directions found here
    http://samuelhaddad.com/2010/06/05/uninstall-trendmicro-officescan/

  82. dude Says:

    I got winpatrol from http://www.winpatrol.com/download.html ..and selected,,delete at boot time,,..so now the stupid OfficeScan is still here..but never loads …hahahaha….marvelous…

  83. sleem Says:

    Can not break the program when doing changes in the file You can not Alhvd in the same folder please help via email and thank you . x_heero@yahoo.com

  84. badar Says:

    dear sir , it tech is not working for unloading this software , this is not working for uninstalling , Trend Micro™ Client/Server Security Agent 6.0
    Service Pack 1 installed in system , kindly suggest what to do , also after installing this software by admin ,i cant download any video through any download kindly tell me what to do with this software .
    your reply is very important .
    thanks

  85. badar Says:

    can any one answer my questions????

  86. vishu Says:

    i want to acess optical drive and usb ports in trend micro office scan without administrator perimission as ti blocked by the server administrator so please give the registry keys for the same.

  87. Sasha Says:

    Sweet mother of jesus it worked.

    I have tried your solution without success; listed below is my client section of the ofcscan.ini file
    [INI_CLIENT_SECTION]
    Client_Use_HTTP=1
    Client_Allow_Uninstall=0
    Client_Allow_Unload=0
    #Uninstall_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
    Uninstall_Pwd=70
    Unload_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
    UnloadProtect=1
    Client_LocalServer_Port=24890
    Filebase_Polling_Range=999
    Show_Window_On_Multiple_Instances=1
    ScanNetwork=0
    ShellExtension=0
    Client_Allow_Mobile=0
    ForceUpdate=0
    Interval=0
    Client_Allow_Schedule_Update=1
    Client_Allow_Update_Now=1
    Client_Allow_Update_From_TMAU=1
    Client_Allow_Update_From_OtherAU=0
    Check_IP_Change_Interval=10
    Client_Allow_Stop_Schedule_Scan=1
    InstallCTA=0
    RemoveCTA=0
    Client_Security=1
    ScheduleUpdateEnableDisable=1
    NoProgramUpgrade=0
    Enable_HIPS=1
    Enable_HIPS_Popup_alert=1
    RCS=0
    Client_Allow_Delay_Schedule_Scan=0
    AllowCfgNotification=0
    EnableScheduleScanWarning=0
    EnableVSTWarning=0
    EnableVirEmailWarning=0
    Reply

  88. kr Says:

    In my case, I don’t even have the “allowuninstall” value in the registry. I was able to go to regedit and go to the path mentioned above. However after reaching “Misc”, I see only “(Default)” in the right hand side pane. Should I just create “allowuninstall” key on the right hand side pane and then change the value to 1?

  89. AeonHelix Says:

    I have Tried 3 ways of Changing the passwords.
    Version 10.5.1161

    1> ofscan.ini > Uninstall_Pwd=70 (#Uninstall_Pwd above that line)
    2> Regedit > Allow Uninstall “1” (Errored)
    3> Uninstall_Pwd= !Crypt! “Hash Code”

    So far nothing has worked, I have Discoonected from internet and cold boot my computer every attempt.

    My current configure (unaltered)
    [INI_CLIENT_SECTION]
    Client_Use_HTTP=1
    Client_Allow_Uninstall=1
    Client_Allow_Unload=1
    Uninstall_Pwd=!CRYPT!e8dc4081b13434b45189a720b77b6818
    Unload_Pwd=!CRYPT!e8dc4081b13434b45189a720b77b6818
    UnloadProtect=0
    Client_LocalServer_Port=29210
    Filebase_Polling_Range=360
    Show_Window_On_Multiple_Instances=1
    ScanNetwork=0
    ShellExtension=0
    Client_Allow_Mobile=0
    ForceUpdate=0
    Interval=0
    Client_Allow_Schedule_Update=1
    Client_Allow_Update_Now=1
    Client_Allow_Update_From_TMAU=1
    Client_Allow_Update_From_OtherAU=0
    Check_IP_Change_Interval=180
    Client_Allow_Stop_Schedule_Scan=0
    InstallCTA=0
    RemoveCTA=0
    Client_Security=1
    ScheduleUpdateEnableDisable=1
    NoProgramUpgrade=0
    Enable_HIPS=1
    Enable_HIPS_Popup_alert=1
    RCS=0
    EnableVirEmailWarning=1
    AllowCfgNotification=0
    EnableScheduleScanWarning=0
    Client_Allow_Delay_Schedule_Scan=1
    AllowPromptRebootForCleanup=1

    Correct me if I’m wrong would this program be integrated with webroot? Cause they started to block URL’s and I want to say its OfficeScan working with webroot.

  90. Chaos Says:

    I also had a !crypt! uninstall password and the normal =70 trick did not work.

    Found another solution that works perfectly.

    set the uninstall password to:
    !CRYPT!523D617DF57CBF0E9ACD37611537EBB612F9B6F1C471EB529B89772E71AD9D2431BC212ACF23B7767831E317364

    then the uninstall password will be “test”

  91. Cleo Andersen Says:

    Thanks Chaos. This worked for me to 🙂 I did stumble on another password option here:
    http://rslucan.wordpress.com/2011/04/05/unloading-officescan-10-5-by-changing-password-set/

    Also, remember to change the unload/uninstall values to 1 in the ini file, mine were set to 0.

    Nice!

    Cheers,
    Cleo

  92. gkhncan Says:

    Chaos thanks for your solution.Perfect!!!

  93. Ednei Says:

    Chaos, Congratulations! Its worked perfect! Great idea!

  94. Bassjunkie Says:

    Many Many thanks Chaos!!!! Works perfect!!!

    • kbk Says:

      Man, do I love you Chaos. I’ve been trying for weeks to move this little file to another place in order to be able to run a game, but stupid OfficeScan keeps saying it’s risky, and doesn’t allow me to open it, move it, delete it, copy it, anything at all. I read this whole page and tried everything and only yours worked. Thanks again, a LOT.

  95. HTC Desire Says:

    {When I|After I} {originally|initially} {commented|left a comment} I {seem to have|appear to have} {clicked|clicked on} the -Notify me when new comments are added- checkbox {and now|and from now on} {each time a|every time a|whenever a} comment is added {I get|I recieve|I receive} {four|4} emails {with the same|with the exact same} comment. {Is there|Perhaps there is|There has to be} {a way|a means|an easy method} {you can|you are able to} remove me from that service? {Thanks|Many thanks|Thank you|Cheers|Thanks a lot|Appreciate it|Kudos}!

  96. Salem M. Almrabit Says:

    This procedure doesn’t work, I tried it several times but with no use.
    Do you know any other method that can remove this software?
    Thanks in advance.

  97. Leafy Leaf Says:

    stop buying GMO foods from the supermarkets… stop taking vaccines and flu shots…. the American and European Government are SICK EVIL WAR CRIMINALS who inject toxic chemicals and poisons into our food supply

  98. HaPe Says:

    Thanks it works for me.

  99. bjorn Says:

    An easy but brutal and effective method. Start PC from a ERD commander. Delete folder with trend micro and also go into services and disable officescan. Start windows again. problems solved. You may want to run a registry clean to remove entries. Works for me since my school don’t push install again. Trend officescan is worse than a virus.

    • sachin Says:

      i am anable to change ofcscan.ini file as in my pc it may be protected can any one give me some other solution and its not allowing to change registry settings of trend micro.

      plz help me

  100. Spoof! Says:

    For Un-install without PW use: “%PROGRAMFILES%\Trend Micro\OfficeScan Client\NTRmv.exe –980223”

  101. Claus M Says:

    Setting the unload and/or uninstall to the !CRYPT! did the trick !
    set the uninstall password to:
    !CRYPT!523D617DF57CBF0E9ACD37611537EBB612F9B6F1C471EB529B89772E71AD9D2431BC212ACF23B7767831E317364

    then the uninstall password will be “test”

    Thanks a lot !!

  102. Mohamed ElMasry Says:

    Great Thx For your support
    you are Genius
    change crypt and password “test”
    Thx again

  103. Custom Glass in Thornton Says:

    Some patients feel soreness at the site of the symptom
    but not the least of which is waking up to lower window replacement jacksonville fl.
    To reduce and eliminate your window replacement jacksonville fl.
    Backpain may be caused from a variety of reasons, lower window replacement jacksonville fl accounts for
    more sick leave taken than any other country.

  104. Hayder Says:

    good stuff, thanks mate


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: