To remove / reset the uninstall password for Trend Micro OfficeScan
Edit Ofcscan.ini file. (Do a search.)
On Windows.95/98/XP machines it is usually in C:\Program Files\Trend Micro\OfficeScan ClientOfcscan.ini
On Windows.NT/2K machines it is usually in C:\WINNT\Ofcscan.ini
Open the Ofcscan.ini file using notepad search for the [INI_CLIENT_SECTION]
Find the line reading Uninstall_Pwd= and type a # at the beginning of the line to comment it out.
Insert a new line saying Uninstall_Pwd=70
Save the Ofcscan.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’.
Good Luck!
UPDATE – Thx to Chaos in the comments:
I also had a !crypt! uninstall password and the normal =70 trick did not work.
Found another solution that works perfectly.
set the uninstall password to:
!CRYPT!523D617DF57CBF0E9ACD37611537EBB612F9B6F1C471EB529B89772E71AD9D2431BC212ACF23B7767831E317364
then the uninstall password will be “test”
RSS Feed
LPF Computer Tips and Information - Windows XP, Vista and Linux 
March 27, 2008 at 11:42 pm
This is outdated procedure and doesn’t work.
March 27, 2010 at 10:04 pm
Mircro Trend security is stupid it makes websites that are harmless seem bad and you will not be able to play it anymore!
March 31, 2008 at 8:43 am
Ravi, I beg to differ.
The procedure is a very primative one, that I will agree with. However, there are not many ways of fooling the system into thinking that a user has rights to remove software.
As for your comment relating to the procedure not working… You obviously have not tried it and if you did, then I suggest you try again. Follow my instructions carefully.
I have used this many times at client sites and will back up my claims.
April 6, 2008 at 7:21 am
The method is not working..
Can you please suggest some other way..
April 16, 2008 at 7:21 am
it worked perfect after my first try, thanks man
May 2, 2008 at 5:18 pm
Thanks, it works with version 8.0 — my office IT staff installed it on my personal laptop without my permission 😦
May 6, 2008 at 10:11 am
perfect!
May 9, 2008 at 12:47 am
It did not work for me, because the password is CRYPT. Any other methods?
May 20, 2008 at 11:25 pm
Can u make a screenshot for us?
Or don’t work or I made some mistake.
thx. 😉
May 21, 2008 at 3:02 pm
I search in other forum and now I did it perfectly.
[INI_CLIENT_SECTION]
……………………….
……………………….
#Uninstall_Pwd=….
Uninstall_Pwd=70
…………………..
…………………..
May 26, 2008 at 9:11 am
I copied my Ofcscan.ini file after i modified it, i just got done uninstalling here goes: 😀
…
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=1
Client_Allow_Unload=1
Uninstall_Pwd=70
Unload_Pwd=70
UnloadProtect=0
Client_LocalServer_Port=33333
Filebase_Polling_Range=360
Show_Window_On_Multiple_Instances=1
ScanNetwork=0
ShellExtension=0
Client_Allow_Mobile=0
ForceUpdate=0
Interval=0
Client_Allow_Schedule_Update=0
Client_Allow_Update_Now=1
Client_Allow_Update_From_TMAU=0
Client_Allow_Update_From_OtherAU=0
Check_IP_Change_Interval=180
Client_Allow_Stop_Schedule_Scan=0
InstallCTA=0
RemoveCTA=1
Client_Security=0
…
February 27, 2011 at 2:21 pm
worked for me!
Client_Allow_Uninstall=1
Client_Allow_Unload=1
Uninstall_Pwd=70
Unload_Pwd=70
UnloadProtect=0
June 13, 2011 at 6:44 am
GREAT!!! Thanks a lot.
May 28, 2008 at 4:57 pm
Worked great for me. thanks!
June 6, 2008 at 11:48 am
It works. After making the changes as mentioned in this thread, save the file and restart the system. After restarting try to uninstall trend micro officescan. It will ask for a password and enter ‘1’ there. It will remove it from the system.
But the problem I am encountering now is whenever I start my computer, Officescan setup starts on its own and try to re-install it again. I don’t know how it is happening as I have searched for it in system and I did not find any setup or any other file of this software. The software is also removed from Add/Remove programs and Start Menu but it still run the setup on start-up. How is it Possible and what is happening here? Please advice.
June 6, 2008 at 4:59 pm
For those having trouble, you may need to go offline for this procedure to work. I modified the file, but the client/server reset the password to the correct one, presumable since it was online. I unplugged and it worked like a champ.
June 17, 2008 at 10:29 pm
Worked perfectly for me once i found the correct ini file. And it is my fault for skimming through and not reading all the directions. Appreciate the help……….
C:\windows\Ofcscan.ini
For me no reboot required……
June 26, 2008 at 12:20 pm
thanks, kenny belwet i uninstall trend micro office,
once again thanks
July 6, 2008 at 4:26 am
worked like a doll!!!!!!
only trouble was finding the file. after it was a breeze
July 10, 2008 at 5:57 am
Hey guys,
Just a few questions. I can see it’s working for some and other’s it’s not. I’m one of those others.
We had version 8.0 installed and I uninstalled it wrongly and now it won’t install the new version saying there’s a version already installed etc.
So I located the OFCscan.ini file under C:/Porgram Files/Trend Micro/OfficeScan Client/
and there was another under Documents and Setting buried in there.
Anyway I did the edit to both of them and restarted and tried it and no go.
I’m just wondering, is it because I didn’t uninstall it correctly in the first place? Are you guys doing this when it’s installed and working correctly?
Cheers.
July 16, 2008 at 2:15 pm
Jeremy,
This is done before you uninstall Office Scan. It is also just done on the INI file in the Program Files folder. I dont know if its only for certain versions though.
Hope you come right.
July 18, 2008 at 8:16 pm
Thanks, worked for me first time!
July 31, 2008 at 2:13 am
Worked great and much simplier than all the reg hacks and file deletions posted on other sites. If you are experiencing a re-install after you log back into the network, your IT group is pushing the install in the login script. Not much you can do in this case. You can try to disable the services, but they may be able to reset them in the login script.
July 31, 2008 at 8:00 am
Brains,
Thanks for the information. I didnt even think about adding that.
August 2, 2008 at 5:41 pm
worked for me, thanks!
August 9, 2008 at 10:46 am
It went fine thanks
August 12, 2008 at 8:00 am
Thats great to hear 🙂
August 13, 2008 at 2:27 pm
My I/T pushes a new ini file each login/reboot. We had version 8.0 and I updated the ini and unloaded every time I rebooted by doing the above. However last weekend they did an update and this hack quit working. I checked the version and it’s still 8.0 but with service pack 1. I suspect they probably now load the ini into memory rather than reading it from disk each time. Because my I/T pushes a new ini each time I suspect it’s their pushed version that gets used. I might be able to stop the pushing of a new ini by stopping a service but they may also push service parameters too. I haven’t figured out yet how to bypass this but it looks like they’ve closed this hole.
August 13, 2008 at 3:26 pm
Well, I made the change (=70) in the ini and turned off all the network services that load a new ini when I reboot. After rebooting I checked the ini and it was still (=70) and then I tried to unload and got the same password mismatch error. Apparently this hole has been plugged with version 8.0 SP1. They’re apparently no longer using the local ini at least for passwords any more.
August 14, 2008 at 9:08 am
DFox, thanks for the update.
I have the weirdest feeling that the other users that had the same problem, regarding the Removal/Reset, were running under a similar environment to you.
In typical Myth Buster fashion, I just completed a download of a new Trend Client (SP1). I will post any info that I find!
August 14, 2008 at 11:45 am
Worked great….Thanks a million
August 15, 2008 at 6:25 am
Los que no pudieron hacerlo son retrasados. Anda a la perfeccion muchas gracias.
August 18, 2008 at 5:41 pm
Its all a pleasure.
August 25, 2008 at 11:55 pm
This DOES, in fact, work with the latest TrendMicro running under Vista x64. I have full rights to my workstation, but I was convinced by our internal support to install this TrendMicro VIRUS. (yes, I said it… it’s nearly as bad as a virus).
Anyways, they had it locked down so I couldn’t uninstall despite having full rights. Thanks for this post, it was quite helpful.
I’m going CLAMWIN! Yeah!
August 26, 2008 at 12:53 am
Works fine for Trend Micro Client Server Agent 3.x series. I just swapped the crypt string for ’70’, saved file and continued with uninstall.
August 26, 2008 at 4:31 am
Wow! This works great for people who have left the corporate environment but their personal machine is held hostage by the Trend Micro Officescan Client enterprise software.
September 7, 2008 at 9:56 pm
Thank you so much. Finaly i got rid of that awfull AW.
September 16, 2008 at 4:03 am
This trick works great. Use it!
September 16, 2008 at 6:27 pm
works like a charm! even for vista! just change the password string to “70” as mentioned and save!
September 17, 2008 at 5:42 pm
I also had to comment the Master_Pwd string in the [INI_SERVER_SECTION] (I had to clean a server installation) and change to =70.
September 17, 2010 at 2:33 am
you suggestion to change Master_Pwd as well to 70 worked with me, thanks.
October 3, 2008 at 7:15 pm
As Dfox mentioned earlier, this vulnerability in their software has been fixed with the service pack 1. However my persistence at pursuing a solution to this problem paid off. For those of you with client version 8.0, service pack 1, here is what I did to uninstall:
1.) Changed the ofcscan.ini as mentioned above, changing the password to 70 and trying to uninstall. This did not work, as this is the vulnerability that service pack 1 fixes.
2.) Tried disabling my internet connection and re-booting my computer as earlier suggestions indicated. Did not work.
3.) Tried different things for several hours playing with the registry and .ini/.inf files, I would change things back to the way they were when it didn’t work so I didn’t screw up my registry. Nothing seemed to work until I changed this key:
4.) HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc
Change the AllowUninstall value to 1, and then try uninstalling. It didn’t even ask me for a password, and just started working all of a sudden. It did come up with an error message halfway through it saying something about “Install failed” but I just clicked ok and it kept going. As of right now, I don’t see any traces of it on my system. I’ll have to see if my network IT tries to re-install it once I go back to work tomorrow, but I’m thinking it might help if I install another program like McAfee or some other 3rd party program that would prevent new program installs on my computer without prompting me if it’s ok.
Hope this helps!
November 19, 2009 at 2:57 pm
Yes dude this works. The previous posts didn’t work but this one works. I guess they made it a bit more complicated with the SP1
January 30, 2012 at 3:04 pm
same. didn’t even asked password after this reg change.
thanks alot vinger
October 15, 2008 at 3:57 pm
vinger Says: …
Thank you vinger. Periodically I’d check to see if there was a solution. Yours works with Ver 8 SP1. I considered looking for an unload entry because I didn’t want to completely uninstall on my work PC. I thought one of the registry entries EnableDisable might give an unload access but I went ahead and uninstalled so now I don’t have it to play with. There isn’t an obvious “AllowUnload” that I could see.
I changed all the “Allow]” entries to “1” in a sledge hammer approach. I did not encounter the error you spoke of. I clicked the uninstall and it immediately started and completed without a hitch.
Our I/T pushes a lot but so far after a couple reboots it hasn’t come back. If it does I’ll play around to see if I can find an entry that allows an unload.
Thanks for your research! It worked perfectly.
March 10, 2010 at 1:36 am
Thanks Vinger, that worked perfectly!
September 28, 2010 at 12:14 am
Thanks DFOX and Vinger. I changed all the Allow… entries to “1” in the registry and the uninstall completed without any errors. Great efforts!
December 29, 2010 at 5:55 pm
To allow unloading of Trend Micro Office Scan 8 SP 1 set the following registry key to “1” and then right click the taskbar icon and select “Unload Officescan” HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc\NoPwdProtect.
November 17, 2011 at 10:33 pm
I tried that and it brought up a pop up message saying “cannot edit Allow Uninstall: Error writing the value’s new contents.” Please see if you can help me on this. Thanks.
October 16, 2008 at 10:44 am
thank you guys. This works perfectly. Thank you for the contribution to this post.
October 19, 2008 at 9:46 pm
Thanks a million vinger the reg fix finaly solved it
October 24, 2008 at 7:03 am
This works absolutely fine & not very difficult either. Works just great.
October 30, 2008 at 5:20 am
works great, thanks
November 3, 2008 at 11:29 am
thanks, it’s working.
November 4, 2008 at 8:40 pm
PERFECT! I’ve been trying to get rid of this awful software on my work laptop forever, (and I actually work for Trend Micro)
Just changing the AllowUninstall value to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc
Worked just fine!
Thanks so much!!!
November 5, 2008 at 10:04 am
Thanks m8!! it worked!!!
November 24, 2008 at 10:22 am
hey guys,
anybody knows how to bypass or reset the trend micro officescan management console ?
December 15, 2008 at 5:11 pm
Edit Ofcserver.ini file.
C:\Program Files\Trend Micro\OfficeScan\PCCSRV\Private
Find the line reading Master_Pwd= and type a # at the beginning of the line to comment it out.
Insert a new line saying Master_Pwd=70
Save the Ofcserver.ini file and retry the uninstall. When it prompts you for a password, enter a ‘1’
December 19, 2008 at 8:43 pm
yes i had done it.
thankx
January 25, 2009 at 5:34 pm
Wow great, thanks for info guys… this is usefull
January 25, 2009 at 10:32 pm
IT REALLY WORKED FOR ME.. GREAT THANKS TO Kenny Blewett AND ALL IN THIS GROUP.
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=0
Client_Allow_Unload=0
#Uninstall_Pwd=!CRYPT!52310E99A873AEA526DD49161845BE8AACC9D632264C1CA4E270FB624CF9F48676B42556AFB41B031704438236E
Uninstall_Pwd=70
Unload_Pwd=!CRYPT!52310E99A873AEA526DD49161845BE8AACC9D632264C1CA4E270FB624CF9F48676B42556AFB41B031704438236E
UnloadProtect=1
Client_LocalServer_Port=16776
Filebase_Polling_Range=360
February 5, 2009 at 12:38 pm
Just changing the AllowUninstall value to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc
did the trick! Thanks
February 11, 2009 at 7:24 pm
I have tried your solution without success; listed below is my client section of the ofcscan.ini file
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=0
Client_Allow_Unload=0
#Uninstall_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
Uninstall_Pwd=70
Unload_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
UnloadProtect=1
Client_LocalServer_Port=24890
Filebase_Polling_Range=999
Show_Window_On_Multiple_Instances=1
ScanNetwork=0
ShellExtension=0
Client_Allow_Mobile=0
ForceUpdate=0
Interval=0
Client_Allow_Schedule_Update=1
Client_Allow_Update_Now=1
Client_Allow_Update_From_TMAU=1
Client_Allow_Update_From_OtherAU=0
Check_IP_Change_Interval=10
Client_Allow_Stop_Schedule_Scan=1
InstallCTA=0
RemoveCTA=0
Client_Security=1
ScheduleUpdateEnableDisable=1
NoProgramUpgrade=0
Enable_HIPS=1
Enable_HIPS_Popup_alert=1
RCS=0
Client_Allow_Delay_Schedule_Scan=0
AllowCfgNotification=0
EnableScheduleScanWarning=0
EnableVSTWarning=0
EnableVirEmailWarning=0
February 12, 2009 at 4:46 pm
Do you have the correct version mentioned above?
February 12, 2009 at 8:21 pm
Paul. my version
Product version: 8.0
Description:
Language: English
Engine version: 8.320
Signatur version: 4.751.00
Producer: Trend Micro
February 16, 2009 at 5:20 pm
Funny, can anyone confirm the following that happened on my machine?
Change the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc\NoPwdProtect from 0 to 1 allows UNLOAD operation without any passwords?
February 20, 2009 at 11:31 pm
Thank you Kenny.
It works for me (XP PRO SP2)
I was about to give up on Ravi says… But u’re reply was sincere and I tried it 🙂
Exit OfficeScan.
Welcome “NO ANTIVIRUS”
February 20, 2009 at 11:37 pm
FYI: i came from “bypass officescan password” (google)
February 21, 2009 at 1:29 am
im kind off computr stupid and i stumbled upon this forum. what is the purpose of Removing/Reseting Trend Micro OfficeScan Password? just wondering if it would do me any good
March 13, 2009 at 6:25 pm
Awesome, worked first time, ive been trying to get rid of this for ages, thanks!!!
March 19, 2009 at 1:28 am
It worked for me,
March 21, 2009 at 8:50 am
You have to set these two lines to 1, otherwise you won’t be able to uninstall or unload it
Client_Allow_Uninstall=1
Client_Allow_Unload=1
April 7, 2009 at 8:16 am
Back on October 3rd, I submitted a comment explaining how I discovered to remove Trend Micro OfficeScan from your computer if you have the Service Pack 1 version, for which the editing of the .ini file does not work. To do this, simply edit this registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc
Change “AllowUninstall” value to 1, and then use the uninstall feature of the program. (This would be either in your “Add/Remove Programs” list in the Control Panel or you can probably find it in your “Start/All Programs” list.
I would like to follow-up on this by sharing some learning experiences I’ve had since then. There is a file called “tmlisten.exe” that is not removed when you do this uninstall. If you are using a company laptop or computer that has the Trend Micro OfficeScan coming back after you uninstall it, you probably have “tmlisten.exe” running in your background. This executable opens up a port on your computer that allows for program updates and remote commands, such as commands initiated by the administrator of your network. (AKA those IT guys that work for your company…)
Here is what I have done to eliminate this problem. I downloaded a process blocker, (google process blocker), and once you read up on the program and learn how to use it, you’ll find that you have to add programs you want to block in a text file. Open the text file with Notepad or whatever, and add the following lines to block programs:
tmlisten.exe
pccntmon.exe
ntrtscan.exe
These are all programs associated with Trend Micro OfficeScan. Blocking these will prevent further problems. You should also delete them from your computer once they stop running. This program is also useful for blocking common Trojans or other unwanted programs from running, such as “helper.dll” or “sysguard.exe”.
The other recommendation I would make would be to get another anti-malware program on your computer to replace OfficeScan; I use Malwarebytes.
These are the two programs I run on my laptop now and I am completely satisfied with them. I feel like my laptop is secure and protected, while not feeling like Big Brother is watching me with that Trend Micro OfficeSpy crap.
Hope this helps!
September 21, 2009 at 7:48 am
Vinger Thanks for the wonderfull solution for unloading officescan adn reinstalling.
what I need to know is how we can clear up the Real Time Monitor screen once office scan founds a virus or spyware.
I treid to clean logs but Real Time kept on showing last virus found information.
May 9, 2009 at 11:47 pm
The Registry fix works!
The ini fix no longer works
Its gone now..
hoooraay
May 27, 2009 at 6:07 am
dude.its work!
thanx buddy!
June 24, 2009 at 5:13 am
For people wanting to stop/unload OfficeScan, but not unistall it, go to ‘HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc’ and change ‘NoPwdProtect’ from ‘0’ to ‘1’. It will then allow you to unload OfficeScan at any time.
June 24, 2009 at 5:15 am
Forgot to mention, have tested the above on ver 8 SP1 and it works
August 17, 2009 at 2:57 pm
Hey guys!
I am proud to announce that our new site is 110% functional!!
Please pay us a visit at http://blog.lpfsystems.com/
Look forward to hearing from you all!
Kenny
September 6, 2009 at 1:02 am
thnx 4 the help!!!!it works a lot…
September 7, 2009 at 8:34 am
Glad that we were able to help! Please feel free to refer back to us for future issues 🙂 check out the new site though, this one is a bit outdated… The new site is – http://blog.lpfsystems.com/
September 21, 2009 at 7:45 am
Kenny Thanks for the wonderfull solution for unloading officescan adn reinstalling.
what I need to know is how we can clear up the Real Time Monitor screen once office scan founds a virus or spyware.
I treid to clean logs but Real Time kept on showing last virus found information.
September 24, 2009 at 4:21 am
Thank You!
September 25, 2009 at 7:58 am
Bad News: New version of office scan has just arrived 8.950 and now you cant change your registry settings.
can anyone confirm this? Atleast on my laptop its not allowing to change registry settings of trend micro.
January 1, 2010 at 8:32 pm
try this…
1. Open “OFCSCAN.INI” from the install path.
2. Go to INI_CLIENT_SECTION and look up Unload_Pwd key.
3. The value is something of the sort !CRYPT!#####################… (This value is decrypted internally and the resulting decrypt, which is md5 hash, is stored on the stack.)
To change it to password of your choice:
4. Choose your own password. Say “abcdefgh”. Find MD5 hash of it. There are many online tools for your help. For example: http://www.fileformat.info/tool/hash.htm
MD5 of “abcdefgh” is e8dc4081b13434b45189a720b77b6818
5. Copy md5 string of the password of your choice.
6. Replace the Unload_Pwd key with the following pattern:
Unload_Pwd=!CRYPT!111################… where ####… is your hash string.
For example:- !CRYPT!111e8dc4081b13434b45189a720b77b6818
Note: 111 is dummy text. Internally the code truncates it. Due to flawed algorithm, OfficeScan ends up not decrypting it and truncates with hashvalue of our choice written to the stack.
7. Save OFCSCAN.ini.
That’s it. Right click on OfficeScan tray icon. Choose Unload and give your password “abcdefgh”. This value is internally MD5 hashed and checked against value read and decrypted from the ini file. They will match and OfficeScan unloads.
March 10, 2010 at 4:52 am
Mou,
Thank you sooooooo much! Your method was the only one that worked for me!
April 2, 2010 at 10:43 pm
Yes….Ally is right…..Mou’s reply is the only that works perfectly. You rock!!
June 26, 2010 at 1:29 am
Oh my god! thanks! This one really worked!!! :DDD A thousand thanks 😀
July 21, 2010 at 5:47 am
I can confirm Mou’s approach works with OfficeScan version 10. Thanks!
September 28, 2010 at 8:49 am
That was the right way for me to uninstall it! Thx for your posting!!!!!
December 26, 2010 at 6:24 pm
Mou’s solution worked perfectly. I tried all the others but changing the hash is what did the trick. I also changed the value on the Allow_Client Uninstall to “1” but I’m not sure if that helped my case too. I used this method to uninstall version 10
February 8, 2011 at 8:36 pm
Worked on version 10.5 on Win XP.
Thank you Mou, You made my day!
March 14, 2011 at 12:16 pm
Yes, That was genius. almost bought a tear to my eye. You are a genuine GENIUS. Thank you. Take THAT!! Office Scan!! and like it.
August 31, 2011 at 8:40 pm
This is perfect. Works, unlike the older solutions.
November 17, 2011 at 11:46 pm
Hey. Thanks. All the ones above did not work for me and this is the only one that worked 🙂
November 27, 2011 at 2:17 pm
Im glad it worked for you.
September 10, 2012 at 7:34 pm
You Sir, saved my day!
December 17, 2013 at 6:47 pm
Mou,
the original password looks like “523F7D…”, i.e. not like “111…”. Why so?
December 29, 2011 at 6:07 pm
Worked on version 10 ! AWESOME !!!!!! Thanks a ton !
September 26, 2009 at 7:08 am
Thanks, it working properly. My Office scan client have been protected by IT administrator but I have already uninstalled it from my notebook. Thanks
October 11, 2009 at 10:41 pm
Hey Guys,
I have the latest upadated version of TM (as of this message), and the registry key solution worked. This thread was very helpfull ! Thanks Vinger and All !
October 15, 2009 at 11:32 am
vinger … thank you so much i have been working on this for last few days ..
November 11, 2009 at 10:14 am
Hey guys,
this little baby worked perfectly :
‘HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc’ and change ‘NoPwdProtect’ from ‘0′ to ‘1′.
good job
By the way, I was wondering is there a possibility to make full rights on a limited user ( by the IT guys ) without accessing the Admin account ? just curious …
November 29, 2009 at 5:04 am
Thanks Radu_Gabri3l!!!
Just set to 1…..
Cheers
December 22, 2009 at 10:34 pm
Great!
Thanks!!!!
December 22, 2009 at 12:39 pm
This works like a charm! Thanks!
February 2, 2010 at 8:16 am
Mou’s text from Jan 1, 2010 worked for me! Awesome.
February 22, 2010 at 3:49 pm
Mou’s text from Jan 1, 2010 was really awesome, thanks for the thread Mou
March 5, 2010 at 4:42 am
Mou, your MD5 hash was the ONLY thing that worked for me. Brilliant!
March 10, 2010 at 8:05 am
Thank you
it is working fine 😉
March 27, 2010 at 10:05 pm
how do you get internal errors to stop popping on the babydow website when you do certain things with the baby such as putting them to bed??!
please help!
March 29, 2010 at 9:47 am
Tee, I really have no idea. I would presume you should look for any Trend addons that could be running in your internet browser. Try disabling them. It is not advisable of course, but it is the only way I could think it may help.
June 6, 2010 at 12:11 am
As some of the other users have mentioned this hole seems to have been plugged in newer versions. If you are still having trouble try following my directions found here
http://samuelhaddad.com/2010/06/05/uninstall-trendmicro-officescan/
July 9, 2010 at 10:11 am
I got winpatrol from http://www.winpatrol.com/download.html ..and selected,,delete at boot time,,..so now the stupid OfficeScan is still here..but never loads …hahahaha….marvelous…
September 13, 2010 at 8:55 pm
Can not break the program when doing changes in the file You can not Alhvd in the same folder please help via email and thank you . x_heero@yahoo.com
March 1, 2011 at 6:00 pm
dear sir , it tech is not working for unloading this software , this is not working for uninstalling , Trend Micro™ Client/Server Security Agent 6.0
Service Pack 1 installed in system , kindly suggest what to do , also after installing this software by admin ,i cant download any video through any download kindly tell me what to do with this software .
your reply is very important .
thanks
March 2, 2011 at 9:36 am
can any one answer my questions????
April 1, 2011 at 2:00 pm
i want to acess optical drive and usb ports in trend micro office scan without administrator perimission as ti blocked by the server administrator so please give the registry keys for the same.
April 12, 2011 at 3:00 am
Sweet mother of jesus it worked.
I have tried your solution without success; listed below is my client section of the ofcscan.ini file
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=0
Client_Allow_Unload=0
#Uninstall_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
Uninstall_Pwd=70
Unload_Pwd=!CRYPT!523E8A9EF2689EAA9E7E300833D5B5E1C4A4626BD467E2638D045878322AAAE38B4B3948E0F0B1E08964662216C
UnloadProtect=1
Client_LocalServer_Port=24890
Filebase_Polling_Range=999
Show_Window_On_Multiple_Instances=1
ScanNetwork=0
ShellExtension=0
Client_Allow_Mobile=0
ForceUpdate=0
Interval=0
Client_Allow_Schedule_Update=1
Client_Allow_Update_Now=1
Client_Allow_Update_From_TMAU=1
Client_Allow_Update_From_OtherAU=0
Check_IP_Change_Interval=10
Client_Allow_Stop_Schedule_Scan=1
InstallCTA=0
RemoveCTA=0
Client_Security=1
ScheduleUpdateEnableDisable=1
NoProgramUpgrade=0
Enable_HIPS=1
Enable_HIPS_Popup_alert=1
RCS=0
Client_Allow_Delay_Schedule_Scan=0
AllowCfgNotification=0
EnableScheduleScanWarning=0
EnableVSTWarning=0
EnableVirEmailWarning=0
Reply
May 19, 2011 at 10:36 am
In my case, I don’t even have the “allowuninstall” value in the registry. I was able to go to regedit and go to the path mentioned above. However after reaching “Misc”, I see only “(Default)” in the right hand side pane. Should I just create “allowuninstall” key on the right hand side pane and then change the value to 1?
August 8, 2011 at 7:26 am
I have Tried 3 ways of Changing the passwords.
Version 10.5.1161
1> ofscan.ini > Uninstall_Pwd=70 (#Uninstall_Pwd above that line)
2> Regedit > Allow Uninstall “1” (Errored)
3> Uninstall_Pwd= !Crypt! “Hash Code”
So far nothing has worked, I have Discoonected from internet and cold boot my computer every attempt.
My current configure (unaltered)
[INI_CLIENT_SECTION]
Client_Use_HTTP=1
Client_Allow_Uninstall=1
Client_Allow_Unload=1
Uninstall_Pwd=!CRYPT!e8dc4081b13434b45189a720b77b6818
Unload_Pwd=!CRYPT!e8dc4081b13434b45189a720b77b6818
UnloadProtect=0
Client_LocalServer_Port=29210
Filebase_Polling_Range=360
Show_Window_On_Multiple_Instances=1
ScanNetwork=0
ShellExtension=0
Client_Allow_Mobile=0
ForceUpdate=0
Interval=0
Client_Allow_Schedule_Update=1
Client_Allow_Update_Now=1
Client_Allow_Update_From_TMAU=1
Client_Allow_Update_From_OtherAU=0
Check_IP_Change_Interval=180
Client_Allow_Stop_Schedule_Scan=0
InstallCTA=0
RemoveCTA=0
Client_Security=1
ScheduleUpdateEnableDisable=1
NoProgramUpgrade=0
Enable_HIPS=1
Enable_HIPS_Popup_alert=1
RCS=0
EnableVirEmailWarning=1
AllowCfgNotification=0
EnableScheduleScanWarning=0
Client_Allow_Delay_Schedule_Scan=1
AllowPromptRebootForCleanup=1
Correct me if I’m wrong would this program be integrated with webroot? Cause they started to block URL’s and I want to say its OfficeScan working with webroot.
September 29, 2011 at 8:36 am
I also had a !crypt! uninstall password and the normal =70 trick did not work.
Found another solution that works perfectly.
set the uninstall password to:
!CRYPT!523D617DF57CBF0E9ACD37611537EBB612F9B6F1C471EB529B89772E71AD9D2431BC212ACF23B7767831E317364
then the uninstall password will be “test”
October 27, 2011 at 3:19 pm
Chaos, that’s the only brilliant solution which worked for my 10.5 client. Thanks a million!!!
December 13, 2011 at 1:37 am
You just saved my butt. TY
January 20, 2012 at 6:09 am
Super, It s worked for me… Many Thanks.
February 15, 2012 at 8:13 pm
hallelujah! you r awesome
March 18, 2012 at 1:06 pm
can you please decode this text for me
523F5FBFBA9D22C438BADC542E01B00047EEC6EA82AC6EFAB2C030FCDEE91883014294DBEDC8CA5B79D49347032
January 7, 2012 at 5:15 pm
Thanks Chaos. This worked for me to 🙂 I did stumble on another password option here:
http://rslucan.wordpress.com/2011/04/05/unloading-officescan-10-5-by-changing-password-set/
Also, remember to change the unload/uninstall values to 1 in the ini file, mine were set to 0.
Nice!
Cheers,
Cleo
January 12, 2012 at 9:47 am
Chaos thanks for your solution.Perfect!!!
April 24, 2012 at 5:53 pm
Chaos, Congratulations! Its worked perfect! Great idea!
May 17, 2012 at 4:29 pm
Many Many thanks Chaos!!!! Works perfect!!!
June 18, 2012 at 12:55 am
Man, do I love you Chaos. I’ve been trying for weeks to move this little file to another place in order to be able to run a game, but stupid OfficeScan keeps saying it’s risky, and doesn’t allow me to open it, move it, delete it, copy it, anything at all. I read this whole page and tried everything and only yours worked. Thanks again, a LOT.
July 1, 2012 at 2:54 pm
{When I|After I} {originally|initially} {commented|left a comment} I {seem to have|appear to have} {clicked|clicked on} the -Notify me when new comments are added- checkbox {and now|and from now on} {each time a|every time a|whenever a} comment is added {I get|I recieve|I receive} {four|4} emails {with the same|with the exact same} comment. {Is there|Perhaps there is|There has to be} {a way|a means|an easy method} {you can|you are able to} remove me from that service? {Thanks|Many thanks|Thank you|Cheers|Thanks a lot|Appreciate it|Kudos}!
July 21, 2012 at 1:42 pm
This procedure doesn’t work, I tried it several times but with no use.
Do you know any other method that can remove this software?
Thanks in advance.
September 24, 2012 at 1:31 am
stop buying GMO foods from the supermarkets… stop taking vaccines and flu shots…. the American and European Government are SICK EVIL WAR CRIMINALS who inject toxic chemicals and poisons into our food supply
October 2, 2012 at 5:20 am
Thanks it works for me.
November 16, 2012 at 10:28 pm
An easy but brutal and effective method. Start PC from a ERD commander. Delete folder with trend micro and also go into services and disable officescan. Start windows again. problems solved. You may want to run a registry clean to remove entries. Works for me since my school don’t push install again. Trend officescan is worse than a virus.
December 19, 2012 at 7:33 pm
i am anable to change ofcscan.ini file as in my pc it may be protected can any one give me some other solution and its not allowing to change registry settings of trend micro.
plz help me
January 24, 2013 at 3:22 pm
For Un-install without PW use: “%PROGRAMFILES%\Trend Micro\OfficeScan Client\NTRmv.exe –980223”
February 23, 2013 at 6:36 pm
Setting the unload and/or uninstall to the !CRYPT! did the trick !
set the uninstall password to:
!CRYPT!523D617DF57CBF0E9ACD37611537EBB612F9B6F1C471EB529B89772E71AD9D2431BC212ACF23B7767831E317364
then the uninstall password will be “test”
Thanks a lot !!
May 26, 2013 at 9:43 pm
Great Thx For your support
you are Genius
change crypt and password “test”
Thx again
July 21, 2013 at 5:58 pm
Some patients feel soreness at the site of the symptom
but not the least of which is waking up to lower window replacement jacksonville fl.
To reduce and eliminate your window replacement jacksonville fl.
Backpain may be caused from a variety of reasons, lower window replacement jacksonville fl accounts for
more sick leave taken than any other country.
September 5, 2013 at 1:25 am
good stuff, thanks mate