Trend Micro Office Scan Password

[jbclarkman]

I am looking for a way to remove trend micro office scan from a clients computer. We just bought them out and now need to remove it/ uninstall it and you can't do so without a password. anyone know how to remove the password?

[helplesslyhopin]

from this link..
http://uwadmnweb.uwyo.edu/ASKIT/faqs...icescanfaq.htm

under the title "Why does OfficeScan prompt me for a password when it is uninstalling? "

you'll read this.. I hope it helps..

OfficeScan contains an undocumented bug, where an uninstall password is sometimes required. The problem occurs when the OfficeScan client cannot communicate with the server to determine if an uninstall is password protected or not. The client application resorts to using the initial password set for the OfficeScan Management Console during the server installation process.

If you initially installed OfficeScan 3.x, the uninstall password is newHouse (note the capital H).
If you initially installed OfficeScan 5.x, the uninstall password is password.

[jbclarkman]

found that earlier. Doesn't work unfortunatly :'(
I also seached the reg for anything that may hint a password but got nothing.

any other help?

[helplesslyhopin]

hmmm.. oh well..

you didn't offer up that info in your post. it might have saved me/others more time.

what version is it ?

maybe contacting trendmicro would be best if this is a corporate situation.

sorry.. I'm outta time for searching around.. my kid is kicking me off the computer..LOL.

[jbclarkman]

version: 5.1.2600

unfortunatly I do not have the time to contact Trend Micro systems. I need this asap

[nihil]

Well there are two possibilities I can think of:

1. Try uninstalling from within Windows, rather than the application itself.

2. Delete the folder in which it resides then run a registry cleaner to get rid of the (now) orphan entries.

Just a thought

[lepricaun]

run msconfig and deny the services from officescan from starting up (this is tmlisten and the other ones).

try uninstalling it now by removing the folder.

if this doesn't work, then there is one thing you might be able to do, and that's cracking (reverse engineering) the pcNTmon.exe file (if i'm correct, this has a hash of the pasword stored in it).
i've been working on it once, but i know to little of assembly to really solve the problem.

but i think removing the folder by first preventing the services from starting up should do the trick

[jbclarkman]

I found the answer:

To uninstall the officescan client without the password, you will have to go into the registry.

Navigate through HKEY_local_machine>software>trendmicro>pc-cillinNTcorp>currentversion>misc.

Look for the key "allowuninstall"

Change the value of that to 1.

Exit the registry.

Now try running the uninstallation again.


To reset the console password, it really depends on the program version but still let me give you a procedure that you can try.

On the server, open the ofcscan.ini file.

Locate the parameter "master_pwd".

Delete everything to the right of the equal sign.

Replace it with 70.

Save the ini file.

Restart the officescan master service.


note: if you are using officescan version 6.5, there is another ini in the "private" folder which you need to edit. The name of the ini file is Ofcmaster.ini. Open it and look for the same parameter and change its value to 70 also. Save before you restart the officescan master service.

Try loging in with the password of 1.