Endpoint Protection

SEP12.1 can not use the SEPprep.exe uninstall the TrendMicro Officescan 10.5

 SEPprep.exe version = 1.09

Client OS = Windows 7 Enterprise 32 bit 

I need a little bit more data to help you out here.  I have worked with other people who have successfully removed Trend Micro Officescan 10.5.

Does this happen only on one system or on all your systems running Trend Micro?

Do you have Trend Micro's uninstall password set?

Have you tried using Trend Micro's uninstaller manually to see if the uninstaller is functioning correctly?

What are the symptoms, do you get any error messages, can you better describe what is happening?

Can you send me the SEPprep.log file?

Thanks,
Elisha

Does this happen only on one system or on all your systems running Trend Micro?

All our sytem.

Do you have Trend Micro's uninstall password set?

Yes.We set the Trend Micro's uninstall password

Have you tried using Trend Micro's uninstaller manually to see if the uninstaller is functioning correctly?

Yes.We can uninstall the Officescan 10.5 from Add/Remove programs.

What are the symptoms, do you get any error messages, can you better describe what is happening?

Using SEPprep.exe and we can install the SEP 12.1 but Officescan 10.5 still stay on system.

Can you send me the SEPprep.log file?

By default SEPprep cannot remove a product if the uninstall password is set.  However, there are a couple of options you have:

1. Disable the uninstall password in Trend Micro before running SEPprep.

2. If there is some command that can be run to disable the uninstall password you can launch this command automatically from SEPprep prior to uninstalling Trend Micro using the "RunBeforeRemoval=" option in the SEPprep.ini file.  For example with some AV products you can run a command to delete a registry key that will remove the uninstall password.

3. If Trend Micro supports sending the password via a command line interface (CLI) you can use SEPprep to send the command via the "RunBeforeRemoval=" or the "DefaultExtraParameters=" option in SEPprep.ini file.

Refer to the SEPprep.pdf help file for more details on how to use these options.

Thanks a lot.

I use the DefaultExtraParameters=password="xxxxxx" still can not uninstall the Officescan 10.5.

Anybody knows how to add the delete uninstall password registry script?

Have u tried this?

‘HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc’ and change ‘NoPwdProtect’ from ‘0′ to ‘1′.

You can do this through SEPprep.ini by adding this line:

 RunBeforeRemoval=reg add "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc" /v NoPwdProtect /t REG_DWORD /d 1 /f 

Thanks for your reply.

But I got the result below.

Computer Name: WINDOWS7
09/28/2011 13:15:54:530 SEPprep starting!
09/28/2011 13:15:56:622 Attempting to run: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc." /v NoPwdProtect /t REG_DWORD /d 1 /f
09/28/2011 13:15:56:716 Exit code: 1
09/28/2011 13:15:57:200 Symantec Endpoint Protection is NOT installed.
09/28/2011 13:15:57:200 SEPprep stopping! 

Thanks for your reply.

But I got the result below. 

 But I got the result belowThanks for your reply.But I got the result below.Computer Name: WINDOWS7
09/28/2011 13:15:54:530 SEPprep starting!
09/28/2011 13:15:56:622 Attempting to run: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc." /v NoPwdProtect /t REG_DWORD /d 1 /f
09/28/2011 13:15:56:716 Exit code: 1
09/28/2011 13:15:57:200 Symantec Endpoint Protection is NOT installed.
09/28/2011 13:15:57:200 SEPprep stopping!Thanks for your reply.But I got the result below.Computer Name: WINDOWS7
09/28/2011 13:15:54:530 SEPprep starting!
09/28/2011 13:15:56:622 Attempting to run: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc." /v NoPwdProtect /t REG_DWORD /d 1 /f
09/28/2011 13:15:56:716 Exit code: 1
09/28/2011 13:15:57:200 Symantec Endpoint Protection is NOT installed.
09/28/2011 13:15:57:200 SEPprep stopping!

smiliar to Tamper protection in SEP in you might have something in Office Scan, disable that, once u r able to make changes in reg, u should be able to remove it..

I found the [TMBMServer service (it protect the officescan to be modified)] in the SERVICE.

I can not stop it.And I also found I can not modify the [Allow Uninstall] or [NoPwdProtect] registry via windows registry edit UI.

I try unload the officescan by typing the password,then the TMBMServer service stop and I can modify the [Allow Uninstall] or [NoPwdProtect] registry via windows registry edit UI.

But I run the SEPPrep.exe still fail.

Exit code: 1
 

Computer Name: WINDOWS7
09/28/2011 15:46:12:509 SEPprep starting!
09/28/2011 15:46:13:887 Attempting to run: reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
09/28/2011 15:46:14:231 Exit code: 0
09/28/2011 15:46:14:748 Attempting to run: reg add HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc. /t REG_DWORD /v "Allow Uninstall" /d 1 /f RUNASADMIN
09/28/2011 15:46:14:842 Exit code: 1
09/28/2011 15:46:14:857 Attempting to run: reg add HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc. /t REG_DWORD /v NoPwdProtect /t REG_DWORD /d 1 /f
09/28/2011 15:46:14:967 Exit code: 1
09/28/2011 15:46:15:906 Symantec Endpoint Protection is NOT installed.
09/28/2011 15:46:15:937 SEPprep stopping!

Yes.The TMBMServer service work to protect the officescan.

If this service on,we can not modify officescan registry via registry edit UI.

We must uoload the officescan,but unload it must type the password.

We try to type the password to unload it.

But run the SEPPrep.exe still fail.

I also found SEPPrep.exe can not uninstall the Officescan 10.5 (even no password protected)

From the log file it looks like the issue is that SEPprep is not detecting Trend Micro.

1. Open the Add/Remove Programs from the Control Panel and check what name is being used for the TrendMicro product.  Please let me know what the name listed there.

2. Can you give me the full version number of SEPprep you are using?  You can see this by going to the file properties of SEPprep.exe.  It should look something like 1,0,0,9f

3. Can you validate that you are using the correct bit rate of SEPprep?  If you are running this on a 64bit OS you should use the SEPprep64.exe tool.

I have also attached the documentation which talks about how SEPprep detects products.  You can modify the SEPprep.ini file (as described in the attached document) to allow it to detect other products.

Thanks.

Attachment(s)

SEPprep_0.pdf   393 KB 1 version

Thanks for your reply.

I checked the Officescan name in the Add/Remove Programs from the Control Panel and found the mane is "趨勢科技 Officescan 用戶端".

I wrote it to the SEPPrep.ini.

I also removed all the [reg add ......].

Then I run the [SEPprep.exe] and the Officescan 10.5 was remved successfully.

Thanks for your support.