I have recently needed to replace the current antivirus on all the workstations at a site. The installed antivirus was Trend WFBS and removal is normally simple except under a few situations.

The first issue is very simple the system is offline. Now all you can do is turn it on and remove it, nothing interesting here unless you are not in the office and doing this remotely.

The second issue is roaming systems, Trend does not let you send commands to a system that is roaming so this will be a small problem if the system never come back to the office.

The third issue is that Trend will not uninstall an agent if Internet Explorer is open on the system. This issue might be simple call the user tell them to close IE and issue the command again. The problem is that the Trend console does not tell you that it had an error uninstalling from the system.

I was able to solve both issue two and three using Kaseya, the management tool that we have installed on all the systems we manage. This was done simply with a custom procedure.

• Close Internet Explorer, and Firefox.
• Set the registry key “HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\Allow Uninstall” to the value “1” permitting uninstall without entering the admin password.
• Run the uninstall agent “C:\Program Files (x86)\Trend Micro\Client Server Security Agent\NTRmv.exe”

After this has run I can now install the new antivirus on the systems, I recommend using Kaseya’s implementation of Kaspersky if you are able.

I have attached the procedure for anyone that wish to have a copy of the procedure.
Procedure Remove Trend Micro Client-Server Security