Uninstall Trend Micro Security script

[AHolmdahl]

This script will completely remove Trend Micro security from the Mac
We saw that the official uninstaller didn't completely remove all components.
Newer versions might work but this script works for us anyway.

#!/bin/sh


# Copyright:       EVRY
# Filename:        UninstallTrend.sh
# Requires:        -
# Purpose:         Removes Trend Micro Security
# Contact:        Anders Holmdahl <anders.holmdahl@evry.com>
# Mod history:    2018-01-31

launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm /Library/LaunchDaemons/com.trendmicro.*
rm -r "/Library/Application Support/TrendMicro"
rm -r /Library/Frameworks/TMAppCommon.framework
rm -r /Library/Frameworks/TMAppCore.framework
rm -r /Library/Frameworks/TMGUIUtil.framework
rm -r /Library/Frameworks/iCoreClient.framework
rm -r /Applications/TrendMicroSecurity.app

killall -kill TmLoginMgr
killall -kill UIMgmt

exit 0

[mack525]

This works like a charm @AHolmdahl Thank you!

[alexa_123]

here is one more way to uninstall TrendMicro on a Mac - https://nektony.com/how-to/how-to-uninstall-trend-micro-antivirus

[homepup]

Thanks for the basics of this script. Needed to do this since the latest version of the Trend installer isn't signed nor notarized. I added a few more lines for the extra components that are part of Trend Micro Apex One now.

launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.ec.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.main.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.misc.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.wp.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist

launchctl unload /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist

sleep 1

rm /Library/LaunchDaemons/com.trendmicro.*
rm -rf "/Library/Application Support/TrendMicro"
rm -rf /Library/Frameworks/TMAppCommon.framework
rm -rf /Library/Frameworks/TMAppCore.framework
rm -rf /Library/Frameworks/TMGUIUtil.framework
rm -rf /Library/Frameworks/iCoreClient.framework
rm -rf /Applications/TrendMicroSecurity.app

rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.ec.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.main.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.misc.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.wp.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist

rm -rf /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist


killall -kill TmLoginMgr
killall -kill UIMgmt

There's still a few minor pieces left, like in ~/Library/LaunchAgents but doesn't seem to harm anything. I also decided to leave the pieces that dealt with encryption just in case it would cause the user to get locked out of the computer. 

[swapple]

Is this still current?

[homepup]

As far as I know, it still does the trick. Sometimes you have to boot into Safe Mode to get rid of it. As long as it isn't throwing kernel panics after a major upgrade, I don't hear many complaints.

[Ralston_Africa]

Hi All,

Does this script need to be converted to a package / configuration file before being uploaded to jamf?

Best,

Ralston

[homepup]

Should be able to just import it as a script into Jamf and then you can scope the policy to either auto deploy or make it a button in Self Service.