Uninstall Trend Micro Security script

AHolmdahl
New Contributor III

This script will completely remove Trend Micro security from the Mac
We saw that the official uninstaller didn't completely remove all components.
Newer versions might work but this script works for us anyway.

#!/bin/sh


# Copyright:       EVRY
# Filename:        UninstallTrend.sh
# Requires:        -
# Purpose:         Removes Trend Micro Security
# Contact:        Anders Holmdahl <anders.holmdahl@evry.com>
# Mod history:    2018-01-31

launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm /Library/LaunchDaemons/com.trendmicro.*
rm -r "/Library/Application Support/TrendMicro"
rm -r /Library/Frameworks/TMAppCommon.framework
rm -r /Library/Frameworks/TMAppCore.framework
rm -r /Library/Frameworks/TMGUIUtil.framework
rm -r /Library/Frameworks/iCoreClient.framework
rm -r /Applications/TrendMicroSecurity.app

killall -kill TmLoginMgr
killall -kill UIMgmt

exit 0
7 REPLIES 7

mack525
Contributor II

This works like a charm @AHolmdahl Thank you!

alexa_123
New Contributor

here is one more way to uninstall TrendMicro on a Mac - https://nektony.com/how-to/how-to-uninstall-trend-micro-antivirus

homepup
New Contributor III

Thanks for the basics of this script. Needed to do this since the latest version of the Trend installer isn't signed nor notarized. I added a few more lines for the extra components that are part of Trend Micro Apex One now.

launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.ec.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.main.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.misc.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.wp.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist
launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist

launchctl unload /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist

sleep 1

rm /Library/LaunchDaemons/com.trendmicro.*
rm -rf "/Library/Application Support/TrendMicro"
rm -rf /Library/Frameworks/TMAppCommon.framework
rm -rf /Library/Frameworks/TMAppCore.framework
rm -rf /Library/Frameworks/TMGUIUtil.framework
rm -rf /Library/Frameworks/iCoreClient.framework
rm -rf /Applications/TrendMicroSecurity.app

rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.ec.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.main.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.misc.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.wp.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist
rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist

rm -rf /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist


killall -kill TmLoginMgr
killall -kill UIMgmt

There's still a few minor pieces left, like in ~/Library/LaunchAgents but doesn't seem to harm anything. I also decided to leave the pieces that dealt with encryption just in case it would cause the user to get locked out of the computer. 

swapple
Contributor III

Is this still current?

homepup
New Contributor III

As far as I know, it still does the trick. Sometimes you have to boot into Safe Mode to get rid of it. As long as it isn't throwing kernel panics after a major upgrade, I don't hear many complaints.

Ralston_Africa
New Contributor

Hi All,

 

Does this script need to be converted to a package / configuration file before being uploaded to jamf?

 

Best,

Ralston

Should be able to just import it as a script into Jamf and then you can scope the policy to either auto deploy or make it a button in Self Service.