This script will completely remove Trend Micro security from the Mac
We saw that the official uninstaller didn't completely remove all components.
Newer versions might work but this script works for us anyway.
#!/bin/sh # Copyright: EVRY # Filename: UninstallTrend.sh # Requires: - # Purpose: Removes Trend Micro Security # Contact: Anders Holmdahl <email@example.com> # Mod history: 2018-01-31 launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist rm /Library/LaunchDaemons/com.trendmicro.* rm -r "/Library/Application Support/TrendMicro" rm -r /Library/Frameworks/TMAppCommon.framework rm -r /Library/Frameworks/TMAppCore.framework rm -r /Library/Frameworks/TMGUIUtil.framework rm -r /Library/Frameworks/iCoreClient.framework rm -r /Applications/TrendMicroSecurity.app killall -kill TmLoginMgr killall -kill UIMgmt exit 0
Thanks for the basics of this script. Needed to do this since the latest version of the Trend installer isn't signed nor notarized. I added a few more lines for the extra components that are part of Trend Micro Apex One now.
launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.ec.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.main.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.misc.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.wp.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist launchctl unload /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist sleep 1 rm /Library/LaunchDaemons/com.trendmicro.* rm -rf "/Library/Application Support/TrendMicro" rm -rf /Library/Frameworks/TMAppCommon.framework rm -rf /Library/Frameworks/TMAppCore.framework rm -rf /Library/Frameworks/TMGUIUtil.framework rm -rf /Library/Frameworks/iCoreClient.framework rm -rf /Applications/TrendMicroSecurity.app rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.ec.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.main.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.misc.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.wp.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist rm -rf /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist killall -kill TmLoginMgr killall -kill UIMgmt
There's still a few minor pieces left, like in ~/Library/LaunchAgents but doesn't seem to harm anything. I also decided to leave the pieces that dealt with encryption just in case it would cause the user to get locked out of the computer.
As far as I know, it still does the trick. Sometimes you have to boot into Safe Mode to get rid of it. As long as it isn't throwing kernel panics after a major upgrade, I don't hear many complaints.