Skip to main content
Question

Uninstall Trend Micro Security script

A
Forum|alt.badge.img+6

This script will completely remove Trend Micro security from the Mac
We saw that the official uninstaller didn't completely remove all components.
Newer versions might work but this script works for us anyway.

#!/bin/sh


# Copyright:       EVRY
# Filename:        UninstallTrend.sh
# Requires:        -
# Purpose:         Removes Trend Micro Security
# Contact:        Anders Holmdahl <anders.holmdahl@evry.com>
# Mod history:    2018-01-31

launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm /Library/LaunchDaemons/com.trendmicro.*
rm -r "/Library/Application Support/TrendMicro"
rm -r /Library/Frameworks/TMAppCommon.framework
rm -r /Library/Frameworks/TMAppCore.framework
rm -r /Library/Frameworks/TMGUIUtil.framework
rm -r /Library/Frameworks/iCoreClient.framework
rm -r /Applications/TrendMicroSecurity.app

killall -kill TmLoginMgr
killall -kill UIMgmt

exit 0
daniel_ross
1 person likes this
  • daniel_ross
    daniel_ross

7 replies

M
Forum|alt.badge.img+7
  • mack525
  • Contributor
  • 91 replies
  • September 19, 2018

This works like a charm @AHolmdahl Thank you!

A
Forum|alt.badge.img+1
  • alexa_123
  • New Contributor
  • 5 replies
  • December 11, 2018

here is one more way to uninstall TrendMicro on a Mac - https://nektony.com/how-to/how-to-uninstall-trend-micro-antivirus

H
Forum|alt.badge.img+8
  • homepup
  • Contributor
  • 18 replies
  • July 19, 2021

Thanks for the basics of this script. Needed to do this since the latest version of the Trend installer isn't signed nor notarized. I added a few more lines for the extra components that are part of Trend Micro Apex One now.

launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.ec.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.main.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.misc.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.wp.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist launchctl unload /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist launchctl unload /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist sleep 1 rm /Library/LaunchDaemons/com.trendmicro.* rm -rf "/Library/Application Support/TrendMicro" rm -rf /Library/Frameworks/TMAppCommon.framework rm -rf /Library/Frameworks/TMAppCore.framework rm -rf /Library/Frameworks/TMGUIUtil.framework rm -rf /Library/Frameworks/iCoreClient.framework rm -rf /Applications/TrendMicroSecurity.app rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.av.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.ec.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.main.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.misc.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.wp.plist rm -rf /Library/LaunchDaemons/com.trendmicro.icore.xdr.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmes.plugin.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.monitor.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.plugin.plist rm -rf /Library/LaunchDaemons/com.trendmicro.tmsm.rpd.plist rm -rf /Library/LaunchAgents/com.trendmicro.TmLoginMgr.plist killall -kill TmLoginMgr killall -kill UIMgmt

There's still a few minor pieces left, like in ~/Library/LaunchAgents but doesn't seem to harm anything. I also decided to leave the pieces that dealt with encryption just in case it would cause the user to get locked out of the computer. 

A
1 person likes this
  • A
    am79
S
Forum|alt.badge.img+11
  • swapple
  • Valued Contributor
  • 164 replies
  • April 5, 2022

Is this still current?

H
Forum|alt.badge.img+8
  • homepup
  • Contributor
  • 18 replies
  • April 5, 2022
swapple wrote:

Is this still current?


As far as I know, it still does the trick. Sometimes you have to boot into Safe Mode to get rid of it. As long as it isn't throwing kernel panics after a major upgrade, I don't hear many complaints.

R
Forum|alt.badge.img+3

Hi All,

 

Does this script need to be converted to a package / configuration file before being uploaded to jamf?

 

Best,

Ralston

H
Forum|alt.badge.img+8
  • homepup
  • Contributor
  • 18 replies
  • August 24, 2023
Ralston_Africa wrote:

Hi All,

 

Does this script need to be converted to a package / configuration file before being uploaded to jamf?

 

Best,

Ralston


Should be able to just import it as a script into Jamf and then you can scope the policy to either auto deploy or make it a button in Self Service.

Reply


Most helpful members this week

Terms & ConditionsCookie settingsAccessibility statement

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings