[JeffMellinge]

I've already tried uninstalling it, you told me to awhile ago. But my windows uninstaller doesn't work. It gives me that "windows installer could not be accessed, contact support personnell to verify that WI service is properly registered." message.
Is there any way I can uninstall Trend Micro without using windows uninstaller?
what can I do?
thanks
jeff
by the way, I've tried to update windows installer, but because I have SP1 and not SP3 installed, it won't let me. The reason I got rid of SP3 is because the last time my computer messed up this bad, it was SP3's fault. It took 20-30 minutes to boot up my computer and there were ALL sorts of problems. So I had to roll back to SP1.

[Rollin' Rog]

Sorry, forgot the history of the thread.

What version is it, perhaps we can find some manual uninstall instructions that will be sufficient?

Also, I don't know if it is still the case, but I believe they used to be one of the few AV companies that still provided free phone support ...

Here are some for the 2003 version:

http://kb.trendmicro.com/solutions/s...lutionID=15504

[JeffMellinge]

Trend Micro(TM) PC-cillin(TM) Antivirus 2004
(Build 2006, Version 11.26)

[Rollin' Rog]

Not sure if this is the same:

http://kb.trendmicro.com/solutions/s...c=17018&sort=0

[JeffMellinge]

Ok I was able to delete most of them. However, I'm not sure how to delete the following:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

* pccguide.exe
* PCCCIOMON.exe
* PCCClient.exe
* TM Outbreak Agent

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

PCCIOMON.exe

[HKEY_LOCAL_MACHINE\System\CurrentControlSet]

* PCCPFW
* TM_CFW
* Tmfilter
* Tmntsrv
* Tmpreflt
* tmproxy
* tmtdi
* Vsapint

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog]

Trend Realtime Service

i didn't see any of those things in there.
jeff

I used the FIND command in regedit to search for some of those things and it found a lot of them, but not in the same place the help page said they were.

I also found this:
http://kb.trendmicro.com/solutions/s...c=21060&sort=0
and I did the Force Uninstall. It worked, so now I will wait for your reply on the above registy stuff and then reboot.

[Rollin' Rog]

If you can't find those items using regedit and manually navigating to those keys -- then they have either been deleted or not present.

I would expect PCCTool.exe, if it was present on the system, to do an adequate if not thorough job of removal.

[JeffMellinge]

From the RKR webpage: "We've therefore updated RootkitRevealer to execute its scan from a randomly named copy of itself that runs as a Windows service."

You have detritus from earlier RKR failures. To remove, either edit the registry or open a CMD shell and, for each leftover service, carefully type:

SC DELETE service_name

e.g. SC DELETE IQNNWZID

[Rollin' Rog]

Ah, must be an update from the early version that I tested.

Any problems following their directions?

And have you tested things after the Trend uninstall?

[JeffMellinge]

Reboot gave the same error as before. I don't think that the force uninstall did enough. THe entire Trend Micro program is still on the hard drive. Like I said before, I did a Find in Regedit and it found a lot of the stuff I couldn't find, there are folders for TMfilter, TMNTsrv, TMproxy, TMtdi, VSApint
they are under Local Machine/System/ControlSet1/Services
should I delete them?
How do I get rid of all the Trend MIcro stuff in the Trend Micro folder on my hard drive?
jeff

[Rollin' Rog]

Does the error reference the same driver and is it still the Driver Verifier error? The Stop 0x000000C4 should carry a driver reference.

You can simply send to the recycle bin any remaining Trend folders or drivers, but none of it should be loading without their registry call ups.

Since the driver you mentioned is listed here, make sure it and the others are deleted as well:

http://kb.trendmicro.com/solutions/s...lutionID=15504

The active startup services will be in the unnumbered CurrentControlSet key (it has a mirrored numbered key whose number varies, when you delete entries in one you automatically delete those in the other; the other two CCS keys include a "failed" one and a backup used for Last Known Good Configuration -- it's best to leave that alone.).

You can verify that all active Trend Services have been removed by running services.msc and checking to see if they are still there. You also simply set the startup modes to disable if you were having trouble finding any.

[JeffMellinge]

Ok, finished deleting registry entries that I know of. Sent everything else to recycle bin. Same BSoD errors. 000000c4 with no name of driver listed.
Event Viewer lists nothing new in the System part but here is what is in the APplications part:
Event Type: Error
Event Source: PerfDisk
Event Category: None
Event ID: 1000
Date: 10/28/2005
Time: 3:56:27 PM
User: N/A
Computer: FPST-COMPUTER
Description:
Unable to open the Disk performance object. Status code returned is data DWORD 0.
Data:
0000: 70 10 00 00 p...
p...


Event Type: Error
Event Source: rasctrs
Event Category: None
Event ID: 2001
Date: 10/28/2005
Time: 3:56:28 PM
User: N/A
Computer: FPST-COMPUTER
Description:
The description for Event ID ( 2001 ) in Source ( rasctrs ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: .

Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 37
Date: 10/28/2005
Time: 3:56:28 PM
User: N/A
Computer: FPST-COMPUTER
Description:
WMI ADAP was unable to load the winspool.drv performance library due to an unknown problem within the library: 0x0

Event Type: Error
Event Source: perfctrs
Event Category: None
Event ID: 3101
Date: 10/28/2005
Time: 3:56:29 PM
User: N/A
Computer: FPST-COMPUTER
Description:
Unable to read IO control information from NBT device.

these seem to happen on every startup.
Also, in MSconfig, I still have it on Selective Startup with only the System Services and Startup Services booting.

[Rollin' Rog]

I don't believe any of those application errors are show stoppers. They appear to result from some problem with performance monitoring which you would have had to manually initiate at some time.

A possible MS error reference here:

http://support.microsoft.com/default...b;en-us;811089

If Driver Verifier is not producing a driver in its error, let's disable it.

From Start > Run, enter:

verifier /reset

reboot and see if the error changes.

[JeffMellinge]

Exact same error.

[Rollin' Rog]

Sheesh, if it's the driver verifier error, I don't understand how it could still run.

Try this instead, run verifier and in the user interface, check "delete existing settings" -- then select finish.

And are the error parameters the same as before:

(0x00000000, 0x00000001, 0x00000000, 0x00000001)

Those are very strange, as they do not show any actual addresses.

I don't think we've entirely ruled out ram -- since there is the possiblity that you cold have two bad sticks.

You might also want to try running chkdsk on the drive. This can be run from a command line (start > run: cmd) or by right clicking on the local drive in My Computer and selecting Properties > Tools > Error checking.

[JeffMellinge]

Chkdisk found nothing.
I reset all the settings in verifier. After reboot, our old friend KMODE returned. This time with a different set of parameters:
0x00000001E (0xC0000005, 0x81A5FC85, 0x00000000, 0x0000F6F0)
no driver listed.
jeff