Manually Applying Updates to Trend IMSVA

Whenever Trend issues an update for these virtual machines the GUI interface isn't always able to apply the patches to the VM.

 This is where a bit of time and patience have to come in to get them updated. Below is how I get it done quickly without much headache to keep these VMs current.

1. Download the patch or hot fix to your computer (Ex: imsva_90_en_criticalpatch1560.zip).

2. Extract the file.  You'll see a couple of files extracted such as readme_en.txt and imsva_90_en_criticalpatch1560.tar.gz listed.

3.  Use a program to upload the files to the IMSVA virtual machine.  I choose to use WinSCP.  Upload the file to the /tmp folder.

4.  Login to the IMSVA using root privilege using Putty or another program via SSH.  NOTE: You have to use SCP on WinSCP as the protocol and the root account for the VM.  If not it won't connect with the standard "admin" and password the web browser login uses.

5.  Run the following commands:

   # tar -zxvf /tmp/imsva_90_en_criticalpatch15160.tar.gz -C /tmp
   # cd /tmp/imsva_90_en_criticalpatch15160
   # ./imssinst

6.  Allow the installation to run and when the install completes you'll see something similar to this:

   Installation is complete and related services are started.

Just a note when you are done you can delete both the *.tar.gz file and the folder it created off of the IMSVA virtual machine to save space.

Login to the web interface and verify with the "About" option the new build version of your IMSVA.

I have found that not every hot fix or patch raises the build level in the web interface but if you try to apply it again to the IMSVA you'll find out it has already been installed.

For those of you that are not great in the Linux/Unix world I hope these instructions help you keep your critical infrastructure system patched and up to date.

It's Friday afternoon now so I hope you all have a great weekend.

Manually Uninstalling Trend Micro Officescan

Trend Micro OfficeScan is normally deployed in corporate network environment to provide endpoint security. Administrators can remotely uninstall the Office Scan client, and user at the workstation can uninstall the client program using built-in uninstall mechanism too (i.e. Add and Remove Program in Control Panel). If for some reason, the Office Scan client cannot or unable to uninstall, or user doesn’t have the required password to remove the OfficeScan client, try the following workaround to manually uninstall and remove Trend Micro OfficeScan.

1.  Go to Control Panel Services (services.msc), and stop the following services:

• OfficescanNT Listener
• OfficescanNT RealTimeScan
• OfficeScanNT Personal Firewall (if enabled)

2.  Run Registry Editor (regedit.exe).

3.  Navigate to the following registry key hive:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

4.  Delete the following keys (if available):

• Ntrtscan
• Tmlisten
• TmFilter
• VSApiNt
• TMPreFilter
• TM_CFW
• OfcPfwSvc

5.  Navigate to the following registry hive:
HKEY_LOCAL_MACHINE \SOFTWARE\TrendMicro or HKEY_LOCAL_MACHINE \SOFTWARE \Wow6432Node\TrendMicro (in 64-bit Windows operating system)

6.  Delete the following keys (if available):

• OfcWatchDog
• Pc-cillinNTCorp or OfficeScanCorp (depends on the client)
• RemoteAgent
• PC-cillin
• CFW

7.  Browse to the following registry key hive:
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft\Windows\CurrentVersion\Run

8.  Delete the OfficeScanNT Monitor key.

9.  Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

10.  Delete the OfficeScanNT key.

11.  Delete the OfficeScan program group (Trend Micro OfficeScan Client) from the Windows Start menu.

12.  Restart the computer.

13.  Delete the directories that contain the OfficeScan Client program files, normally located inside Program Files folder.

NOTE:  The above steps work for OfficeScan 7.x client in Windows 2003/XP/2000/NT/Vista/2008 machine. 

For Trend Micro OfficeScan Corporate Edition (OSCE) – 5.58, OfficeScan Corporate Edition (OSCE) – 6.5, Client / Server / Messaging Suite for SMB – 2.0, follow these manual uninstallation steps instead.

1.  Delete the Trend Micro OfficeScan Client program shortcut in Start Menu, by right click on it and then choose Delete.

2.  Delete the installed files located in the OfficeScan folder under the \Program Files\Trend Micro\OfficeScan Client directory.

3.  Open the Registry Editor (regedit).

4.  Navigate to the following registry key:
HKEY_LOCAL_MACHINE\Software\TrendMicro

5.Delete the following keys:

• OfcWatchDog
• PC-cilling
• PC-cillingNTCorp

6.  Also delete the following registry hives:
◦HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeScanNT Monitor
◦HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT
◦HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ntrtscan
◦HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmfilter
◦HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmlisten
◦HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmPreFilter (for Win2003)
◦HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSApiNt

7.  Right click on My Computer, click Manage and then select Device Manager.
 

8.  Enable the Show Hidden Devices option.
 

9.Remove the following hidden devices in Non-Plug and Play Drivers tree pertaining to OfficeScan (right-click and select Uninstall):

• Trend Micro VSAPI NT
• Trend Micro FILTER
• Common Firewall Driver
• NTRTSCAN (if available)
• TMLISTEN (if available)

10.Restart the OfficeScan client machine.

This has worked for me each and every time I have had to do a manual removal.  Good luck.