Jump to content

ESET AVR can't remove Trend Micro OfficeScan


da_yoshman

Recommended Posts

I'm in the process of migrating 1.000+ Clients from Trend Micro OfficeScan to ESET and at the moment it is nearly impossible to remove Trend Micro in an easy way :( The only working way at the moment is to trigger an uninstallation from the webinterface of Trend Micro :( Because all the silent things with ntremove are not working for me :(

So i created an AiO with AVR, but the included AVR doesn't remove Trend Micro because it is unsupported. So i tried the standalone AVR and this version can remove the Trend Micro - but how combine these to things? Or is it possible to use the AVR with silent parameters? Because then i can first remove Trend Micro with the standalone AVR and after that install the AiO ...

PS: Wanna do all these things with PDQ

Link to comment
Share on other sites

  • ESET Staff

@da_yoshman From which version of ERA you have created the AiO? Is it already V7 of ESMC, or you are still using ERA 6.5? I will check, what´s the reason that you do not get the latest AV remover package in the AiO. 

Link to comment
Share on other sites

@MichalJ At the moment i'm still using ERA 6.5, because i'm afraid of updating to v7 :) There were and are 500+ on the existing ERA 6.5 Installation and i "only" want to add the other 1.000+ which are using Trend Micro at the moment

Link to comment
Share on other sites

  • ESET Staff

I have checked. The EPI build in the ERA 6.5 is quite old and the functionality to update its contents via our repository, including the AVR functionality was added in V7.

In the V7, we have a newer AiO (internally called EPI), which includes a newer version of AV Remover and are also able to release an updated version, which then gets downloaded upon generating the AIO package.

I will check with devs, whether the one in current V7 will be able to remove the specific version of Trend Micro Office Scan. Can you please post a specific version of TM product you are running?

PS: Please note, that you can still operate 6.5 agents, with 7.0 server. Is the ESET Management agent already deployed on the machines with Trend Micro?

Link to comment
Share on other sites

Here are my answers :)

1. Installed Trend Micro Versions including number of installations --> 11.0.4664 = 1; 11.0.4778 = 1; 12.0.1406 = 1; 12.0.1429 = 2; 12.0.1576 = 29; 12.0.1708 = 1; 12.0.4613 = 27; 12.0.5147 = 1.142

2. I stopped the parallel deployment of ESET RAA because sometimes the groups/ rules/ ... in ERA are not working 100% and it installs ESET EAV although Trend Micro is still installed :(

3. And if i remember right, at one point in the past i successfully remove Trend Micro with the ThirdParty-Uninstall in ERA and then suddenly it seems stop working?!

4. Is it right that is not possible at the moment to run the standalone-AVR silent?

5. So i have to really think about upgrading to V7 and then give it a try or maybe you can generate a AiO from V7 and i try it with one of my Trend Micro Installations?

Link to comment
Share on other sites

Good morning from germany :)

I made a test with the following construction and was semi successful -->

I download and setup the ESMC Server Appliance and generate an AiO; manual execution show me to remove Trend Micro OfficeScan 12.0.5147 so i decided to try it silent with the parameters --silent --accepteula. It removes Trend Micro successfully, but than stuck :( So i killed the ntrmv.exe after waiting 30min and installation of ESET EAA continues ...

First question --> Why it stucks?

Second question --> I try to remove Trend Micro in the same way using the ntrmv.exe, but without success :( Are there special parameters or so you are using?

Link to comment
Share on other sites

Update (i'm not sure if it is better to Quote/ Edit) -->

I rerun my test with AiO package from ESMC and it seems to work :) The formerly stucking machine (Win10) works, but it takes a long time to finish. The second test with Win7 also works and was noticeable faster ...

Conclusion for me is that i have to move from ERA 6.5 to ESMC 7.x ?

Link to comment
Share on other sites

  • ESET Staff

The best thing would be to test one more thing.

  • Deploy just the ESMC Agent to one of the machines which has Trend Micro installed (manually / GPO / create AIO installer, with just the agent).
  • Do not remove Trend Micro upon install (disable the AV remover functionality)
  • Initiate a "software uninstall" task, where you do not choose the "application from list", but the "Third-party antivirus software (Built with OPSWAT)" option.

If this works, I would suggest:

  1. Upgrade your ERA 6.5 server to ESMC
  2. Keep the already deployed machines running ERA Agent 6.5 (they will communicate just fine)
  3. Deploy the ESMC Agent to the machines running Trend Micro (GPO, SCCM would be recommended option for such big deployment)
  4. If the above mentioned works, remove the Trend Micro
  5. Install ESET Endpoint solution of your choice.

We will be releasing a service release of ESMC within next few weeks that will address the issues reported by some customers with upgrades, and we will subsequently enable component upgrade task, which will allow you to upgrade your 6.5 agents to V7 with ease.

 

 

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...