1

We’ve recently had an issue with our anti-virus (upgraded to the new version, then the old version was overwriting some of the new files when we logged in). I’ve had to manually uninstall it from about 5 computers. They’re now all up to the correct version, but Spiceworks is now reporting that they have out of date anti-virus, and that they have more than one installed.

1 Spice up
2

Sounds like you might have missed a few things when you manually removed it. Perhaps a few missing reg keys, files or DLLs.

Which Antivirus?

What was the old version?

What is the new version?

Sometimes you can find little programs that perform the cleanup for you, since some AV’s are just plain sloppy.

I hope this helps!

3

It’s Trend Micro OfficeScan. I followed the directions in their Knowledge Base on manually removing it. We had version 8.0 installed, and upgraded to 10.0. We also had a login script that would install 8.0 if it wasn’t installed. We didn’t update this script or the install files to it would overwrite the 10.0 if an administrator logged in (which is why only 5 to 10 computers were affected by it)

4

Okay, you didn’t update the script, but I’m assuming that you did disable the script, correct?

Hmmm … sometimes I’ve had to manually search through the registry looking for left behind keys and such. I use “Find” and search for certain values. For instance, if I was removing AVG< I’d look for either Grisoft or AVG or AVGFree, depending on the specific instance.

5

So I’ve run a script to query the WMI, and I got back the attached information. It almost looks like it’s installed 4 times… Perhaps I’ll look at the information on uninstalling remotely from a command line and pull up the wmi info on installed apps.

hello.txt (1.46 KB)

6

Hopefully that will resolve the issue, please let me know if I can be of further service. Have a great Friday and weekend!

7

It seems that an uninstall from the control panel didn’t resolve this issue. Is there a way to clean this information out of the WMI? I will probably be getting on the line with Trend Micro tech support this afternoon to see if they can help. A clean install is not an option (especially given that this occurred on a computer that was a clean install).

8

CoryK wrote:

It seems that an uninstall from the control panel didn’t resolve this issue. Is there a way to clean this information out of the WMI? I will probably be getting on the line with Trend Micro tech support this afternoon to see if they can help. A clean install is not an option (especially given that this occurred on a computer that was a clean install).

Just what I said earlier about cleaning it up manually in the registry.

David Scammell wrote:

Hmmm … sometimes I’ve had to manually search through the registry looking for left behind keys and such. I use “Find” and search for certain values. For instance, if I was removing AVG - I’d look for either Grisoft or AVG or AVGFree, depending on the specific instance.

I hope this helps!

9

Actually I can’t find any reference in there. Although I did find this: Remove Phantom Antivirus from Vista WMI Repository | MCB Systems The steps outlined there do work. This seems to be common with Trend Products (in that it’s happened to us, and this guy, and that makes commonality)

10

Sweet!