In other news I have a few projects in progress. The main one that isn’t work related is called Swatchee. It is a simple web app that generates syntax highlighting schemes for a variety of editors starting with vim, textmate, and notepad++. The app is based on jQuery, HTML5, and the Lithium framework for PHP. If you’re interested in testing or would like to lend a hand with development post a comment or send me an email at lane [at] laneolson [dot] ca.

The first step for installing PHP 5.3 is to get the prerequisites. For this guide you will need the following libraries in order to compile php with the options that I use. If you have some custom libraries/extensions that you want included in your build of PHP, now is the time to install them if you haven’t already.

The following command will install the libraries that I will need:

sudo apt-get install libmcrypt-dev libxml2 libxml2-dev libbz2-dev libcurl4-gnutls-dev libjpeg62-dbg libpng12-dev libxslt1-dev libbz2-dev

Once our required libraries have been installed we can go to http://www.php.net/downloads.php and choose to download the latest 5.3.x build in tar.gz format. I chose to copy the download link and use wget to download it to the tmp directory, but you can do whatever you like.

cd /tmp
wget http://ca2.php.net/get/php-5.3.1.tar.gz/from/this/mirror

now untar the file and go into the directory

tar -xvf php-5.3.1.tar.gz
cd php-5.3.1

Now comes the fun part. Here we will run the configure script that says what kind of extensions we want php built with. At the beginning of the tutorial we installed a bunch of libraries (for example libbz2) and because of that we are able to build PHP with support for these libraries by specifying the –with-%library% flag. To see the options available for configuring php type:

./configure --help

You should be fine using what I used below, but feel free to make adjustments as you see fit:

./configure --prefix=/usr --with-config-file-path=/etc/php5/ --with-config-file-scan-dir=/etc/php5/ --with-apxs2=/usr/bin/apxs2 --with-bz2 --with-curl --with-gd --with-iconv --with-mcrypt --with-mysql --with-mysqli --with-openssl --with-pcre-regex --with-pdo-mysql --with-pear --with-xmlrpc --with-xsl --with-zlib --enable-ftp --enable-mbstring --enable-soap --enable-sockets

If all goes well with the configure script you can continue to run the make file:

sudo make -i install

Once the make script is finished running we have to manually create the modules for Apache:

cd /etc/apache2/mods-available
sudo nano php5.load

The contents of this file should be:

LoadModule php5_module /usr/lib/apache2/modules/libphp5.so

Now create the configuration file:

sudo nano php5.conf

with the contents:

<IfModule mod_php5.c>
	AddType application/x-httpd-php .php .phtml .php3
	AddType application/x-httpd-php-source .phps
</IfModule>

Once those two files have been created we can enable the php5 module for Apache, then restart Apache for the new module to load.

sudo a2enmod php5
sudo /etc/init.d/apache2 restart

Now go into your web directory (if you followed my apache guide earlier go to ~/www/sandbox.loc/httpdocs) and create a file called test.php

nano ~/www/sandbox.loc/httpdocs/test.php

with the following contents:

<?php echo phpinfo(); ?>

Now point your web browser to the new file you created. Which should be at http://sandbox.loc/test.php, you should get a phpinfo page if all went according to plan.

You have now successfully installed php 5.3. On the phpinfo page if you scroll down to the date section you will probably see an error saying you have to set your timezone. You can do this with the php.ini file. To ceate the php in file first create the /etc/php5 directory and copy the php.ini-production file included in the php-5.3.1 tar file.

sudo mkdir /etc/php5
sudo cp /tmp/php-5.3.1/php.ini-production /etc/php5/php.ini

Now edit the php.ini file:

sudo nano /etc/php5/php.ini

and find the line beginning with “;date.timezone”, remove the semi-colon and set the value to your desired time zone. There is a list of supported timezones in the PHP manual. For example, I changed mine to:

date.timezone = "America/Edmonton"

You should now be set to start using PHP 5.3 with Apache!

MultiBeast installs everything you need to get your system 100% in one convenient package including Bootloader, Graphics, Sound, Network, DSDT, Kernels, Extras, and Utilities.

This is great for those who have always wanted a Hackintosh but were too intimidated by the manual terminal work. MultiBeast provides a straight forward GUI for performing the grudging tasks of getting your hardware to work with OS X.

I have been a loyal reader of tonymacx86’s blog for the past few months since his guides have got me up and running with a Core i5 Hackintosh of my own. His guides are very thorough and easy to follow. The introduction of this tool makes things so much easier. Thanks tonymacx86!

Links:

• tonymacx86’s blog – guides and various p55 i5/i7 hackintosh information
• tonymacx86 forums
• MultiBeast Installer – The Ultimate tool for Hackintosh Post-Installation

sudo tasksel

Then follow the onscreen instructions and choose “LAMP Server” when prompted to be up and running with Apache, MySQL, and PHP in mere minutes. This is great for a user that just wants the standard versions of PHP or MySQL. However, I’m working on a project that requires PHP 5.3, and installing a LAMP server using tasksel installs PHP 5.2. I decided that I would just install Apache and PHP manually so that I could use PHP 5.3. This guide starts with my ideal Apache setup. This is kind of a personal preference of how I like Apache setup, others may prefer a different method. If you follow this guide directly you will end up with your web directory in your home folder, with two sites (http://sandbox.local/ and http://production.local/). Lets get started.

Installing Apache

Installing Apache is the easy part, simply use apt:

sudo apt-get install apache2 apache2-prefork-dev apache2-mpm-prefork

Let it do its thing and in a few minutes you should have Apache up and running. Once it is done you can test if it is working by opening a web browser and entering http://localhost/ in the address bar. You should get Apache’s default message that says “It works!”. Now that Apache is installed we can configure it to fit our needs.

Configuring Apache

The first thing we are going to do is edit our hosts file to include our two “domain names” we’ll be using for the site, sandbox.local and production.local. Open up the /etc/hosts file with nano (or your editor of choice):

sudo nano /etc/hosts

And add the following lines below the line that begins with 127.0.1.1:

127.0.1.2 sandbox.local www.sandbox.local
127.0.1.3 production.local www.production.local

For those not familiar with the hosts file, what this is doing is assigning an IP Address to the host names. 127.0.1.2 and 127.0.1.3 are IP addresses that point to the local machine. The values following the IP Address are the host name, and host alias respectively. If you want to additional host names that point to the local machine then add them here. You can call your host names whatever you like instead of sandbox.local and production.local, just be sure to substitute your own names in place of these for the rest of the tutorial.

Now that we have our host names pointing to our local machine we can create directories to hold the content for our two websites. I created my base web directory inside of my home directory:

mkdir ~/www

Now I want a directory for each site inside of the www directory. The following will make a directory for each site with sub directories for the type of content (httpdocs for the web files, logs for the logs). The last line just creates an index.html file in the httpdocs directory so we can test that our websites are working later.

For the sandbox.local website:

mkdir ~/www/sandbox.local
mkdir ~/www/sandbox.local/httpdocs
mkdir ~/www/sandbox.local/logs
echo "<h1>sandbox.local</h1>" > ~/www/sandbox.local/httpdocs/index.html

For the production.local website:

mkdir ~/www/production.local
mkdir ~/www/production.local/httpdocs
mkdir ~/www/production.local/logs
echo "<h1>production.local</h1>" > ~/www/production.local/httpdocs/index.html

Now we have our host names setup, and directories setup that contain our website. The next step is to create configuration files to tell Apache what our host name (domain name) is and where on the computer it is located. The configuration files for each site should be created in "/etc/apache2/sites-available".

First lets create the configuration file for sandbox.local

cd /etc/apache2/sites-available
sudo nano sandbox.local

The file sandbox.local should contain the following. You will have to change the "ServerAdmin" value and all the instances of "/home/lane" to your home directory depending on your username.

<VirtualHost *:80>
	ServerAdmin username@sandbox.local
	ServerName sandbox.local
	ServerAlias www.sandbox.local
 
	DocumentRoot /home/lane/www/sandbox.local/httpdocs/
	<Directory /home/lane/www/sandbox.local/httpdocs/>
		Options Indexes FollowSymLinks MultiViews
		AllowOverride All
		Order allow,deny
		allow from all
	</Directory>
 
	ErrorLog /home/lane/www/sandbox.local/logs/error.log
	LogLevel warn
	CustomLog /home/lane/www/sandbox.local/logs/access.log combined
</VirtualHost>

Now do the same for production.local.

sudo nano production.local

With contents:

<VirtualHost *:80>
	ServerAdmin username@production.local
	ServerName production.local
	ServerAlias www.production.local
 
	DocumentRoot /home/lane/www/production.local/httpdocs/
	<Directory /home/lane/www/production.local/httpdocs/>
		Options Indexes FollowSymLinks MultiViews
		AllowOverride All
		Order allow,deny
		allow from all
	</Directory>
 
	ErrorLog /home/lane/www/production.local/logs/error.log
	LogLevel warn
	CustomLog /home/lane/www/production.local/logs/access.log combined
</VirtualHost>

As you can see the two configuration files are pretty straight forward XML files. The ServerName and ServerAlias values tell Apache what host name the following configuration is meant for. The DocumentRoot value tells Apache where to find the files for this website. The Directory directive allows you to specify specific options for the given directory. Lastly the ErrorLog and CustomLog tells Apache where to store the log files for this domain.

Once the configuration files have been created we want to enable them so that Apache knows they are there. I also chose to disable the default config, this is up to you. The default config will load whatever is in "/var/www" when you point your browser to "localhost" (which is why we recieved the "It works!" message earlier.

sudo a2ensite sandbox.local
sudo a2ensite production.local
sudo a2dissite default

Finally the last step is to restart Apache. This can be done with the following command:

sudo /etc/init.d/apache2 restart

If all went well we should be able to bring up our two new local websites. Here is where everything we've done comes together. Open up your web browser and type in "http://sandbox.local/". When you type in sandbox.local in your web browser, the host name is looked up (and found in /etc/hosts) which points to the localhost (127.0.1.2). Apache is listening on port 80 (the default http port) and picks up the request for "sandbox.local". It looks in the enabled sites for one with a ServerName of "sandbox.local" then points to the requested file (index.html by default) in "DocumentRoot". The web browser then displays this page and should say "sandbox.local" in big letters.

Now point your web browser to http://production.local/ and you should receive a similar page that says "production.local" in big letters.

You can now put whatever web content you want in ~/www/sandbox.local/httpdocs/ or ~/www/production.local/httpdocs/ and they will load up when you type their host name into your web browser.

This isn't really all that useful yet because all you can load up are html pages, which you could do anyways just by double clicking on an html file. In my next blog post I will show you how to install PHP for use with your Apache web server so you can use it as a testing ground for various projects.

This is a great tool for Splunk. All you have to do is copy an event that you want to capture a custom field in, paste it in the tool, then work with the regular expression until it captures that data you need. One example of a regular expression that I built is this monster:

(http|https)://(([A-Za-z0-9\.\-]*)?\.)?(?<domain_name>[A-Za-z0-9\-]{3}[A-Za-z0-9\-]*\.([A-Za-z]{2}\.[A-Za-z]{2}|[A-Za-z]{2,3})|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})

I’ll explain what this one does in a second, but you can probably guess just by looking at it. With Splunk I am indexing all data that goes through the HTTP proxy on the firewall. Each event that Splunk indexes from the proxy includes the address processessed, right down to the file name. However, I’m more interested in pooling all of the events by domain name to get total amount of requests, time spent, etc by domain name. So, I needed a regular expression to extract the domain name; enter the mess of characters from above.

The regular expression above will break down a URL and capture its domain name. For example the regex will capture example.com from the following url:

http://www.example.com/some_folder/filename.php?id=34&name=something

This is actually simple enough to capture but became more complex when you considered the following:

• Subdomains (whatever.example.com)
• Odd domain extensions (ab.ca, co.uk)
• IP Address domains (64.75.34.12)

Here is a break down of the regular expression mentioned above.

Capture group 1:

(http|https)://

Pretty straight forward, the url must begin with http or https. This is a HTTP/S proxy so I know that it will begin with either of these two values. If you were to use this for an FTP proxy you could easily put in ftp. The http/s is always followed by ://.

Capture Group 2:

([A-Za-z0-9\.\-]*\.)?

This part of the expression is to capture the subdomain. It looks for any number containing characters in the range A-Z, a-z, 0-9, ., and – followed by a . (dot). The question mark at the end of this part of the expression means that it is optional, that is, not all URL’s have subdomains. Now that we have the subdomain, the next thing to process will be the domain name.

Capture Group 3 (this one’s a doosey):

([A-Za-z0-9\-]{3}[A-Za-z0-9\-]*\.([A-Za-z]{2}\.[A-Za-z]{2}|[A-Za-z]{2s,4})|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})

This one is so long because it looks for a domain name, or an IP address. Here is the part that captures a domain name:

([A-Za-z0-9\-]{2}[A-Za-z0-9\-]*\.[A-Za-z]{2}\.[A-Za-z]{2}|[A-Za-z]{2,6})

A domain name must be at lease 2 characters, the first part takes care of that: [A-Za-z0-9\-]{2}.

The expression that follows that captures the remaining characters in the domain up until the “.” before the domain extension: [A-Za-z0-9\-]*\.

The final part captures the domain extension, which can sometimes be a provice/state followed by a country code (ab.ca or fl.us which is ([A-Za-z]{2}\.[A-Za-z]{2}) or (|) an extension from two characters (ie: .ca) to six characters (ie: .museum) which is represented by [A-Za-z]{2,6}.

I also wanted to capture the IP address if the http request used an IP instead of a host name. That’s what the last part captures:

[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}

This one is fairly easy as well. An Ipv4 address is just a series of 1 to 3 digits, a dot, 1 to 3 digits, a dot, 1 to 3 digits, a dot, then 1 to 3 digits. That is what the above captures.

To reiterate, the full regular expression is:

(http|https)://(([A-Za-z0-9\.\-]*)?\.)?(?<domain_name>[A-Za-z0-9\-]{3}[A-Za-z0-9\-]*\.([A-Za-z]{2}\.[A-Za-z]{2}|[A-Za-z]{2,3})|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})

You may be wondering what the ? is for. That is just a way to assign the value of the 4th capture group a variable named “domain_name” in Splunk. If you take out the ? capture group 4 will still contain the domain name.

I feel that learning and becoming comfortable with regular expressions is extremely important if you do any kind of programming. At first they may seem a little daunting, but once you get the patterns down they are actually quite simple to write. They allow you to parse almost any kind of data and nearly every programming language has some kind of implementation for them. Using a tool like RegExr is a great way to learn to write regular expressions and also test them out once you get the hang of it. You can also find a large library of regular expressions at regexlib.com.

Regular Expression Links:

• RegExr – Regular Expression Testing Tool
• RegExLib.com – A collection of regular expressions
• An Introduction to Regular Expressions

• A new internal architecture of the modules
• NVT Meta Information that is free of arbitrary size limits
• IPv6 support
• WMI clients support
• Supports upcoming optional extensions:
  • OpenVAS Manager for storing and organizing scans on a central server in a
    SQL database
  • OpenVAS Administrator for User-, Feed- and Settings-Management
  • Greenbone Security Assistent for a web-based Vulnerability Management

You can read more about it on the official OpenVAS website. Now, lets get to the good stuff. The instructions below should get you up and running with OpenVAS 3 on Ubuntu 9.10:

Prerequisites

First we need to install all of the dependent packages:

sudo apt-get install build-essential libgnutls-dev libpcap0.8-dev bison 
libglib2.0-dev libgpgme11-dev libssl-dev cmake

Getting the Files

Once those packages have installed we need to download the files required for OpenVAS. The links below may be outdated, make sure you obtain the latest version.

cd /tmp
wget http://wald.intevation.org/frs/download.php/706/openvas-libraries-3.0.3.tar.gz
wget http://wald.intevation.org/frs/download.php/696/openvas-scanner-3.0.1.tar.gz

Now that we have downloaded the required files we must compile and install the packages in the following order:

1. openvas-libraries
2. openvas-scanner

Install OpenVAS Libraries

Start by untarring the openvas-libraries and compiling/installing it:

tar -xvf openvas-libraries-3.0.3.tar.gz
cd openvas-libraries-3.0.3/
sudo ./configure
sudo make
sudo make install

If all goes well here then you should get a message saying that the openvas-libraries have been installed. If for some reason you get a message saying that gpgme is not installed, then try this:

sudo apt-get install libgpgme11-dev

Install OpenVAS Scanner

Next untar the openvas-scanner and compile/install it:

cd ..
tar -xvf openvas-scanner-3.0.1.tar.gz
cd openvas-scanner-3.0.1/
sudo ./configure
sudo make
sudo make install

The OpenVAS libraries, and scanner should now be installed. We now have to make sure that /usr/local/bin and /usr/local/sbin are in our PATH. We can do that by typing in:

echo ${PATH}

In the output from the above command you should see /usr/local/bin and /usr/local/sbin somewhere. If you don’t you will have to add those entries to the PATH environmental variable manually. If your PATH environmental variable is all good you can build the links to the new libraries:

sudo ldconfig

Generate a Certificate

We are now ready to generate a certificate for our OpenVAS Server, make sure to enter values relevant to your location.

sudo openvas-mkcert

Follow the onscreen prompts and enter the appropriate information when asked.

Create a User

Now we need to add a user:

sudo openvas-adduser

Enter a username and choose your authentication method (choose “pass” to authenticate with a password). Hit ctrl-d when you are prompted for rules if you don’t want any scanning restrictions.

Now everything that we need is setup for the OpenVAS scanner. The next step is to sync the server with the NVT feed. The NVT (Network Vulnerability Test) feed is a list of files that will be downloaded to your server. I would recommend that you run the openvas-nvt-sync on regular intervals to ensure that your NVT files are up to date.

sudo openvas-nvt-sync

Note: The first time you run this command it may take a while to download all the NVT’s. Grab a coffee and a sandwich, some water and a piece of fruit, some beer and some pretzels… or whatever it is you eat/drink.

Once it’s done its thing you can start up the OpenVAS server daemon:

sudo openvassd

Note: It might take a few minutes to load all the plug-ins. A great opportunity to get some exercise and burn off the beer and pretzels from earlier.

If all went according to plan, you now have a running version of OpenVAS server. The next step in the process is to setup a client to connect to the OpenVAS server. You may opt to do this on a different computer, but you can just as easily install it on the same computer.

Install the OpenVAS Client

First we need to install the dependent packages for the client:

sudo apt-get install libgtk2.0-dev htmldoc

Now we can proceed to install the client:

cd /tmp
wget http://wald.intevation.org/frs/download.php/685/openvas-client-3.0.0.tar.gz
tar -xvf openvas-client-3.0.0.tar.gz
cd openvas-client-3.0.0/
sudo ./configure
sudo make
sudo make install

If the above works for you, great! However if you’re running a 64 bit OS like me, you might get an error when you run “sudo make”. The error I received was:

/usr/bin/ld: cannot find -lcrypto
collect2: ld returned 1 exit status
make[1]: *** [OpenVAS-Client] Error 1
make[1]: Leaving directory `/tmp/openvas-client-3.0.0/openvas'
make: *** [client] Error 2

I ran the following command to see what the problem was:

laneolson@system:/tmp/openvas-client-3.0.0$ ldconfig -p | grep crypto
	libcrypto.so.0.9.8 (libc6,x86-64) => /lib/libcrypto.so.0.9.8
	libcrypto.so.0.9.8 (libc6,x86-64) => /usr/lib/libcrypto.so.0.9.8
	libcrypto.so.0.9.8 (libc6, hwcap: 0x0008000000008000) => /lib32/i686/cmov/libcrypto.so.0.9.8
	libcrypto.so.0.9.8 (libc6, hwcap: 0x0004000000000000) => /lib32/i586/libcrypto.so.0.9.8
	libcrypto.so.0.9.8 (libc6, hwcap: 0x0002000000000000) => /lib32/i486/libcrypto.so.0.9.8

Creating a link in /usr/lib/ solved the problem:

sudo ln -s /usr/lib/libcrypto.so.0.9.8 /usr/lib/libcrypto.so

If you had to make the symbolic link make sure you do the following afterwards to complete the setup:

sudo ldconfig
sudo make clean
sudo ./configure
sudo make
sudo make install

You should have a message saying that the Client was installed successfully. You can run the client with:

sudo OpenVAS-Client

The client can be installed on any computer that has access to the server. Once it is installed you just have to connect, setup a scan and you’re done! If you run into any hiccups along the way feel free to post in the comments and I will see if I can lend a hand.

The issue was with snapshots. I had been taking snapshots of the VM prior to applying service packs or installing risky software. After the procedure was successful I would delete the snapshot… or so I thought. I’m no Hyper-V guru, but from past experience with VMware products once a snapshot is deleted, it’s gone. This isn’t the case with Hyper-V. If you want to delete a snapshot, you have to delete it in the Hyper-V manager, then turn off the VM with the deleted snapshot and wait for it to merge.

I shut down the VM and the merging process began. However, I had created a few snapshots in the past that still hadn’t been merged. It looked like the merging process might take a while, so I let it run. However, the merging process could not complete because I didn’t have enough disk space! I found this quite ironic.

I am of disk space because I did not merge the snapshots into the vhd, but I cannot merge the snapshots because I am out of disk space. Does that seem odd to anyone else?

In order to fix this problem I had to dive into the config file. Luckily, I had another hard drive with around 30GB of freespace attached to the host. To fix the problem I shut down the VM and Hyper-V Services then went to the directory containing .avhd (snapshot) files. I moved one of the snapshot files to a temporary directory on the drive with the free space, then updated the snapshot entry in the config xml file for the VM to point to the new directory where I placed the snapshot file. After restarting the Hyper-V services and turning off the VM the merge was able to complete, albeit after 2 hours of waiting.

I realize that Hyper-V is a somewhat new contender in the Virtualization marketplace, but I think that something is completely out of whack with the way that snapshots work. When you have systems that are required to be up and running 24/7 it basically throws away any use that snapshots have. It seems somewhat ridiculous that you have to bring a system down to delete the snapshot when one of the reasons you created the snapshot was to help reduce downtime in case something goes wrong. It is even more ridiculous that if you don’t power down your system and wait for the vhd to merge, the snapshot will continue to grow until the system comes crashing down due to a lack of disk space!

Anyways, that’s my rant. Yes, I understand that Microsoft does not recommend snapshots for production environments… but I hope in the future they make some improvements so that snapshots are usable in production environments.

• I often get a “shadow” mouse where I can see the Windows cursor and the Ubuntu cursor at the same time. This would make it difficult for me to know what I was clicking on.
• I usually have my Ubuntu VM at fullscreen on one monitor and Windows running in the other. In order to release the mouse from the VM I would have to hit Ctrl+Alt, which makes it tough to use the VM and Windows side-by-side. Also hitting Ctrl+Alt would exit the VM from fullscreen mode.
• The cursor would often flash in a seizure inducing way.

All of these issues can be easily fixed by installing the vmmouse driver. Which can be done with the following command:

sudo apt-get install xserver-xorg-input-vmmouse

After it is installed you can reboot or simply restart gdm with:

sudo /etc/init.d/gdm restart

You can now run the VM in fullscreen and seamlessly move the mouse in and out of the VM without having to press ctrl+alt all the time. It also fixes the other issues mentioned above.

How to change the password for the Web Console if you are locked out

For some reason after I upgraded from WFBS 5.1 to 6.0 I was unable to login to the Web Console with my old password. Accessing the web console is pretty essential to managing WFBS so I had to find a way to reset it. Fortunately I had a backup of the ofcserver.ini file which contains an encrypted version of the web console password. I was able to replace the encrypted password in the new ini file with the one from the old file. You can reset your password by:

1. Stop the Trend Mico Master Service
2. Open up the ofcserver.ini (C:\Program Files\Trend Micro\Security Server\PCCSRV\Private\ofcserver.ini)
3. Find the line that starts with “Master_Pwd” and replacing it with this:

   Master_Pwd=!CRYPT!523DD5B28918ED6D2ED4C7DFFE949A638AA4D1C8B1D25440F37606AD23C793453C0043B1B483A2EADE21439233C

4. Save the file then Start the Trend Micro Master Service
5. Login to the Trend Micro WFBS web console, your password will be “P@$$w0rd!”.
6. You should now be able to login to the web console and set your password to whatever you like.

Disable the password to unload or uninstall the Trend Micro Client/Server Security Agent

In addition to being locked out of the web console as mentioned above, I was also unable to unload or uninstall the Cient/Server Security agent from any of my machines. A quick registry fix solves this problem.

1. Go to Start > Run and type in “regedit”.
2. Search for the keys “Allow Uninstall” or “NoPwdProtect” located in HKEY_LOCAL_MACHINE/Software/TrendMicro/PC-cillinNTCorp/CurrentVersion/Misc.
3. Change these values from 0 to 1. You will then be able to unload the agent and uninstall the agent.

Cannot re-install client security agent

After having issues with one of my clients I decided to scrap it and start with a fresh install. Unfortunately uninstalling the agent from add/remove programs often isn’t enough. There are several fragments left behind and the Trend Micro agent will not let you re-install until those fragments are gone. The remedy for this is performing a manual uninstall of the Client/Security agent. In my case the Add/Remove uninstaller got most of the job done, but I still had to remove the registry keys before I was able to re-install the agent. I’m not going to outline all the steps here because they can already be found in the Trend Micro WFBS knowledgebase.

That concludes the fixes I’ve had to use in the past to deal with a flakey Trend Micro install. Hopefully they help you out!