How to uninstall Trend Micro Antivirus on Mac

Trend Micro Antivirus does not disappear when you drag its icon to the Trash. The app installs system-level services, such as LaunchAgents, LaunchDaemons, a privileged helper, and a Safari extension, that keep running on every restart even after the main app is gone, and its menu bar icon usually comes right back on the next login.

~/Library

Why you might need to remove Trend Micro Antivirus

Trend Micro is one of the heavier consumer antivirus suites on macOS. It runs background scans on file activity and network traffic, registers system extensions for endpoint security and network filtering, and installs a Safari content blocker. On older Macs or systems with sustained workloads, that overhead is noticeable because the app can also clash with developer tools, VPN clients, Docker, and Homebrew packages that touch low-level networking.

Apple has also tightened built-in macOS protections in macOS 13 through 26, so a third-party antivirus is less essential for most home users than it was a few years ago. Add in the usual reasons like an expired subscription, an app you no longer use, or historical privacy concerns around Trend Micro consumer tools that MacRumors users flagged for sending system data without explicit consent, and a clean uninstall becomes the right move.

Manual vs. automatic uninstallation: a quick comparison

Trend Micro can be removed by hand or with a dedicated uninstaller. The table below shows how the two routes compare on a real test Mac.

If you only want Trend Micro gone, jump to Method 3 and let App Cleaner & Uninstaller handle every component in a single pass. If you prefer the official Trend Micro tooling, Method 1 and Method 2 below walk through both first-party options in full.

Method 1: How to uninstall Trend Micro manually

The manual route works on every recent macOS version (13 Ventura, 14 Sonoma, 15 Sequoia, and 26 Tahoe) and on both Intel and Apple Silicon. Before you start, save your Trend Micro serial number in case you may reinstall later, and confirm you have the admin password for your Mac.

Versioning note: which Trend Micro do you actually have?

The Trend Micro name covers several different products, and the right uninstall path depends on which one is installed:

• Trend Micro Antivirus — the consumer product distributed from trendmicro.com; this guide focuses on this version.
• Trend Micro Antivirus One — a separate sandboxed App Store version; uninstall by dragging the app to Trash and removing files in

  ~/Library/Containers/com.trendmicro.drsafety.*

  Copy

  .
• Trend Micro Apex One Security Agent — an enterprise product managed by your IT team; removal usually requires an admin password issued by IT or the Common Uninstall Tool (CUT) from the VisionOne portal.
• Trend Micro Internet Security — an older suite; look for leftovers in

  ~/Library/Containers/com.trendmicro.DrSafety

  Copy

  .

To check which one is installed, open /Applications/ in Finder and inspect the Trend Micro folder — the bundles inside reveal the edition.

Stop Trend Micro background processes

Trend Micro will block its own deletion if any of its services are still running. Click the Trend Micro icon in the menu bar and choose Shut Down Trend Micro Antivirus. If the menu bar icon is missing or the option is greyed out, force-quit the processes from Activity Monitor instead.

1. Open Activity Monitor (Applications → Utilities → Activity Monitor).
2. From the View menu, choose All Processes.
3. Type

   trend

   Copy

   in the search field at the top right.
4. Select each Trend Micro process (look for

   iCoreService

   Copy

   ,

   com.trendmicro.icore.es

   Copy

   ,

   com.trendmicro.icore.netfilter

   Copy

   ,

   AFMMainUI

   Copy

   ) and click the × button → Force Quit.

Use the built-in “Uninstall Trend Micro Antivirus” app

Trend Micro ships with its own uninstaller inside the application folder. It removes the main app and several support files, but it does not catch every leftover. My testing on macOS Tahoe showed 253 residual items (1.72 MB) remaining after the built-in uninstaller finished. Plan to do the leftover cleanup in the next subsection regardless.

1. Open Finder → Applications, then open the Trend Micro folder.
2. Launch Uninstall Trend Micro Antivirus.app.
3. Click the Uninstall button on the welcome screen.

1. Enter your Mac admin name and password when prompted, then click OK.
2. Wait for the progress bar to finish — it usually takes 30–60 seconds.
3. Click OK in the Uninstall completed dialog.

After the built-in uninstaller finishes, open System Settings → General → Login Items & Extensions and look under Endpoint Security Extensions and Network Extensions. Trend Micro extensions often remain registered with their toggles on, even when the main app is gone. Switch each one off, then click the three-dot menu → Delete Extension.

Open Safari and go to Safari → Settings → Extensions. If a Trend Micro Web Threat Protection extension is still listed, uncheck it and click Uninstall. The official Uninstall Tool (covered in Method 2) removes the Safari extension automatically, but the built-in uninstaller sometimes leaves it behind.

Find and remove leftover service files

Trend Micro scatters files across both the system-level /Library and your user-level ~/Library. These folders hold files from many other apps too, so move carefully and only delete items whose name contains TrendMicro, trendmicro, or com.trendmicro.

Pro Tip: Run a quick sanity scan from Terminal first to see what is actually still on disk:

sudo find /Library ~/Library -iname “*trendmicro*” 2>/dev/null

In Finder, press ⌘+Shift+G to open the Go to Folder dialog. Paste each system path below in turn and move what it opens to the Trash. Each system path will trigger an admin password prompt:

• /Applications/Trend Micro/

  Copy

• /Library/Application Support/TrendMicro/

  Copy

• /Library/Frameworks/iCoreClient.framework

  Copy

• /Library/Frameworks/iCoreClientPb.framework

  Copy

• /Library/Frameworks/TMAppCore.framework

  Copy

• /Library/PrivilegedHelperTools/com.trendmicro.AFM.HelperTool

  Copy

• /Library/LaunchAgents/com.trendmicro.itis.dca.plist

  Copy

• /Library/LaunchAgents/com.trendmicro.itis.dmr.plist

  Copy

• /Library/LaunchAgents/com.trendmicro.itis.uimgmt.agent.plist

  Copy

• /Library/LaunchDaemons/com.trendmicro.AFM.HelperTool.plist

  Copy

• /Library/LaunchDaemons/com.trendmicro.icore.av.plist

  Copy

• /Library/LaunchDaemons/com.trendmicro.icore.main.plist

  Copy

• /Library/LaunchDaemons/com.trendmicro.icore.misc.plist

  Copy

• /Library/LaunchDaemons/com.trendmicro.icore.wp.plist

  Copy

• /Library/LaunchDaemons/com.trendmicro.itis.kext.plist

  Copy

• /private/var/log/TrendMicro

  Copy

• /Users/Shared/TrendMicro

  Copy

Now switch to the user-level paths. Reveal hidden files in Finder with ⌘+Shift+. (period), then repeat the same Go to Folder routine for each item:

• ~/Library/Application Scripts/com.trendmicro.AFMMainUI.AFMFinderSync

  Copy

• ~/Library/Application Scripts/com.trendmicro.itis.SafariToolbar

  Copy

• ~/Library/Application Scripts/com.trendmicro.itis.SafariToolbar.Extension

  Copy

• ~/Library/Caches/com.trendmicro.AFMMainUI

  Copy

• ~/Library/Caches/com.trendmicro.iTIS.PackageSelector

  Copy

• ~/Library/Containers/com.trendmicro.AFMMainUI.AFMFinderSync

  Copy

• ~/Library/Containers/com.trendmicro.itis.SafariToolbar

  Copy

• ~/Library/Containers/com.trendmicro.itis.SafariToolbar.Extension

  Copy

• ~/Library/HTTPStorages/com.trendmicro.AFMMainUI

  Copy

• ~/Library/HTTPStorages/com.trendmicro.iTIS.PackageSelector

  Copy

• ~/Library/Logs/TrendMicro

  Copy

• ~/Library/Preferences/com.trendmicro.AFMMainUI.plist

  Copy

• ~/Library/WebKit/com.trendmicro.AFMMainUI

  Copy

~/Library

Finish with Finder → Empty Trash, then restart your Mac. The restart is the only reliable way to unload Trend Micro system extensions that were active during the cleanup.

Method 2: Use the official developer Uninstall Tool

Trend Micro publishes a standalone uninstaller as UninstallTool.zip for cases where the built-in route fails: the Trend Micro folder is already gone from Applications, the menu bar app refuses to quit, the consumer uninstaller throws an error, or an enterprise edition (Apex One) is installed.

Download the archive from the Trend Micro Help Center page that documents the uninstall procedure. The tool is a Universal Binary that runs natively on both Intel and Apple Silicon, and it has been confirmed to work on macOS 12 Monterey through macOS 26 Tahoe.

1. Download UninstallTool.zip from the Trend Micro Help Center.
2. Double-click the archive in Finder to extract UninstallTool.app.
3. Right-click UninstallTool.app and choose Open (this avoids a Gatekeeper warning on first run).

1. Tick the I have copied my serial number checkbox so the Uninstall button activates.
2. Click Uninstall, then enter your admin name and password when prompted.
3. Wait for the progress dialog to finish — it usually takes one to two minutes — and click OK.

On my Mac, the standalone Uninstall Tool removed Trend Micro components more thoroughly than the built-in uninstaller; the Safari extension was gone automatically, and the registered system extensions were properly deregistered.

~/Library/Preferences/com.trendmicro.iTIS.UninstallTool.plist

/private/var/folders/…/C/com.trendmicro.iTIS.UninstallTool

Method 3: Uninstall Trend Micro automatically with App Cleaner & Uninstaller

If you would rather skip the path-by-path cleanup, App Cleaner & Uninstaller by Nektony detects every component that matches the com.trendmicro.* bundle identifier (including hidden containers, WebKit caches, and Application Scripts) and removes them in a single confirmed action.

1. Download and launch App Cleaner & Uninstaller by Nektony.
2. Select Applications in the left sidebar.
3. Find Trend Micro Antivirus in the list. The app automatically groups every related component under one entry.
4. Switch on Expert Mode (top toolbar) if you would like to have every component is visible. In this case, tick the boxes next to every Trend Micro item.
5. Click Remove (or Uninstall, if you’re not in Expert Mode) in the bottom right.
6. Review the file list in the confirmation dialog and click Remove again to confirm.
7. Enter your admin password if prompted.

After the removal finishes, open the Remaining Files section in the sidebar and scroll for any entry that still mentions Trend Micro. There should not be one. If something appears, tick it and remove it the same way.

Empty the Trash and restart your Mac to unload any Trend Micro extension that was still active during cleanup. As a final check, open System Settings → General → Login Items & Extensions and confirm no Trend Micro entries remain under Endpoint Security Extensions or Network Extensions.

The bottom line

For the fastest clean removal, use App Cleaner & Uninstaller. It covers every Trend Micro component in one confirmed step, and it is the only one of the three methods that catches every WebKit cache, container, and Application Scripts folder without manual path hunting.

If you want to stay on first-party tools, run the built-in Uninstall Trend Micro Antivirus.app first; switch to the standalone UninstallTool.zip only when the built-in app is missing or fails. Plan for a manual sweep of ~/Library afterwards in both cases.

Whichever method you pick, finish by restarting your Mac and checking System Settings → General → Login Items & Extensions for orphaned Trend Micro permissions. And remember: uninstalling the app does not cancel your subscription; sign in at account.trendmicro.com to manage billing separately.