Uninstalling the Windows forwarder

Manual Uninstallation of the Windows Forwarder

These methods work for all versions except for 1.4.x.

Windows UI

Like most programs, you can remove the Stairwell Forwarder using normal Windows uninstallation methods

Command Line with Installer EXE

For this to work, you need to use the installer executable that corresponds to the version of the forwarder on your system. In the example below, we are uninstalling version 1.6.4.

• Open an elevated cmd.exe
• Run the following command (with your installer filename): .\StairwellForwarderBundle-1.6.4.0.exe /uninstall /Log StairwellUninstall.log /q /norestart

Manual Uninstallation of 1.4.x

Step 1: Enter Maintenance Mode

• Open cmd.exe
• Run the following command: C:\Program Files\Stairwell\SwellService\SwellService.exe -mainttoken=$token

Step 2: Repair Stairwell

• Open Control Panel
• Find the StairwellForwarderBundle.exe
• Select Repair

Step 3: Re-enter Maintenance Mode

• Open cmd.exe
• Run the following command: C:\Program Files\Stairwell\SwellService\SwellService.exe -mainttoken=$token

Step 4: Uninstall Forwarder

• Open cmd.exe
• Run the following command: .\StairwellForwarderBundle-1.4.0.886.exe /uninstall /Log StairwellUninstall.log /q /norestart

🚧

Until a reboot occurs...

the driver SWAgent.sys and service SwellService.exe will continue to run and show in their respective locations, however the application should be removed from installed programs.

Step 5: Verify Services Stopped

Once rebooted, we’ll want to verify success by checking the service.

• Select Windows button + R to open the run dialog box
• Type in services.msc
• Search for StairwellForwarder
• Open Powershell
• Type in fltmc.exe
• Search for SWAGENT

Step 6: Manual Cleanup

Remove any leftover Stairwell artifacts from the program files.

• Navigate to C:\Program Files\Stairwell\ and delete all related folders and files
• Navigate to registry keys and cleanup items
  • HKEY_LOCAL_MACHINE\SOFTWARE\Inception\Stairwell
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWAgent