Uninstalling the Windows forwarder

Manual Uninstallation of 1.4.x

Step 1: Enter Maintenance Mode

  • Open cmd.exe
  • Run the following command: C:\Program Files\Stairwell\SwellService\SwellService.exe -mainttoken=$token

Step 2: Repair Stairwell

  • Open Control Panel
  • Find the StairwellForwarderBundle.exe
  • Select Repair

Step 3: Re-enter Maintenance Mode

  • Open cmd.exe
  • Run the following command: C:\Program Files\Stairwell\SwellService\SwellService.exe -mainttoken=$token

Step 4: Uninstall Forwarder

  • Open cmd.exe
  • Run the following command: .\StairwellForwarderBundle-1.4.0.886.exe /u /Log StairwellUninstall.log /q /norestart

🚧

Until a reboot occurs...

the driver SWAgent.sys and service SwellService.exe will continue to run and show in their respective locations, however the application should be removed from installed programs.

Step 5: Verify Services Stopped

Once rebooted, we’ll want to verify success by checking the service.

  • Select Windows button + R to open the run dialog box
  • Type in services.msc
  • Search for StairwellForwarder
  • Open Powershell
  • Type in fltmc.exe
  • Search for SWAGENT

Step 6: Manual Cleanup

Remove any leftover Stairwell artifacts from the program files.

  • Navigate to C:\Program Files\Stairwell\ and delete all related folders and files
  • Navigate to registry keys and cleanup items
    • HKEY_LOCAL_MACHINE\SOFTWARE\Inception\Stairwell
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWAgent