Uninstalling the Windows forwarder

Manual Uninstallation of 1.4.x

Step 1: Enter Maintenance Mode

• Open cmd.exe
• Run the following command: C:\Program Files\Stairwell\SwellService\SwellService.exe -mainttoken=$token

Step 2: Repair Stairwell

• Open Control Panel
• Find the StairwellForwarderBundle.exe
• Select Repair

Step 3: Re-enter Maintenance Mode

• Open cmd.exe
• Run the following command: C:\Program Files\Stairwell\SwellService\SwellService.exe -mainttoken=$token

Step 4: Uninstall Forwarder

• Open cmd.exe
• Run the following command: .\StairwellForwarderBundle-1.4.0.886.exe /u /Log StairwellUninstall.log /q /norestart

🚧

Until a reboot occurs...

the driver SWAgent.sys and service SwellService.exe will continue to run and show in their respective locations, however the application should be removed from installed programs.

Step 5: Verify Services Stopped

Once rebooted, we’ll want to verify success by checking the service.

• Select Windows button + R to open the run dialog box
• Type in services.msc
• Search for StairwellForwarder
• Open Powershell
• Type in fltmc.exe
• Search for SWAGENT

Step 6: Manual Cleanup

Remove any leftover Stairwell artifacts from the program files.

• Navigate to C:\Program Files\Stairwell\ and delete all related folders and files
• Navigate to registry keys and cleanup items
  • HKEY_LOCAL_MACHINE\SOFTWARE\Inception\Stairwell
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWAgent