IBM Support

Uninstalling IBM Security Host Protection for Windows

Technote (FAQ)


How do you uninstall IBM Security Host Protection for Windows?


Follow the instructions below to uninstall IBM Security Host Protector for Windows.

Note: Steps 3-5 are not mandatory but should be performed to clean up any leftover pieces from the installation, which are no longer needed.

  1. Before uninstalling the agent, you should first disable agent protection. To do this, open a command prompt and run the following:
    \Program Files (x86)\IBM\Host Protection\rapapp -ap <password>
    If no password is in use, run the following command:
    \Program Files (x86)\IBM\Host Protection\rapapp -ap
    Note: The path that is referenced above is configurable during the installation. This is the default path. You need to modify this if you used a custom directory.
  2. Once agent protection is disabled, run the following command from a command prompt to uninstall Host Protection for Windows agent:
    \Program Files (x86)\IBM\Host Protection\AgentRemove.exe -full
    An uninstall log will be generated in C:\Windows\AgentRemove.log.
  3. Open the registry and delete the registry keys that are listed below if they exist:
    Note: If you are running a 64-bit system, the first two entries are found under HKLM\Software\Wow6432Node.
    • HKLM\Software\Agent
    • HKLM\Software\ISS (Important: If your agent is installed on a system with other ISS products, do not remove this directory)
    • HKLM\System\CurrentControlSet\Services\blackICE
    • HKLM\System\CurrentControlSet\Services\RapAPP
    • HKLM\System\CurrentControlSet\Services\issfltr
    • HKLM\System\CurrentControlSet\Services\issnet
    • HKLM\System\CurrentControlSet\Services\issnfh
    • HKLM\System\CurrentControlSet\Services\W32Yelo
  4. Open a command prompt and run the following commands to remove the services if they exist:
    • sc delete VPatch
    • sc delete blackice
    • sc delete rapapp
    • sc delete ibmproventia
  5. Delete the following directories and files if they exist:
    • \Program Files\ISS\proventia server
    • \Windows\System32\blackdll.dll
    • \Windows\System32\drivers\blackcat.sys
    • \Windows\System32\drivers\MakoNT.sys
    • \Windows\System32\drivers\isskboep.sys
    • \Windows\System32\drivers\issnetv.sys
    • \Windows\System32\drivers\issnfhv.sys
  6. Reboot the server.

Finally, the agent within SiteProtector can be manually removed. To do this, go into the Agent view and right click the icon of the recently uninstalled agent. Then, click Delete for it to be removed.

Document information

More support for: IBM Security Host Protection

Software version: 2.1, 2.2, 2.2.2

Operating system(s): Windows

Reference #: 1616265

Modified date: 09 February 2015