Steps to uninstall IBM Security Host Protection for Windows

Technote (FAQ)


How do you uninstall IBM Security Host Protection for Windows?


Follow the instructions below to uninstall IBM Security Host Protector for Windows.

Note: Steps 3-5 are not mandatory but should be performed to cleanup any leftover pieces from the install which are no longer needed.

  1. Prior to uninstalling the agent, you should first disable agent protection. To do this, open a command prompt and run the following:

    <drive>:\Program Files (x86)\IBM\Host Protection\rapapp -ap <password>

    If no password is in use, run the following command:

    <drive>:\Program Files (x86)\IBM\Host Protection\rapapp -ap

    Note: The path referenced above is configurable during the installation. This is the default path. You will need to modify this if you used a custom directory.

  2. Once agent protection is disabled, run the following command from a command prompt to uninstall Host Protection for Windows agent:

    <drive>:\Program Files (x86)\IBM\Host Protection\AgentRemove.exe -full

    An uninstall log will be generated in C:\Windows\AgentRemove.log.

  3. Open the registry and delete the registry keys listed below if they exist:

    Note: If you are running a 64-bit system, the first two entries will be found under HKLM\Software\Wow6432Node.
    • HKLM\Software\Agent
    • HKLM\Software\ISS (Important: If your agent is installed on a system with other ISS products, do not remove this directory)
    • HKLM\System\CurrentControlSet\Services\blackICE
    • HKLM\System\CurrentControlSet\Services\RapAPP
    • HKLM\System\CurrentControlSet\Services\issfltr
    • HKLM\System\CurrentControlSet\Services\issnet
    • HKLM\System\CurrentControlSet\Services\issnfh
    • HKLM\System\CurrentControlSet\Services\W32Yelo

  4. Open a command prompt and run the following commands to remove the services if they exist:
    • sc delete VPatch
    • sc delete blackice
    • sc delete rapapp
    • sc delete ibmproventia

  5. Delete the following directories and files if they exist:
    • \Program Files\ISS\proventia server
    • \Windows\System32\blackdll.dll
    • \Windows\System32\drivers\blackcat.sys
    • \Windows\System32\drivers\MakoNT.sys
    • \Windows\System32\drivers\isskboep.sys
    • \Windows\System32\drivers\issnetv.sys
    • \Windows\System32\drivers\issnfhv.sys

  6. Reboot the server.

Finally, the agent within SiteProtector can be manually removed. To do this, go into the Agent view and right click on the icon of the recently uninstalled agent. Then, click Delete for it to be removed.

Document information

More support for:

IBM Security Host Protection

Software version:

2.1, 2.2, 2.2.2

Operating system(s):


Reference #:


Modified date:


Translate my page

Content navigation