How can I make sure MetaDefender Endpoint is completely removed from my endpoint?
This article applies to all MetaDefender Endpoint releases deployed on Windows and macOS systems.
For detailed instructions on how to uninstall MetaDefender Endpoint, please Read This before returning to this page to validate your uninstall and, if required, remove any remaining Client components.
In rare cases, following uninstall, certain MetaDefender Endpoint components may remain on your system, requiring manual removal.
Such instances have been well documented by the OPSWAT team, so candidate components can be easily identified and removed via the methods listed below.
Windows (32-bit or 64-bit)
- Open Task Manager and click on the Details tab.
- If any of the following MetaDefender Endpoint related items appear on the list, right-click them and select the End Process option.
- waodwd.exe
- wabpoes.exe
- wabpmsn.exe
- Gears.exe
- GearsHelper.exe
- GearsAgentService.exe
- wa_3rd_party_host_32.exe
- GearsInstaller.exe
- GearsSdkInstaller.exe
- OPSWATClientUI.exe
- owcjls.exe
Now, click on the Services tab to check whether either of the following services related to MetaDefender Endpoint still appear on the list.
- OPSWAT GEARS Client
- OPSWAT GEARS Helper
If either of these OPSWAT services are still running, open a Command Prompt and select the Run as Administrator option. Then, enter the appropriate command from the options below.
- sc delete opswatgearshelper
- sc delete waondemand
Once all MetaDefender Endpoint services are stopped, go to C:\Program Files(x86)\OPSWAT (on 64-bit) or Program Files (on 32-bit) and delete any of the following MetaDefender Endpoint related folders that may remain.
- GEARS Client
- OnDemand
- GEARS Client.bak
Delete the following folder: C:\ProgramData\OPSWAT\Gears
Next, open Regedit, then find and delete the following registry keys, but take note that the Wow6432Node segment is omitted from the key path on 32-bit systems.
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OPSWAT\Gears Client
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OPSWAT\OnDemand
Search the registry for other keys containing the word OPSWAT, then delete them.
Users with other OPSWAT products installed on their systems (that they do not wish to uninstall) will need to check which OPSWAT registry keys are related to their other products, and then only delete the Client related registry keys.
If you have any doubt or queries in this regard, please follow the instructions at the end of this article to contact OPSWAT Support.
- Finally, Restart your machine.
macOS
- Open your Activity Monitor and enter each of the following into the Search field to check whether any of the Client services are still running.
- OPSWAT Client
- opswat-gears-od
- GearsCLI
- GearsHelper
- If any of the above processes remain, do the following:
- Open Finder and type /Library/LaunchDaemons into the search field, then check the folder for any of the following files related to the MetaDefender Endpoint.
- com.opswar.GearsCLI.plist
- com.opswat.GearsHelper.plist
- com.opswat.GearsUpdater.plist
- Finally, Restart your machine.
For any queries about Ensuring That MetaDefender Endpoint Is Fully Removed From Your System, Or Identifying Other OPSWAT Registry Keys, please open a Support Case with the OPSWAT team via phone, online chat or form, or feel free to ask the community on our OPSWAT Expert Forum.