How to uninstall SecureAnywhere

These instructions are for uninstalling Webroot SecureAnywhere. If you need help uninstalling
an older Webroot product, click here.

Webroot SecureAnywhere does not require any removal tools to uninstall it from your
computer.
To uninstall Webroot SecureAnywhere:

Follow the correct steps for your Operating System.

Windows 8:

 Move your cursor to the bottom right of the screen to open the Charm Bar menu. Click
Search, then type "appwiz.cpl" (without quotes), and press Enter on your keyboard.

This will open your Control Panel to the list of all programs currently installed on your
computer.

Scroll down the programs list until you see the Webroot security product.

Click the Webroot security product entry once to select it, then click Uninstall/Remove.

When asked if you are sure you want to uninstall, click Yes to continue.

If prompted with a CAPTCHA, enter the requested characters and click Enter.

Webroot removes itself from your computer.

If you would now like to reinstall Webroot, click here for instructions.
Note: If you are reinstalling the software, please reboot your computer during this
process. However, if you are uninstalling SecureAnywhere to troubleshoot an issue, we
recommend you reboot your computer and test the issue before reinstalling.
If you are not able to uninstall SecureAnywhere using the steps above, click here for
troubleshooting uninstall problems.

How to Uninstall Webroot Completely From

a PC
Webroot's SecureAnywhere line of antivirus, firewall and security software protects your
business from online threats and data theft. If you have a technical problem with Webroot
SecureAnywhere, or if you want to upgrade or try a different protection program, you can
uninstall the software through the Windows Control Panel. In some cases, this does not
completely remove Webroot from your computer. Webroot offers two cleanup tools that will
remove all traces of the software from your system.

1.

Click the "Start" button on your desktop and select "Control Panel." Click "Uninstall a Program."

2.

Click the name of your Webroot product and then click "Uninstall."

3.

Click "Start," then right-click "Computer." Click "Properties," "System Protection" and "Create"
to set a system restore point.

4.

Open your Web browser and download the CleanWDF tool from the Webroot website (link in
Resources). Save the tool to your desktop.

5.

Double-click the "CleanWDF.exe" file on your desktop. Click "Clean" to remove all Webroot
drivers. When cleaning completes, click "Yes" to restart your computer at the prompt. If you
don't receive a prompt to restart, click "OK."

6.

Download the "WRUpgradeTool" file from the Webroot website (link in Resources). Save the
tool to your desktop.

7.

Double-click the "WRUpgradeTool" file on your desktop. Click "Next" to uninstall any
remaining Webroot files on your computer.

8.

Click "OK" to restart the computer when the tool finishes the cleanup process.

chiapeterson

Had the same issue many times. The C:\Program Files\Webroot\wrsa.exe -uninstall will work...
but first you need to delete C:\ProgramData\WRData.
level 2

1 point · 1 year ago

this guys knows whats up. you must delete that WRData folder.

If you have any access to the console, that's the "right" way. Otherwise...from safe mode only.
"C:\Program Files\Webroot\WRSA.exe" –uninstall

Webroot Removal Tool - Anyone have a tool

or script for it?
So taking over a client from another IT company, they used CentraStage for their RMM.
They have Webroot SecureAnywhere installed on all the rigs.

Thursday night I asked the prior tech to uninstall Webroot....and I'd get our N-Able AV-Defender
pushed out after that. Already got my agents pushed out from the server, N-Ables Bitdefender
has a lot of built in competitor removal/registry removal scripts built in....but apparently not for
webroot...as each workstations gives an error about current antivirus install needing
removal...and won't install AV-D.

Apparently CentraStages own removal process won't pull it either.

On Webroots website, I found one cleanup tool..but it appears only for older versions, and
running it doesn't remove what is installed....have tried it.

The tech sent me this...I've tried it but WR tends to reinstall after the first reboot, I find it still
running in the systray after that first reboot, and the registry entries are back.

Reaching out to you guys...especially if there are any CentraStage users here...to see if you have
any removal tools or better steps than below.

*********************************************************************
Run regedit.exe:

Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete WRSVC
Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WRUNINST
Delete HKLM\SOFTWARE\WRData
Delete HKLM\SYSTEM\ControlSet001\services\WRSVC
Delete HKLM\SYSTEM\ControlSet002\services\WRSVC
Delete HKLM\SYSTEM\CurrentControlSet\services\WRSVC

From the command prompt:

sc.exe \\%hostname% delete WRSVC

Reboot the desktop

After the reboot, log in and:

Webroot should not be in the system tray.

Delete C:\ProgramData\WRData
Delete C:\Program Files\Webroot
Delete C:\Program Files (x86)\Webroot
*********************************************

I know with N-Able, we have maintenance windows which ensure apps (like AV-D and patch
manager) are installed on clients rigs....if a client removes them, it shoves them back in. I asked
the tech to double check that....he said that once the workstations are removed from their
Webroot control panel, it should not do that. Myself not knowing CentraStage at all....just
wondering if any CS users here know that he is being accurate, or perhaps forgetting a setting or
not knowing about some other enforcement setting.

You might be able to run this from admin CMD "wrsa.exe -uninstall" from install directory.

Before trying to uninstall or run the removal tool have you tried deactivating the computer in
the MyWebroot Account Console?

Go to the PC Security tab.

Click on the computer if it is listed.
Go to the Advanced Options tab.
Click Deactivate Computer.
After you Deactivate the the computer then reboot, it is supposed to send an uninstall code to
remove Webroot SecureAnywhere.

Also can they not use a third party uninstaller like Revo Uninstaller or GeekUninstaller to
remove everything Webroot SecureAnywhere related?

I had a consumer machine like this. I ended up having to boot to parted magic, delete the web
root folder out of program files, then disable it's startup entries. Not a clean way but effective.

Before trying to uninstall or run the removal tool have you tried deactivating the computer in
the MyWebroot Account Console?

Also can they not use a third party uninstaller like Revo Uninstaller or GeekUninstaller to
remove everything Webroot SecureAnywhere related?

He said he "deactivated" them in the console...I don't have access to their console.
I tried revo....on the reboot it was back.

I had a consumer machine like this. I ended up having to boot to parted magic, delete the web
root folder out of program files, then disable it's startup entries. Not a clean way but effective.

I may have to resort to that...was hoping to avoid an onsite just for the onboarding task.

Did you try http://download.webroot.com/WRUpgradeTool.exe?

Got the info from:

http://www.webroot.com/prodCheck/?p...ppc`lkik^^afhgpewgfa&opi=2&omj=6&omn=1&osl=e
n

Yeah that's the removal tool I tried from their site......seems to work only on older versions of
WR.

A program known as AppRemover will do it, but here's the hitch: they were bought by a
company known as Gears. The AppRemover product will still work, but you can't automate it --
unless you buy the pro version. I think your current script should work, but if you'd like to
explore AppRemover/Gears: http://www.appremover.com/
Must be 6/7 months since I had to remove Webroot, if I remember correctly I had to search for
WRSVC & Webroot in the Registry to remove it. There were other names to search for, can't
remember them now but I got clues from the webroot entries. It never came back.

It might be worth running Eset AV Remover also, it's part of Windows Repair Toolbox.

NB: This was on a residential machine.

Are these two files getting uninstalled:

1. C:\Windows\System32\Drivers\WRKrn.sys
This is the driver that does all the file filtering, system monitoring, etc.

2. C:\Windows\System32\WRusr.dll or C:\Windows\SysWow64\WRusr.dll
This loads for user mode analysis. It's responsible for WRSA running as a user mode service.
WRSA will be loaded equally proportionately to the number of user profiles that are loaded
because of this file.

Also I didn't see these two listed in your post above:

1. C:\Users\*User Account Name*\AppData\Local\Webroot

Backup & Sync

2. C:\Users\*User Account Name*\AppData\Roaming\Mozilla\Firefox\Profiles\*Your

Profile*\extensions\{8ac62a8b-8b3f-43ba-9b1a-90c299b9dfda}
Firefox toolbar

Has he tried uninstalling WRSA in safe mode withOUT networking?

Have you tried using Process Explorer to suspend and/or kill WRSA?

Have you used Autoruns to see if WRSA is re-loading anywhere else?

Have you tried running RKILL before uninstalling WRSA?

It might be worth running Eset AV Remover also, it's part of Windows Repair Toolbox.
.
 Esets tool doesn't cover current versions of WR, it won't even detect it.
Process Explorer can't suspend or kill it.

RKill won't find it.....

1.

wavey Active Member

Esets tool doesn't cover current versions of WR, it won't even detect it.
Process Explorer can't suspend or kill it.

Ok, it must have been a previous version, I used Proexp & Autoruns to stop it.
Good luck ;-)

2.

Went onsite today, yeah safe mode, logging in as local admin, bang the registry, bounce into
safe mode again, bounce...then run a WMI cleanup tool that N-Able has to get the WMI entries
out....BitDefender still detects stuff and doesn't like to install via the "cleanup/remove" push
install. It however install with "no removal" option selected. But I don't like that.

Turned into a pissing contest with the outgoing IT people today...what a tennis match of e-mails.
It's only professional if you're the exiting IT people to remove all of your RMM tools and
services, clean it all up. Their contract ends July 31...and they're saying they're going to charge
the client for removing their stuff. LOL.

I know this is late but all the previous IT company had to do was trigger an uninstall from their
Webroot console then deactivate in the console. Deactivate does not uninstall. It simply makes
it not count against a license in the console. Strange but true. There is currently no integration
between Centrastage and Webroot. It's coming but as of now Webroot is managed separately.

3.

I know this thread is a bit old, but I just wasted an hour trying to get rid of SecureAnywhere. I
too took over an account, and the previous company was completely unresponsive. I found the
solution:
-- Boot into Safe Mode (w/ Networking is ok).
-- Open admin cmd.
-- "C:\Program Files (x86)\Webroot\WRSA.exe" -uninstall

You have to be in safe mode for that to work - executing from normal mode results in a message
stating that "SecureAnywhere is currently managed by the web console."
Hope this helps someone else! What a frustrating situation...

Serious thread necro, but I felt having an actual support response on this topic may help
someone:

Hello,

Thank you for contacting Webroot Business Support.

Unfortunately, we don't have an uninstall utility.

There are two ways to uninstall the Endpoint agent.

-- Option 1: Uninstall from the console using Agent Commands --

1. Sign into your Webroot console.

2. Select the Group Management tab followed by the endpoint(S) you'd like to uninstall
3. Open the Agent Commands menu and select Agent > Uninstall

As you said this will be executed with the next polling interval. However, if you would like to
expedite the process, go to the machine locally and right click on the Webroot system tray icon.
Select "Refresh Configuration" and click "OK". This will force a polling interval

** Note: by selecting Uninstall, the SecureAnywhere agent will be removed; however the listing
for the workstation will remain. We recommend you create a group called "Uninstalled Clients"
into which these can be moved. If you prefer to completely remove a listing, you can select the
red "Do not enter" button for "Deactivate." This endpoint will no longer check in with your
console unless you request we reactivate it in the cloud.

-- Option 2: Uninstall on the endpoint in Safe Mode with Networking --

***For instructions on starting in Safe Mode with Networking click here.***

1. After Booting into SafeMode with Networking, open the Command Prompt.
2. Type in "C:\Program Files\Webroot\WRSA.exe" -uninstall

***(You may need to adjust the file path if you've changed the install directory)***

3. Enter in the CAPTCHA puzzle.

4. Reboot into normal Windows mode and test.

Let us know if we can assist further.

Regards,
Josko
Webroot Business Support

Click to expand...

Oh, and if anyone runs into an MSP that wants to charge to remove their junk, tell them they
can pound sand. Because removing Webroot from a client is a simple matter of ticking the select
all box, and clicking deactivate.