A friend of mine had accidentally installed RAV Endpoint protection from Reasonlabs and uninstalling it turned out to be incredibly demanding. This app does not want to be removed. Some websites suggest third party uninstallers, but I wanted to avoid those, since they themselves might require high permissions and pose a security risk.
Here is some information about the process and what was succesfull:
The application appeared in Windows’ Installed Apps list and in the older Programs and Features window, but neither removal route worked. Its own uninstaller either did nothing or exited with an error. Several ReasonLabs services continued running, and some of them refused to stop—even when commands were executed with administrator and SYSTEM privileges.
This article documents the removal process that ultimately worked. It is intended for technically confident Windows users dealing with the same broken uninstall situation.
Important: These steps modify Windows services and the offline registry. Create a restore point first, back up important files, and copy commands carefully. Remove only entries that you have positively identified as belonging to ReasonLabs. If the normal uninstaller works, use it and stop there.
1. Confirm that RAV is actually present
Open PowerShell as Administrator and check Windows Security’s registered antivirus products:
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct |
Select-Object displayName, pathToSignedProductExe
RAV may appear as Reason Cybersecurity, with an executable inside:
C:\Program Files\ReasonLabs\
Next, identify its services:
Get-Service |
Where-Object {
$_.Name -match 'RAV|Reason|rsEngine' -or
$_.DisplayName -match 'RAV|Reason'
} |
Select-Object Status, Name, DisplayName
Our installation initially contained these services:
rsClientSvc— Reason Security EPP Client ServicersEDRSvc— Reason Cybersecurity EDR ServicersEngineSvc— Reason Security Engine ServicersSyncSvc— Reason Security Sync ServicersVPNSvc— RAV VPN ServicersWSC— Reason WSC Service
2. Try the supplied uninstallers first
Before removing anything manually, search the ReasonLabs directory for its own uninstallers:
Get-ChildItem 'C:\Program Files\ReasonLabs' -Recurse -Force -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'uninstall|unins|remove|setup' } | Select-Object FullName
Our installation contained:
C:\Program Files\ReasonLabs\EDR\Uninstall.exe
C:\Program Files\ReasonLabs\EPP\Uninstall.exe
Run the main EPP uninstaller as administrator:
$process = Start-Process 'C:\Program Files\ReasonLabs\EPP\Uninstall.exe' -Verb RunAs -Wait -PassThru
$process.ExitCode
In our case, no window appeared and the exit code was 6. The EDR uninstaller did run and successfully removed the EDR component, but the main EPP antivirus remained.
Restart after running an uninstaller, because antivirus removal is often completed during boot.
3. Disable the services that Windows allows you to disable
Create a restore point before making manual changes:
Checkpoint-Computer -Description 'Before ReasonLabs removal' -RestorePointType MODIFY_SETTINGS
Then attempt to disable the known services:
$reasonServices = @(
'rsClientSvc',
'rsEngineSvc',
'rsSyncSvc',
'rsVPNSvc',
'rsWSC'
)
foreach ($service in $reasonServices) {
sc.exe config $service start= disabled
}
Windows allowed us to disable rsClientSvc, rsSyncSvc, and rsVPNSvc. The protected rsEngineSvc and rsWSC services returned Access is denied.
After restarting, the three disabled services remained stopped. The engine and Windows Security integration were still running.
4. Check for drivers before deleting files
Do not delete the ReasonLabs folder while services or drivers still reference it. Check for drivers first:
Get-CimInstance Win32_SystemDriver |
Where-Object {
$_.DisplayName -match 'RAV|Reason' -or
$_.PathName -match 'ReasonLabs|RAV'
} |
Select-Object State, StartMode, Name, DisplayName, PathName
Be careful with partial text matches. Our first search accidentally displayed iaStorAVC, which is an Intel storage controller driver—not a ReasonLabs component. Removing an unrelated storage driver could prevent Windows from starting.
No actual ReasonLabs driver was found on our machine.
5. Remove the unprotected service registrations
The services that had been disabled could be unregistered normally:
foreach ($service in $reasonServices) {
sc.exe delete $service
}
The three unprotected services were deleted successfully. The two protected services again returned Access is denied.
We also tried running Service Control under the SYSTEM account with Microsoft Sysinternals PsExec. Even SYSTEM access was denied, which confirmed that ReasonLabs’ tamper protection was blocking changes inside normal Windows.
At that point, the protected service registrations had to be removed while Windows—and therefore RAV—was offline.
6. Remove the protected services from Windows Recovery Environment
Before entering recovery, make sure you have your Windows account password and, if device encryption is enabled, access to your BitLocker recovery key.
Hold Shift while choosing Restart, then select:
Troubleshoot → Advanced options → Command Prompt
The Windows partition is not always assigned C: in recovery. Find it with:
for %d in (C D E F) do if exist %d:\Windows\System32\Config\SYSTEM echo Windows is on %d:
The result on our computer was C:. Substitute the correct letter in the commands below if yours is different.
Load the offline SYSTEM registry hive:
reg load HKLM\OFFSYS C:\Windows\System32\Config\SYSTEM
Delete only the two confirmed ReasonLabs service keys:
reg delete HKLM\OFFSYS\ControlSet001\Services\rsEngineSvc /f
reg delete HKLM\OFFSYS\ControlSet001\Services\rsWSC /f
reg delete HKLM\OFFSYS\ControlSet002\Services\rsEngineSvc /f
reg delete HKLM\OFFSYS\ControlSet002\Services\rsWSC /f
It is normal for commands targeting a nonexistent secondary ControlSet to report that the key was not found.
Unload the registry hive properly:
reg unload HKLM\OFFSYS
Exit Command Prompt and continue into Windows.
7. Remove the leftover Windows Security registration
After rebooting, ReasonLabs no longer had active antivirus services or processes, but Windows Security still listed Reason Cybersecurity. That was only a stale registration.
Remove it from an elevated PowerShell window:
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct |
Where-Object { $_.displayName -eq 'Reason Cybersecurity' } |
Remove-CimInstance
8. Find the separate DNS-filtering services
Deleting the ReasonLabs folders initially failed because files in the DNS directory were still in use. The earlier service search had missed two services whose display names did not contain “Reason” or “RAV.”
Searching by executable path revealed them:
$leftoverServices = Get-CimInstance Win32_Service |
Where-Object { $_.PathName -match '\\ReasonLabs\\' }
$leftoverServices |
Select-Object Name, State, StartMode, DisplayName, PathName
They were:
rsDNSResolver— Safer Web DNS ResolverrsDNSSvc— Safer Web Service
Stop, disable, and unregister every service whose executable path is inside the confirmed ReasonLabs directory:
foreach ($service in $leftoverServices) {
sc.exe stop $service.Name
sc.exe config $service.Name start= disabled
sc.exe delete $service.Name
}
Then stop any remaining processes running from that directory:
Get-CimInstance Win32_Process |
Where-Object { $_.ExecutablePath -like 'C:\Program Files\ReasonLabs\*' } |
ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
Restart Windows again.
9. Delete the leftover files
Once all ReasonLabs services and processes were gone, the folders could finally be deleted:
Remove-Item 'C:\Program Files\ReasonLabs' -Recurse -Force
Remove-Item 'C:\ProgramData\ReasonLabs' -Recurse -Force
Verify that both paths are gone:
Test-Path 'C:\Program Files\ReasonLabs'
Test-Path 'C:\ProgramData\ReasonLabs'
Both commands should return:
False
10. Perform final verification
Check that no service still points into the ReasonLabs directory:
Get-CimInstance Win32_Service |
Where-Object { $_.PathName -match '\\ReasonLabs\\' } |
Select-Object Name, State, PathName
This should produce no output.
Check the antivirus providers registered with Windows:
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct |
Select-Object displayName
Reason Cybersecurity should no longer appear.
Finally, verify Microsoft Defender’s status:
Get-MpComputerStatus |
Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled
If Microsoft Defender is the intended antivirus, all three values should normally be True. Another installed antivirus may intentionally place Defender into passive mode.
Run a full malware scan afterward:
Windows Security → Virus & threat protection → Scan options → Full scan
What ultimately worked
The important discovery was that RAV was not one removable item. It consisted of several layers:
- The visible EPP application
- A separate EDR component
- Protected engine and Windows Security services
- VPN and synchronization services
- A separate “Safer Web” DNS-filtering component
- A Windows Security registration
- Program and data folders
The successful removal order was therefore:
- Try the official uninstallers
- Disable and unregister ordinary services
- Confirm that no ReasonLabs drivers are present
- Remove protected service keys offline
- Remove the stale Windows Security registration
- Identify services by their executable paths, which exposed the overlooked DNS filter
- Restart and delete the remaining folders
- Verify that Defender or another chosen antivirus is active
The largest mistake would have been deleting C:\Program Files\ReasonLabs at the beginning. That would have left services and security registrations pointing to missing files, making the system harder—not easier—to repair.