How to Remove Windows Enterprise Defender (Removal Guide)
Windows Enterprise Defender is a rogue antivirus application that uses the name of Windows Defender and the similarities of their name to appear as an official product or add on to windows. Of course, the real Windows Defender is a legitimate application, but Windows Enterprise Defender is a rogue antivirus application that gives false warnings about security problems (which are also falsified) and it encourages you to pay for the ability to fix the problems. So, read on for information that will help you to remove Windows Enterprise Defender.
One of the interesting “tricks” this rogue antivirus plays is creating the following files that it claims are viral:
%userprof%\Recent\cb.sys
%userprof%\Recent\ddv.dll
%userprof%\Recent\eb.sys
%userprof%\Recent\energy.exe
%userprof%\Recent\pal.sys
%userprof%\Recent\PE.drv
%userprof%\Recent\ppal.exe
%userprof%\Recent\tempdoc.tmp
The files are harmless, but are used as evidence by Windows Enterprise Defender that you need to purchase their software and then you will be able to remove the “threat” that these files pose.
The following site is related to Windows Enterprise Defender and it would be good to block it at the firewall or router if possible:
windowsenterprisedefender.com
You may also want to go ahead and download malwarebytes antimalware from the virus removal toolkit page. If you are not able to run the install for the program there are a couple things you could try. 1) rename the install file (mbam.exe) to something else (bob.exe) and then attempt to run the installer, update and scan. 2) boot into safe mode and retry the installer. 3) The last idea is to kill off the following processes via task manager (the same as you would do to start a manual removal of Windows Enterprise Defender.)
The following processes should be killed off using task manager (or Process explorer – which you can download on the virus removal toolkit page.)
ppal.exe
energy.exe
WindowsEDefender.exe
There may be a variable component to the naming of these files, you may want to be alert to possible variations in the naming above. If task manager is not able to be opened so that you can disable the processes, you may try process explorer as an alternative or rename task managers executable file. (taskmgr.exe) (My preference is to copy and paste then rename the file.)
The following dll files should be unregistered and deleted:
ddv.dll
mozcrt19.dll
sqlite3.dll
The following files and folders should also be deleted to remove Windows Enterprise Defender:
%docs%\All Users\Application Data\c9ba
%docs%\All Users\Application Data\c9ba\83.mof
%docs%\All Users\Application Data\c9ba\mozcrt19.dll
%docs%\All Users\Application Data\c9ba\sqlite3.dll
%docs%\All Users\Application Data\c9ba\unins000.dat
%docs%\All Users\Application Data\c9ba\WED.ico
%docs%\All Users\Application Data\c9ba\WindowsEDefender.exe
%docs%\All Users\Application Data\c9ba\WEDDSys
%docs%\All Users\Application Data\c9ba\WEDDSys\vd952342.bd
%docs%\All Users\Application Data\WEDDSys
%docs%\All Users\Application Data\WEDDSys\wed.cfg
%userprof%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Enterprise Defender.lnk
%userprof%\Application Data\Windows Enterprise Defender
%userprof%\Application Data\Windows Enterprise Defender\cookies.sqlite
%userprof%\Desktop\Windows Enterprise Defender.lnk
%userprof%\Recent\cb.sys
%userprof%\Recent\ddv.dll
%userprof%\Recent\eb.sys
%userprof%\Recent\energy.exe
%userprof%\Recent\pal.sys
%userprof%\Recent\PE.drv
%userprof%\Recent\ppal.exe
%userprof%\Recent\tempdoc.tmp
%userprof%\Start Menu\Windows Enterprise Defender.lnk
%userprof%\Start Menu\Programs\Windows Enterprise Defender.lnk
%progfiles%\Mozilla Firefox\searchplugins\search.xml
After all of the above files are removed you still will want to run a reputable antivirus/spyware removal tool (perhaps a run with each…) such as malwarebytes antimalware (which you can download on the virus removal toolkit page.) You will want to do this so that you can be sure to remove Windows Enterprise Defender completely.