Windows Enterprise Defender Virus

[Aidan]

My sister in law has given me her laptop to fix.  It has the ‘Windows Enterprise Defender’ (WED) virus on it.  It seems to have disabled McAfee.  I searched the web and found that most people were saying to download ‘Spyware Doctor’ and run a scan.  I downloaded Spyware Doctor and installed it on her laptop; however, it won’t run either.  I uninstalled it and installed it again, but it still won’t run.  I downloaded ‘SUPERAntiSpyware’ as well; I was able to run a scan with this program, but it has not been successful in removing the (WED) virus.  

Any help on this issue would be much appreciated.

Aidan,

[rodi]

Hello Aidan,

Maybe you should try to change Spyware Doctor's executable file (.exe, not shortcut). For example rename it to iexplore.exe or svchost.exe. Also try a random name like test123.exe. Update Spyware Doctor and run a scan. If that won't help, then try to boot your computer in 'safe mode with networking'. Then delete the following directories: (including files in those directories)

C:\Documents and Settings\All Users\Application Data\c9ba  (could be any random number in your case)
C:\Documents and Settings\All Users\Application Data\c9ba\WEDDSys
C:\Documents and Settings\All Users\Application Data\WEDDSys
C:\Documents and Settings%UserProfile%\Application Data\Windows Enterprise Defender

NOTE: %UserProfile% stands for your log in user name, usually it is 'Administrator'.

Then if you can, open Registry Editor and remove the following registry values:

HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WindowsEDefender.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" => "http://search-gala.com/?&uid=7&q={searchTerms}"
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes "URL"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
"[xSP_2:61a6083b6194a2314e3dd54cf9615e36_7]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "876902803"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows Enterprise Defender"

Next, downlaod Malwarebytes' anti-malware and scan your PC (in safe mode)
http://www.2-spyware.com/review-malwarebytes-anti-malware.html

Now, reboot your PC in normal mode, open Task Manager and kill these processes:
WindowsEDefender.exe
energy.exe
ppal.exe

Run a scan with an anti-spyware application again. If the problem persists download HijackThis, run a scan and post the log of the scan.
http://free.antivirus.com/hijackthis/

Good luck!

[Aidan]

hey, thanks for the reply, but I downloaded malwarebytes and it fixed the problem.

Cheers,