Blocked from updating Windows Defender on Windows 7 Enterprise x64

[Zeroaccesstroja]

Dear Sevenforums experts,

i am unable to turn on real time protection nor update to the latest malware defintions, its possible i am blocked due to group policy, here are attached frst and addition logs

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 07-12-2019
Ran by j (administrator) on J-PC (Dell Inc. Latitude E4310) (10-12-2019 15:39:47)
Running from C:\Users\j\Desktop
Loaded Profiles: j (Available Profiles: j)
Platform: Windows 7 Enterprise Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Users\j\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Tweaking LLC -> Tweaking.com) C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1239035355-3179000145-829395696-1000\...\Run: [Google Update] => C:\Users\j\AppData\Local\Google\Update\1.3.35.342\GoogleUpdateCore.exe [218920 2019-12-10] (Google Inc -> Google LLC)
HKU\S-1-5-21-1239035355-3179000145-829395696-1000\...\Policies\Explorer: [NoViewContextMenu] 0
GroupPolicy: Restriction ? <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {436C71B0-E522-4E83-99F6-804859EE3944} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [1174016 2014-04-20] (Microsoft Windows -> Microsoft Corporation)
Task: {809E0129-B4A4-4D0E-8CC6-D2BF0BB2A8BF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1239035355-3179000145-829395696-1000UA => C:\Users\j\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2019-12-10] (Google Inc -> Google Inc.)
Task: {C5CEBDAB-78D4-4FA7-BFA7-A2A666C5824B} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [218336 2017-05-02] (Tweaking LLC -> Tweaking.com)
Task: {DD15AFAB-C056-446E-9517-87822C25D3A4} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [410784 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {DD820CA8-BDCC-41FA-876B-CC08AEE5CC5D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1239035355-3179000145-829395696-1000Core => C:\Users\j\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2019-12-10] (Google Inc -> Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5-x64 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5-x64 09 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0C7F2758-66E3-4A6F-9CB2-19413BA4D626}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-1239035355-3179000145-829395696-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2014-04-20] (Microsoft Windows -> Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2014-04-20] (Microsoft Windows -> Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2014-04-20] (Microsoft Windows -> Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2014-04-20] (Microsoft Windows -> Microsoft Corporation)

FireFox:
========
FF Plugin HKU\S-1-5-21-1239035355-3179000145-829395696-1000: tools.google.com/Google Update;version=3 -> C:\Users\j\AppData\Local\Google\Update\1.3.35.342\npGoogleUpdate3.dll [2019-12-10] (Google Inc -> Google LLC)
FF Plugin HKU\S-1-5-21-1239035355-3179000145-829395696-1000: tools.google.com/Google Update;version=9 -> C:\Users\j\AppData\Local\Google\Update\1.3.35.342\npGoogleUpdate3.dll [2019-12-10] (Google Inc -> Google LLC)

Chrome:
=======
CHR Profile: C:\Users\j\AppData\Local\Google\Chrome\User Data\Default [2019-12-10]
CHR Extension: (Slides) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2019-12-10]
CHR Extension: (Docs) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-12-10]
CHR Extension: (Google Drive) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-12-10]
CHR Extension: (YouTube) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-12-10]
CHR Extension: (Sheets) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2019-12-10]
CHR Extension: (Google Docs Offline) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2019-12-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-12-10]
CHR Extension: (Gmail) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-12-10]
CHR Extension: (Chrome Media Router) - C:\Users\j\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-12-10]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
S2 PCloudCleanerService; C:\Windows\SysWow64\PCloudCleanerService.exe [108792 2019-12-10] (Panda Security S.L -> Panda Security S.L.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Windows -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation -> Microsoft Corporation)
R3 netr28ux; C:\Windows\System32\DRIVERS\netr28ux.sys [2246488 2015-11-19] (MEDIATEK INC. -> MediaTek Inc.)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation -> Microsoft Corporation)
U2 KillEmAllPlusService; no ImagePath
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-12-10 15:44 - 2019-12-10 15:44 - 000281376 _____ (Kaspersky Lab, Yury Parshin) C:\Windows\system32\Drivers\09976633.sys
2019-12-10 15:41 - 2019-12-10 15:42 - 000007311 _____ C:\Users\j\Downloads\Result.txt
2019-12-10 15:41 - 2019-12-10 15:41 - 000957952 _____ (Farbar) C:\Users\j\Downloads\ListParts64.exe
2019-12-10 15:36 - 2019-12-10 15:39 - 000002196 _____ C:\Users\j\Desktop\Fixlog.txt
2019-12-10 13:46 - 2012-02-16 22:38 - 001112064 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2019-12-10 13:46 - 2012-02-16 22:38 - 001031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2019-12-10 13:46 - 2012-02-16 21:34 - 000826880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2019-12-10 13:46 - 2012-02-16 20:58 - 000210944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2019-12-10 13:46 - 2012-02-16 20:57 - 000023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2019-12-10 13:21 - 2019-12-10 13:23 - 000018596 _____ C:\Users\j\Desktop\Addition.txt
2019-12-10 13:19 - 2019-12-10 13:35 - 000000000 ____D C:\Users\j\Desktop\d7
2019-12-10 13:19 - 2014-05-14 08:23 - 002477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2019-12-10 13:19 - 2014-05-14 08:23 - 000058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2019-12-10 13:19 - 2014-05-14 08:23 - 000044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2019-12-10 13:19 - 2014-05-14 08:21 - 002620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2019-12-10 13:18 - 2019-12-10 15:43 - 000009567 _____ C:\Users\j\Desktop\FRST.txt
2019-12-10 13:18 - 2019-12-10 13:18 - 002263552 _____ (Farbar) C:\Users\j\Desktop\FRST64.exe
2019-12-10 13:18 - 2019-12-10 13:18 - 000000000 ____D C:\Users\j\Desktop\FRST-OlderVersion
2019-12-10 13:18 - 2019-11-21 02:42 - 000602112 _____ (OldTimer Tools) C:\Users\j\Desktop\OTL.exe
2019-12-10 13:11 - 2014-05-14 08:23 - 000700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2019-12-10 13:11 - 2014-05-14 08:23 - 000581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2019-12-10 13:11 - 2014-05-14 08:23 - 000038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2019-12-10 13:11 - 2014-05-14 08:23 - 000036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2019-12-10 13:11 - 2014-05-14 08:20 - 000097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2019-12-10 13:11 - 2014-05-14 08:17 - 000092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2019-12-10 13:08 - 2019-12-10 13:08 - 000003160 _____ C:\Windows\system32\Tasks\SidebarExecute
2019-12-10 13:07 - 2014-05-14 09:23 - 000198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2019-12-10 13:07 - 2014-05-14 09:23 - 000179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2019-12-10 13:07 - 2014-05-14 09:20 - 000036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2019-12-10 13:07 - 2014-05-14 09:17 - 000033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2019-12-10 13:03 - 2019-12-10 13:03 - 000713888 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2019-12-10 12:53 - 2019-12-10 12:53 - 000000207 _____ C:\Windows\tweaking.com-regbackup-J-PC-Windows-7-Enterprise-(64-bit).dat
2019-12-10 12:52 - 2019-12-10 12:52 - 000003638 _____ C:\Windows\system32\Tasks\Tweaking.com - Windows Repair Tray Icon
2019-12-10 12:52 - 2019-12-10 12:52 - 000002159 _____ C:\Users\j\Desktop\Tweaking.com - Windows Repair.lnk
2019-12-10 12:52 - 2019-12-10 12:52 - 000000000 ____D C:\Users\j\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2019-12-10 12:52 - 2019-12-10 12:52 - 000000000 ____D C:\RegBackup
2019-12-10 12:52 - 2019-12-10 12:52 - 000000000 ____D C:\Program Files (x86)\Tweaking.com
2019-12-10 12:51 - 2019-12-10 12:52 - 000194478 _____ C:\Windows\Tweaking.com - Windows Repair Setup Log.txt
2019-12-10 12:47 - 2019-12-10 12:47 - 000002359 _____ C:\Users\j\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-12-10 12:47 - 2019-12-10 12:47 - 000002322 _____ C:\Users\j\Desktop\Google Chrome.lnk
2019-12-10 12:46 - 2019-12-10 12:57 - 000003502 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskUserS-1-5-21-1239035355-3179000145-829395696-1000UA
2019-12-10 12:46 - 2019-12-10 12:57 - 000003230 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskUserS-1-5-21-1239035355-3179000145-829395696-1000Core
2019-12-10 12:45 - 2019-12-10 12:45 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2019-12-10 12:45 - 2019-12-10 12:45 - 000000000 ____D C:\ProgramData\Mediatek Driver
2019-12-10 12:45 - 2015-11-19 16:06 - 002246488 _____ (MediaTek Inc.) C:\Windows\system32\Drivers\netr28ux.sys
2019-12-10 12:45 - 2015-11-19 16:06 - 000343712 _____ (Mediatek Inc.) C:\Windows\system32\RaCoInstx.dll
2019-12-10 12:45 - 2015-11-19 15:57 - 000079216 _____ C:\Windows\SysWOW64\Drivers\FW_7662.bin
2019-12-10 12:45 - 2015-11-19 15:57 - 000079216 _____ C:\Windows\system32\Drivers\FW_7662.bin
2019-12-10 12:45 - 2015-11-19 15:57 - 000020626 _____ C:\Windows\SysWOW64\Drivers\Patch_7662.bin
2019-12-10 12:45 - 2015-11-19 15:57 - 000020626 _____ C:\Windows\system32\Drivers\Patch_7662.bin
2019-12-10 12:45 - 2015-11-19 15:57 - 000016389 _____ C:\Windows\SysWOW64\RaCoInst.dat
2019-12-10 12:45 - 2015-11-19 15:57 - 000016389 _____ C:\Windows\system32\RaCoInst.dat
2019-12-10 12:41 - 2019-12-10 15:33 - 000000000 ____D C:\Users\j\AppData\Local\Google
2019-12-10 12:18 - 2019-12-10 12:21 - 000179952 _____ C:\TDSSKiller.3.1.0.28_10.12.2019_12.18.44_log.txt
2019-12-10 12:11 - 2019-12-10 12:18 - 000063564 _____ C:\TDSSKiller.2.5.11.0_10.12.2019_12.11.33_log.txt
2019-12-10 12:09 - 2019-12-10 12:10 - 000011382 _____ C:\Users\j\Desktop\MBRCheck_12.10.19_12.09.44.txt
2019-12-10 12:06 - 2019-12-10 15:41 - 000000000 ____D C:\FRST
2019-12-10 10:54 - 2019-12-10 10:54 - 000000477 _____ C:\Users\j\Desktop\System - Shortcut.lnk
2019-12-10 10:53 - 2019-12-10 13:34 - 000000232 _____ C:\Windows\system32\zerobyte_files_deleted.txt
2019-12-10 10:53 - 2019-12-10 13:34 - 000000196 _____ C:\Windows\zerobyte_files_deleted.txt
2019-12-10 10:41 - 2019-12-10 11:55 - 000002186 _____ C:\Users\j\Desktop\Rkill.txt
2019-12-10 10:40 - 2019-12-10 11:56 - 000000000 ____D C:\Users\j\Desktop\mikey
2019-12-10 10:34 - 2019-12-10 11:53 - 000002198 _____ C:\Windows\epplauncher.mif
2019-12-10 10:33 - 2019-12-10 10:33 - 000002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2019-12-10 10:32 - 2019-12-10 10:34 - 000000000 ____D C:\Program Files\Microsoft Security Client
2019-12-10 10:32 - 2019-12-10 10:32 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2019-12-10 10:31 - 2019-12-10 10:44 - 000000000 ____D C:\Users\j\Desktop\TODAY2
2019-12-10 10:31 - 2019-12-10 10:31 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2019-12-10 10:31 - 2019-12-05 01:48 - 015065792 _____ (Microsoft Corporation) C:\Users\j\Desktop\MSEInstall.exe
2019-12-10 08:24 - 2019-12-10 15:44 - 038535168 _____ C:\Windows\system32\config\SOFTWARE
2019-12-10 08:07 - 2019-12-10 08:07 - 000000000 ____D C:\Windows\Microsoft Antimalware
2019-12-10 08:01 - 2019-12-10 08:33 - 000001768 __RSH C:\ProgramData\ntuser.pol
2019-12-10 07:54 - 2019-12-10 13:16 - 000057560 _____ C:\Users\j\AppData\Local\GDIPFONTCACHEV1.DAT
2019-12-10 07:53 - 2019-12-10 07:53 - 000001443 _____ C:\Users\j\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2019-12-10 07:53 - 2019-12-10 07:53 - 000001409 _____ C:\Users\j\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2019-12-10 07:53 - 2019-12-10 07:53 - 000000000 ____D C:\Users\j\AppData\Local\VirtualStore
2019-12-10 07:52 - 2019-12-10 07:53 - 000000000 ____D C:\Users\j
2019-12-10 07:52 - 2019-12-10 07:52 - 000000020 ___SH C:\Users\j\ntuser.ini
2019-12-10 07:52 - 2009-07-13 23:23 - 000000000 ____D C:\Users\j\AppData\Roaming\Media Center Programs
2019-12-10 07:41 - 2019-12-10 07:41 - 000001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2019-12-10 07:41 - 2019-12-10 07:41 - 000001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2019-12-10 07:41 - 2019-12-10 07:41 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WUDFUsbccidDriver_01_09_00.Wdf
2019-12-10 07:35 - 2019-12-10 07:52 - 000000000 ____D C:\Windows\Panther
2019-12-10 03:51 - 2019-12-10 03:51 - 000108792 _____ (Panda Security S.L.) C:\Windows\SysWOW64\PCloudCleanerService.exe
2019-12-10 03:51 - 2019-12-10 03:51 - 000022752 _____ C:\Windows\system32\autochk.exe
2019-12-10 03:51 - 2019-12-10 03:51 - 000000000 ____D C:\CloudCleaner

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-12-10 15:16 - 2009-07-13 21:13 - 000713888 _____ C:\Windows\system32\PerfStringBackup.INI
2019-12-10 15:16 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\inf
2019-12-10 15:12 - 2009-07-13 21:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-12-10 15:12 - 2009-07-13 20:45 - 000015680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2019-12-10 15:12 - 2009-07-13 20:45 - 000015680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2019-12-10 14:18 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\rescache
2019-12-10 13:17 - 2009-07-13 23:23 - 000000000 ___RD C:\Users\Public\Recorded TV
2019-12-10 13:16 - 2009-07-13 23:23 - 000000000 ____D C:\Windows\CSC
2019-12-10 13:16 - 2009-07-13 20:45 - 000274320 _____ C:\Windows\system32\FNTCACHE.DAT
2019-12-10 13:06 - 2009-07-13 18:34 - 000000439 _____ C:\Windows\win.ini
2019-12-10 08:00 - 2009-07-13 19:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2019-12-10 07:41 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\system32\sysprep
2019-12-10 07:35 - 2009-07-13 21:32 - 000028672 _____ C:\Windows\system32\config\BCD-Template

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)


LastRegBack: 2019-12-10 14:11
==================== End of FRST.txt ========================

 

[Zeroaccesstroja]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2019
Ran by j (10-12-2019 15:44:49)
Running from C:\Users\j\Desktop
Windows 7 Enterprise Service Pack 1 (X64) (2019-12-10 15:52:39)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1239035355-3179000145-829395696-500 - Administrator - Disabled)
Guest (S-1-5-21-1239035355-3179000145-829395696-501 - Limited - Disabled)
j (S-1-5-21-1239035355-3179000145-829395696-1000 - Administrator - Enabled) => C:\Users\j

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Out of date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Out of date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Google Chrome (HKU\S-1-5-21-1239035355-3179000145-829395696-1000\...\Google Chrome) (Version: 79.0.3945.79 - Google LLC)
Mediatek RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.39.173 - MediatekWiFi)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Tweaking.com - Windows Repair (HKLM-x32\...\Tweaking.com - Windows Repair) (Version: 4.1.0 - Tweaking.com)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1239035355-3179000145-829395696-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\j\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1239035355-3179000145-829395696-1000_Classes\CLSID\{84EB3779-151B-4C71-AEF0-A0FEE9481401}\InprocServer32 -> C:\Users\j\AppData\Local\Google\Update\1.3.35.342\psuser_64.dll (Google Inc -> Google LLC)
CustomCLSID: HKU\S-1-5-21-1239035355-3179000145-829395696-1000_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\localserver32 -> C:\Users\j\AppData\Local\Google\Chrome\Application\79.0.3945.79\notification_helper.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-1239035355-3179000145-829395696-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\j\AppData\Local\Google\Update\1.3.35.342\psuser_64.dll (Google Inc -> Google LLC)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} => -> No File

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============


==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

==================== Association (Whitelisted) =================

==================== Internet Explorer trusted/restricted ==========

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 18:34 - 2019-12-10 13:06 - 000000855 _____ C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1239035355-3179000145-829395696-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\j\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe No File
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe No File

==================== Restore Points =========================

10-12-2019 13:07:04 Windows Update
10-12-2019 13:18:53 Windows Update
10-12-2019 13:46:51 Windows Update

==================== Faulty Device Manager Devices ============

Name: PCI Serial Port
Description: PCI Serial Port
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Network Controller
Description: Network Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Ethernet Controller
Description: Ethernet Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI Simple Communications Controller
Description: PCI Simple Communications Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Broadcom USH
Description: Broadcom USH
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: ========================

Application errors:
==================
Error: (12/10/2019 03:12:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Faulting module name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Exception code: 0xc0000417
Fault offset: 0x00005d4b
Faulting process id: 0x648
Faulting application start time: 0x01d5afaf40a47b0e
Faulting application path: C:\Windows\syswow64\PCloudCleanerService.exe
Faulting module path: C:\Windows\syswow64\PCloudCleanerService.exe
Report Id: 874ed897-1ba2-11ea-9e07-ad91bd86cf92

Error: (12/10/2019 01:39:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Faulting module name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Exception code: 0xc0000417
Fault offset: 0x00005d4b
Faulting process id: 0x634
Faulting application start time: 0x01d5afa2549e7a44
Faulting application path: C:\Windows\syswow64\PCloudCleanerService.exe
Faulting module path: C:\Windows\syswow64\PCloudCleanerService.exe
Report Id: 9b46766d-1b95-11ea-9a9a-a557db643293

Error: (12/10/2019 01:17:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Faulting module name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Exception code: 0xc0000417
Fault offset: 0x00005d4b
Faulting process id: 0x590
Faulting application start time: 0x01d5af9f2ac58050
Faulting application path: C:\Windows\syswow64\PCloudCleanerService.exe
Faulting module path: C:\Windows\syswow64\PCloudCleanerService.exe
Report Id: 7178a7ce-1b92-11ea-bbbc-c98d5095c99e

Error: (12/10/2019 12:40:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Faulting module name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Exception code: 0xc0000417
Fault offset: 0x00005d4b
Faulting process id: 0x5cc
Faulting application start time: 0x01d5af9a15ce110d
Faulting application path: C:\Windows\syswow64\PCloudCleanerService.exe
Faulting module path: C:\Windows\syswow64\PCloudCleanerService.exe
Report Id: 5947f699-1b8d-11ea-a3f0-8dba879f5489

Error: (12/10/2019 12:02:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Faulting module name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Exception code: 0xc0000417
Fault offset: 0x00005d4b
Faulting process id: 0x5d0
Faulting application start time: 0x01d5af94b5d2a9a5
Faulting application path: C:\Windows\syswow64\PCloudCleanerService.exe
Faulting module path: C:\Windows\syswow64\PCloudCleanerService.exe
Report Id: f8c01e00-1b87-11ea-bdc7-aff011f4ea85

Error: (12/10/2019 11:53:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Faulting module name: PCloudCleanerService.exe, version: 1.4.0.5, time stamp: 0x55d6f34a
Exception code: 0xc0000417
Fault offset: 0x00005d4b
Faulting process id: 0x6d0
Faulting application start time: 0x01d5af93733e960a
Faulting application path: C:\Windows\syswow64\PCloudCleanerService.exe
Faulting module path: C:\Windows\syswow64\PCloudCleanerService.exe
Report Id: b4bc9bb8-1b86-11ea-9fd1-a01f9c85a88d


System errors:
=============
Error: (12/10/2019 04:09:29 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Malware Protection Center

Update Stage: Download

Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiSpyware

Update Type: Full

User: j-PC\j

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x80070070

Error description: There is not enough space on the disk.

Error: (12/10/2019 04:09:29 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Malware Protection Center

Update Stage: Download

Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiVirus

Update Type: Full

User: j-PC\j

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x80070070

Error description: There is not enough space on the disk.

Error: (12/10/2019 04:09:17 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Update Server

Update Stage: Download

Source Path: http://www.microsoft.com

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\SYSTEM

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x80240022

Error description: The program can't check for definition updates.

Error: (12/10/2019 04:09:16 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Update Server

Update Stage: Download

Source Path: http://www.microsoft.com

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\SYSTEM

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x80240022

Error description: The program can't check for definition updates.

Error: (12/10/2019 03:25:27 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Malware Protection Center

Update Stage: Install

Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x800b0109

Error description: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

Error: (12/10/2019 03:25:27 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Malware Protection Center

Update Stage: Install

Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiSpyware

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x800b0109

Error description: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

Error: (12/10/2019 03:25:27 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Malware Protection Center

Update Stage: Install

Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x800b0109

Error description: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

Error: (12/10/2019 03:20:13 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: Microsoft Update Server

Update Stage: Download

Source Path: http://www.microsoft.com

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\SYSTEM

Current Engine Version:

Previous Engine Version: 0.0.0.0

Error code: 0x80240022

Error description: The program can't check for definition updates.


CodeIntegrity:
===================================

Date: 2019-12-10 12:58:56.352
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shdfmini.sys because the set of per-page image hashes could not be found on the system.

Date: 2019-12-10 12:58:56.352
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shdfmini.sys because the set of per-page image hashes could not be found on the system.

Date: 2019-12-10 12:58:56.352
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shdfmini.sys because the set of per-page image hashes could not be found on the system.

Date: 2019-12-10 12:58:56.290
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shdfmini.sys because the set of per-page image hashes could not be found on the system.

Date: 2019-12-10 12:58:56.087
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shieldf.sys because the set of per-page image hashes could not be found on the system.

Date: 2019-12-10 12:58:56.087
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shieldf.sys because the set of per-page image hashes could not be found on the system.

Date: 2019-12-10 12:58:56.087
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shieldf.sys because the set of per-page image hashes could not be found on the system.

Date: 2019-12-10 12:58:56.025
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\j\Desktop\TODAY2\RebootRestoreRx3\Drivers\win10\x64\shieldf.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

BIOS: Dell Inc. A05 11/20/2010
Motherboard: Dell Inc. 0D8H24
Processor: Intel(R) Core(TM) i5 CPU M 560 @ 2.67GHz
Percentage of memory in use: 80%
Total physical RAM: 3893.83 MB
Available physical RAM: 744.09 MB
Total Virtual: 7785.86 MB
Available Virtual: 3583.2 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:37.16 GB) (Free:0.02 GB) NTFS

\\?\Volume{cf2f9366-1b62-11ea-a4cc-806e6f6e6963}\ (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 37.3 GB) (Disk ID: D47F2CDA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=37.2 GB) - (Type=07 NTFS)

==================== End of Addition.txt =======================

 

[torchwood]

Hi Zero,

not a security expert, do have these comments

1) Most importantly you do NOT have enough free space on your disk - >1% you need at least 10%
2) there are remnants of another AV -PCloudCleanerService
3) out of date certificate to run MSE via NT AUTHORITY\NETWORK SERVICE
4) OS licencing files are not present and you appear to be self validating-
5) The OS appears to have been a Sysprep install and likely had the Group policy restrictions on it
6) IE version is 8 way outta date

Enterprise versions of W7 are for use by large companies and ANY changes to the system should be administered by them.

please run this tool copy/paste the output
Windows Genuine and Activation Issue Posting Instructions


Roy