VIRY.CZ

ok,
Tuto sluzbu nastav na AUTO
BITS
potom na pravej strane posun posuvnik uplne dole a daj druhy screenshot.

Spust prikazovy riadok ako spravca/admin a do cierneho okna ,tam kde blika kurzor>.skopiruj tento prikaz.
tasklist /m /fi "IMAGENAME eq svchost.exe" >C:\svchost.txt
Stlac ENTER.
Najdi na disku C:
svchost.txt
otvor a obsah vloz sem.

N zev procesu PID Moduly
========================= ======== ============================================
svchost.exe 668 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
umpnpmgr.dll, SPINF.dll, USER32.dll,
GDI32.dll, LPK.dll, USP10.dll, DEVRTL.dll,
IMM32.DLL, MSCTF.dll, RpcRtRemote.dll,
USERENV.dll, profapi.dll, GPAPI.dll,
CRYPTBASE.dll, umpo.dll, WINSTA.dll,
SETUPAPI.dll, CFGMGR32.dll, ADVAPI32.dll,
OLEAUT32.dll, ole32.dll, DEVOBJ.dll,
pcwum.DLL, rpcss.dll, SspiCli.dll,
credssp.dll, CLBCatQ.DLL, ntmarta.dll,
WLDAP32.dll, wmidcprv.dll, FastProx.dll,
wbemcomn.dll, WS2_32.dll, NSI.dll,
NTDSAPI.dll, wbemprox.dll, CRYPTSP.dll,
rsaenh.dll, wbemsvc.dll, wmiutils.dll,
WINTRUST.dll, CRYPT32.dll, MSASN1.dll,
apphelp.dll, WTSAPI32.dll
svchost.exe 748 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
rpcepmap.dll, RpcRtRemote.dll, secur32.dll,
SSPICLI.DLL, credssp.dll, CRYPTBASE.dll,
rpcss.dll, ADVAPI32.dll, CRYPTSP.dll,
rsaenh.dll, WS2_32.dll, NSI.dll,
mswsock.dll, user32.dll, GDI32.dll,
LPK.dll, USP10.dll, IMM32.DLL, MSCTF.dll,
wshtcpip.dll, wship6.dll, FirewallAPI.dll,
VERSION.dll, CLBCatQ.DLL, ole32.dll,
OLEAUT32.dll, fwpuclnt.dll, WTSAPI32.dll,
WINSTA.dll
svchost.exe 836 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
USP10.dll, IMM32.DLL, MSCTF.dll,
CRYPTBASE.dll, ADVAPI32.dll, wevtsvc.dll,
RpcRtRemote.dll, secur32.dll, SSPICLI.DLL,
credssp.dll, WS2_32.dll, NSI.dll,
mswsock.dll, wshtcpip.dll, wship6.dll,
GPAPI.dll, audiosrv.dll, POWRPROF.dll,
SETUPAPI.dll, CFGMGR32.dll, OLEAUT32.dll,
DEVOBJ.dll, MMDevAPI.DLL, PROPSYS.dll,
AVRT.dll, CLBCatQ.DLL, WINSTA.dll,
SHLWAPI.dll, CRYPTSP.dll, rsaenh.dll,
audioses.dll, lmhsvc.dll, IPHLPAPI.DLL,
WINNSI.DLL, nrpsrv.DLL, dhcpcore.dll,
DNSAPI.dll, firewallapi.dll, VERSION.dll,
dhcpcore6.dll, dhcpcsvc6.DLL, dhcpcsvc.DLL,
wbemprox.dll, wbemcomn.dll, wbemsvc.dll,
fastprox.dll, NTDSAPI.dll, CRYPT32.dll,
MSASN1.dll, WINTRUST.DLL, imagehlp.dll,
ncrypt.dll, bcrypt.dll,
bcryptprimitives.dll, wuapi.dll,
Cabinet.dll, profapi.dll
svchost.exe 880 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
USP10.dll, IMM32.DLL, MSCTF.dll,
CRYPTBASE.dll, ADVAPI32.dll, audiosrv.dll,
POWRPROF.dll, SETUPAPI.dll, CFGMGR32.dll,
OLEAUT32.dll, DEVOBJ.dll, MMDevAPI.DLL,
PROPSYS.dll, AVRT.dll, CLBCatQ.DLL,
SHLWAPI.dll, uxsms.dll, WTSAPI32.dll,
WINSTA.dll, wlansvc.dll, CRYPT32.dll,
MSASN1.dll, bcrypt.dll, dsrole.dll,
SHELL32.dll, WLANMSM.DLL, WLANSEC.dll,
WS2_32.dll, NSI.dll, OneX.DLL,
eappprxy.dll, AUTHZ.dll, dhcpcsvc.DLL,
IPHLPAPI.DLL, WINNSI.DLL, eappcfg.dll,
wlgpclnt.dll, l2gpstore.dll, wlanutil.dll,
SYSNTFY.dll, WinSCard.dll, msxml6.dll,
CRYPTSP.dll, rsaenh.dll, RpcRtRemote.dll,
secur32.dll, SSPICLI.DLL, credssp.dll,
kerberos.DLL, cryptdll.dll, WINTRUST.dll,
profapi.dll, rtutils.dll, comctl32.dll,
netcfgx.dll, devrtl.DLL, netman.dll,
pcasvc.dll, apphelp.dll, AEPIC.dll,
sfc.dll, sfc_os.DLL, VERSION.dll,
wevtapi.dll, sysmain.dll, ntmarta.dll,
WLDAP32.dll, trkwks.dll, hidserv.dll,
HID.DLL, wdi.dll, USERENV.dll, GPAPI.dll,
PortableDeviceApi.dll, APPHLPDM.DLL,
wer.dll, portabledeviceconnectapi.dll,
netshell.dll, nlaapi.dll, RASDLG.dll,
MPRAPI.dll, RASAPI32.dll, rasman.dll,
hnetcfg.dll, ATL.DLL, slc.dll,
wbemprox.dll, wbemcomn.dll, wbemsvc.dll,
fastprox.dll, NTDSAPI.dll
svchost.exe 908 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
USP10.dll, IMM32.DLL, MSCTF.dll,
CRYPTBASE.dll, ADVAPI32.dll, gpsvc.dll,
GPAPI.dll, WLDAP32.dll, Secur32.dll,
SSPICLI.DLL, NSI.dll, SYSNTFY.dll,
nlaapi.dll, profsvc.dll, OLEAUT32.dll,
USERENV.dll, profapi.dll, SHLWAPI.dll,
ATL.DLL, themeservice.dll, sens.dll,
WINSTA.dll, RpcRtRemote.dll, WS2_32.dll,
CLBCatQ.DLL, CRYPTSP.dll, rsaenh.dll,
dsrole.dll, slc.dll, eapsvc.dll,
eapphost.dll, CRYPT32.dll, MSASN1.dll,
umb.dll, shsvcs.dll, CFGMGR32.dll,
SETUPAPI.dll, DEVOBJ.dll, WINTRUST.dll,
schedsvc.dll, pcwum.dll, SHELL32.dll,
NETAPI32.dll, netutils.dll, srvcli.dll,
wkscli.dll, wevtapi.dll, AUTHZ.dll,
UBPM.dll, ktmw32.dll, XmlLite.dll,
credssp.dll, FVEAPI.dll, tbs.dll,
FVECERTS.dll, LOGONCLI.DLL, taskcomp.dll,
VERSION.dll, wiarpc.dll, ntmarta.dll,
mswsock.dll, wshtcpip.dll, wship6.dll,
netjoin.dll, WTSAPI32.dll, comctl32.dll,
PROPSYS.dll, ikeext.dll, fwpuclnt.dll,
ncrypt.dll, bcrypt.dll,
bcryptprimitives.dll, IPHLPAPI.DLL,
WINNSI.DLL, dhcpcsvc6.DLL, dhcpcsvc.DLL,
seclogon.dll, wmisvc.dll, wbemcomn.dll,
iphlpsvc.dll, FirewallAPI.dll, rtutils.dll,
sqmapi.dll, WDSCORE.dll, netcfgx.dll,
devrtl.DLL, hnetcfg.dll, SPINF.dll,
netprofm.dll, VSSAPI.DLL, VssTrace.DLL,
samcli.dll, SAMLIB.dll, es.dll,
wbemcore.dll, esscli.dll, FastProx.dll,
NTDSAPI.dll, wbemsvc.dll, wmiutils.dll,
repdrvfs.dll, ndiscapCfg.dll, rascfg.dll,
MPRAPI.dll, tcpipcfg.dll, DNSAPI.dll,
wmiprvsd.dll, NCObjAPI.DLL, wbemess.dll,
RASAPI32.dll, rasman.dll, kerberos.DLL,
cryptdll.dll, srvsvc.dll, browser.dll,
SSCORE.DLL, CLUSAPI.DLL, RESUTILS.DLL,
WLIDNSP.DLL, PSAPI.DLL, rasadhlp.dll,
UxTheme.dll, aelupsvc.dll, npmproxy.dll,
apphelp.dll, SPFILEQ.dll, SXS.DLL,
appinfo.dll, actxprxy.dll, ncprov.dll,
tschannel.dll, qmgr.dll, bitsperf.dll,
bitsigd.dll, upnp.dll, WINHTTP.dll,
webio.dll, SSDPAPI.dll, wuaueng.dll,
ESENT.dll, WINSPOOL.DRV, Cabinet.dll,
mspatcha.dll, WMsgAPI.dll, wer.dll,
mmcss.dll, AVRT.dll, msi.dll, advpack.dll,
CbsApi.dll, msxml3.dll, nci.dll,
wlaninst.dll, wwaninst.dll, dssenh.dll,
wups2.dll, schannel.DLL, cryptnet.dll,
dpx.dll, MPR.dll
svchost.exe 384 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
USP10.dll, IMM32.DLL, MSCTF.dll,
CRYPTBASE.dll, ADVAPI32.dll, es.dll,
OLEAUT32.dll, CRYPTSP.dll, rsaenh.dll,
RpcRtRemote.dll, CLBCatQ.DLL, nsisvc.dll,
NSI.dll, SXS.DLL, sstpsvc.dll, rtutils.dll,
HTTPAPI.dll, CRYPT32.dll, MSASN1.dll,
WS2_32.dll, webio.dll, IPHLPAPI.DLL,
WINNSI.DLL, netprofm.dll, nlaapi.dll,
wdi.dll, npmproxy.dll, perftrack.dll,
wer.dll, dwmapi.dll, Secur32.dll,
SSPICLI.DLL, AEPIC.dll, sfc.dll,
sfc_os.DLL, VERSION.dll, winhttp.dll,
GPAPI.dll, SHLWAPI.dll, credssp.dll,
DNSAPI.dll, napinsp.dll, pnrpnsp.dll,
WLIDNSP.DLL, PSAPI.DLL, mswsock.dll,
winrnr.dll, wshtcpip.dll, wship6.dll,
rasadhlp.dll, fwpuclnt.dll, dhcpcsvc6.DLL,
dhcpcsvc.DLL, fdphost.dll, fdwsd.dll,
ATL.DLL, bcrypt.dll, MLANG.dll, wsdapi.dll,
webservices.dll, FirewallAPI.dll,
fdssdp.dll, SSDPAPI.dll
svchost.exe 688 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
USP10.dll, IMM32.DLL, MSCTF.dll,
CRYPTBASE.dll, ADVAPI32.dll, dnsrslvr.dll,
WS2_32.dll, NSI.dll, DNSAPI.dll,
WINNSI.DLL, Fwpuclnt.dll, dnsext.dll,
USERENV.dll, profapi.dll, GPAPI.dll,
RpcRtRemote.dll, mswsock.dll, wship6.dll,
iphlpapi.dll, dhcpcsvc6.DLL, dhcpcsvc.DLL,
wkssvc.dll, netutils.dll, netjoin.dll,
SspiCli.dll, cryptsvc.dll, CRYPTNET.dll,
CRYPT32.dll, MSASN1.dll, WLDAP32.dll,
wshtcpip.dll, VSSAPI.DLL, ATL.DLL,
VssTrace.DLL, OLEAUT32.dll, samcli.dll,
SAMLIB.dll, CRYPTSP.dll, rsaenh.dll,
CLBCatQ.DLL, es.dll, PROPSYS.dll,
nlasvc.dll, wevtapi.dll, ncsi.dll,
WINHTTP.dll, webio.dll, CFGMGR32.dll,
secur32.dll, credssp.dll, ssdpapi.dll,
wkscli.dll, bcrypt.dll,
bcryptprimitives.dll, rtutils.dll,
ESENT.dll, psapi.dll, SETUPAPI.dll,
DEVOBJ.dll, WINTRUST.dll, WTSAPI32.dll,
WINSTA.dll, SHLWAPI.dll, WLIDNSP.DLL,
rasadhlp.dll, SensApi.dll
svchost.exe 1240 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
USP10.dll, IMM32.DLL, MSCTF.dll,
CRYPTBASE.dll, ADVAPI32.dll, bfe.dll,
AUTHZ.dll, slc.dll, SspiCli.dll, pcwum.dll,
RpcRtRemote.dll, mpssvc.dll,
FirewallAPI.dll, VERSION.dll, fwpuclnt.dll,
NSI.dll, CFGMGR32.dll, SHLWAPI.dll,
secur32.dll, credssp.dll, USERENV.dll,
profapi.dll, GPAPI.dll, WS2_32.dll,
IPHLPAPI.DLL, WINNSI.DLL, dhcpcsvc6.DLL,
dhcpcsvc.DLL, wfapigp.dll, ntmarta.dll,
WLDAP32.dll, dps.dll, OLEAUT32.dll,
CLBCatQ.DLL, taskschd.dll, mswsock.dll,
wshtcpip.dll, wship6.dll, wdi.dll,
netprofm.dll, nlaapi.dll, CRYPTSP.dll,
rsaenh.dll, diagperf.dll, pnpts.dll,
wdiasqmmodule.dll, npmproxy.dll,
bcrypt.dll, radardt.dll, WTSAPI32.dll
svchost.exe 1692 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
wiaservc.dll, ADVAPI32.dll, USER32.dll,
GDI32.dll, LPK.dll, USP10.dll,
OLEAUT32.dll, ole32.dll, VERSION.dll,
IMM32.DLL, MSCTF.dll, wiatrace.dll,
CRYPTBASE.dll, RpcRtRemote.dll,
secur32.dll, SSPICLI.DLL, credssp.dll,
msv1_0.DLL, cryptdll.dll, CFGMGR32.dll,
CLBCatQ.DLL, CRYPTSP.dll, rsaenh.dll,
SETUPAPI.dll, DEVOBJ.dll, sti.dll,
comctl32.dll, SHLWAPI.dll, WINTRUST.dll,
CRYPT32.dll, MSASN1.dll
svchost.exe 1908 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
mpsvc.dll, ADVAPI32.dll, ole32.dll,
GDI32.dll, USER32.dll, LPK.dll, USP10.dll,
WTSAPI32.dll, sfc.dll, sfc_os.DLL,
MpClient.dll, OLEAUT32.dll, USERENV.dll,
profapi.dll, WINTRUST.dll, CRYPT32.dll,
MSASN1.dll, VERSION.dll, SHELL32.dll,
SHLWAPI.dll, IMM32.DLL, MSCTF.dll,
GPAPI.dll, CRYPTSP.dll, rsaenh.dll,
CRYPTBASE.dll, imagehlp.dll, bcrypt.dll,
bcryptprimitives.dll, ncrypt.dll,
mprtp.dll, PSAPI.DLL, tdh.dll,
mpengine.dll, WS2_32.dll, NSI.dll,
secur32.dll, SSPICLI.DLL, credssp.dll,
RpcRtRemote.dll, wscapi.dll, urlmon.dll,
iertutil.dll, WININET.dll, Normaliz.dll,
ntmarta.dll, WLDAP32.dll, CLBCatQ.DLL,
XmlLite.dll
svchost.exe 2228 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ipsecsvc.dll, AUTHZ.dll, fwpuclnt.dll,
FirewallAPI.dll, VERSION.dll,
FwRemoteSvr.DLL, ADVAPI32.dll, ole32.dll,
GDI32.dll, USER32.dll, LPK.dll, USP10.dll,
IMM32.DLL, MSCTF.dll, CRYPTBASE.dll,
CLBCatQ.DLL, OLEAUT32.dll, secur32.dll,
SSPICLI.DLL, credssp.dll, RpcRtRemote.dll,
WS2_32.dll, NSI.dll, mswsock.dll,
wshtcpip.dll, wship6.dll, IPHLPAPI.DLL,
WINNSI.DLL, dhcpcsvc.DLL, dhcpcsvc6.DLL
svchost.exe 1640 ntdll.dll, kernel32.dll, KERNELBASE.dll,
msvcrt.dll, sechost.dll, RPCRT4.dll,
ole32.dll, GDI32.dll, USER32.dll, LPK.dll,
USP10.dll, IMM32.DLL, MSCTF.dll,
CRYPTBASE.dll, ADVAPI32.dll, fdrespub.dll,
wsdapi.dll, WS2_32.dll, NSI.dll,
IPHLPAPI.DLL, WINNSI.DLL, webservices.dll,
FirewallAPI.dll, VERSION.dll, CLBCatQ.DLL,
OLEAUT32.dll, FunDisc.dll, ATL.DLL,
SHLWAPI.dll, dhcpcsvc6.DLL, dhcpcsvc.DLL,
mswsock.dll, wship6.dll, wshtcpip.dll,
WINHTTP.dll, webio.dll, HTTPAPI.dll,
pcwum.dll, wkscli.dll, netutils.dll,
msxml6.dll, CRYPTSP.dll, rsaenh.dll,
XmlLite.dll, ssdpsrv.dll, secur32.dll,
SSPICLI.DLL, credssp.dll, RpcRtRemote.dll,
upnphost.dll, SHELL32.dll, SSDPAPI.dll,
fntcache.dll, ktmw32.dll, ntmarta.dll,
WLDAP32.dll, USERENV.dll, profapi.dll,
msxml3.dll, udhisapi.dll

No nevidim malware proces medzi kniznicami.
Je evidentne ze problem je s kniznicami netservices.
Problem pretrvava aj po nainstalovani SP???

Ak ano pokracuj opravou sluzieb.
No nic opravime vsetky sluzby pre system.
Navod od kolegu.

Stahnete Service Repair
http://kb.eset.com/library/ESET/KB%20Te ... Repair.exe
Ulozte nejlepe na Plochu
Spustte a potvrdte Yes abyste potvrdil reinstalaci sluzeb
Nasledne kliknutim na Yes potvrdte restart PC
Na Plose vznikne slozka CC Support, najdete tam log SvcRepair.txt - mel by byt CC Support\Logs\SvcRepair.txt - vlozte mi jej sem

Problém stále přetrvává...tady je log:
Log Opened: 2013-04-25 @ 19:27:32
19:27:32 - -----------------
19:27:32 - | Begin Logging |
19:27:32 - -----------------
19:27:32 - Fix started on a WIN_7 X64 computer
19:27:32 - Prep in progress. Please Wait.
19:27:34 - Prep complete
19:27:34 - Repairing Services Now. Please wait...
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\BFE.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\BITS.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\iphlpsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo\{FA88062C-9A61-4C1E-AC45-7143F8F01AAD}>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap\{8AD2FB26-F91E-44F1-9B24-3C0AE56C9CE0}>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\IPHTTPS>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\MpsSvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\DHCP>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\SharedAccess.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch2>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\WinDefend.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo\0>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\wscsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\wuauserv.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>

SetACL finished successfully.
19:28:34 - Services Repair Complete.
19:28:40 - Reboot Initiated

stiahni na plochu minitoolbox
http://www.bleepingcomputer.com/download/minitoolbox/
spust ako admin,
Zafajkni.
list last 10 event viewer ERRORS a klikni na Go
log vloz sem

MiniToolBox by Farbar Version:21-04-2013
Ran by Krista (administrator) on 25-04-2013 at 19:56:36
Running from "C:\Users\Krista\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************

========================= Event log errors: ===============================

Application errors:
==================
Error: (04/25/2013 07:31:09 PM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/25/2013 04:45:02 PM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/25/2013 04:20:20 PM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/25/2013 02:39:13 PM) (Source: Application Hang) (User: )
Description: Program wusa.exe verze 6.1.7600.16385 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Centrum akcí.

ID procesu: f9c

Čas spuštění: 01ce41ab6e8714ce

Čas ukončení: 116

Cesta k aplikaci: C:\Windows\system32\wusa.exe

ID hlášení:

Error: (04/25/2013 11:01:36 AM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/25/2013 10:56:35 AM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/25/2013 10:36:51 AM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/24/2013 03:18:06 PM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/24/2013 11:39:57 AM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/24/2013 10:40:51 AM) (Source: SideBySide) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.


System errors:
=============
Error: (04/25/2013 07:48:47 PM) (Source: Service Control Manager) (User: )
Description: Při čekání na odezvu transakce služby EapHost bylo dosaženo časového limitu (30000 ms).

Error: (04/25/2013 07:37:23 PM) (Source: Service Control Manager) (User: )
Description: Při čekání na odezvu transakce služby EapHost bylo dosaženo časového limitu (30000 ms).

Error: (04/25/2013 07:34:48 PM) (Source: Service Control Manager) (User: )
Description: Při čekání na odezvu transakce služby sppsvc bylo dosaženo časového limitu (30000 ms).

Error: (04/25/2013 07:33:47 PM) (Source: Service Control Manager) (User: )
Description: Při čekání na odezvu transakce služby BFE bylo dosaženo časového limitu (30000 ms).

Error: (04/25/2013 07:32:19 PM) (Source: Service Control Manager) (User: )
Description: Služba Správce vzdáleného přístupu byla ukončena s následující chybou:
%%20

Error: (04/25/2013 07:32:19 PM) (Source: RasMan) (User: )
Description: Spuštění Správce vzdáleného přístupu se nezdařilo, protože se nezdařila inicializace jádra protokolu [vpnike.dll]. Systém nemůže nalézt uvedené zařízení.

Error: (04/25/2013 07:32:17 PM) (Source: Service Control Manager) (User: )
Description: Služba Správce vzdáleného přístupu byla ukončena s následující chybou:
%%20

Error: (04/25/2013 07:32:17 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005

Error: (04/25/2013 07:32:17 PM) (Source: RasMan) (User: )
Description: Spuštění Správce vzdáleného přístupu se nezdařilo, protože se nezdařila inicializace jádra protokolu [vpnike.dll]. Systém nemůže nalézt uvedené zařízení.

Error: (04/25/2013 07:32:13 PM) (Source: Service Control Manager) (User: )
Description: Služba Správce vzdáleného přístupu byla ukončena s následující chybou:
%%20


Microsoft Office Sessions:
=========================
Error: (03/08/2012 08:24:46 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2233 seconds with 1560 seconds of active time. This session ended with a crash.

Error: (10/27/2011 05:16:52 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6565.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 1605 seconds with 960 seconds of active time. This session ended with a crash.


CodeIntegrity Errors:
===================================
Date: 2013-04-24 15:12:37.166
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 15:12:36.947
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 15:12:36.713
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 15:12:36.495
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 14:31:18.462
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 14:31:18.228
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 14:31:17.947
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 14:31:17.729
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 11:33:43.625
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-04-24 11:33:43.422
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


**** End of log ****

start>.do pola hladat napis alebo skopiruj
services.msc
potom pravy klik spust ako spravca.
najdi tuto sluzbu.
WMPNetworkSvc
2x klik, a na otvorenej karte nastav ZAKAZANE
ok, pouzit.
Restart a napis ci problem pretrvava.

ak ano pokracuj takto.

http://download.bleepingcomputer.com/farbar/FSS.exe
Ulozte nejlepe na Plochu
U vsech polozek udelejte zatrzitko (tim je oznacite pro skenovani)
Kliknete na Scan
Po dokonceni skenu se objevi log FSS.txt ten sem vlozte

Je možné, že ta služba tam není? Nikde ji tam totiž nemůžu najít...

je tam, no nic spust prikazovy riadok ako spravca/admin
do pola hladat napis cmd>>pravy klik a spust ako admin.
do cierneho okna vloz tento prikaz
Net Stop WMPNetworkSvc
Enter

Napis ze aku odpoved si dostala od prikazoveho riadku,

Došlo k systémové chybě 5. Přístup byl odepřen

pretoze si nespustila prikazovy riadok ako spravca.
Este raz.Pravy klik na cierne cmd a spust ako spravca.

Jj, už to mám...noťas nestíhá, tak to první spuštění přes správce nestihl pobrat a spustil mi to až teď. Aha, ono šlo o službu Windows Media Player Network Sharing a napsalo to, že byla úspěšně provedena. Jdu to restartnout.

jasne, ok, restart a napis ze co a ako.

Zastavení služby nepomohlo, takže rovnou přidávám i log.

Farbar Service Scanner Version: 14-04-2013
Ran by Krista (administrator) on 25-04-2013 at 21:06:15
Running from "C:\Users\Krista\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

Tu je tiez vsetko ok, tu sluzbu co sme zastavili, nechaj tak.

Spustis program OTL.exe
spust ako admin
Nastavenie nechaj tak ako je, zafajkni
Pro vsechny uzivatele.
64.bit
A klikni na PROHLEDAT
Log vloz sem, zajtra sa na to pozriem, dnes koncim.
dole do okna vloz tento script: