1) Odinstaluj te programy:
Ball Form (HKU\S-1-5-21-290575239-1943465458-3441839995-1000\...\{E8470B66-97C1-8A83-045C-236130DF56D7}) (Version: 1.5.2 - Comp Cooking corp) <==== ATTENTION
Ball Form (HKU\S-1-5-21-290575239-1943465458-3441839995-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\{E8470B66-97C1-8A83-045C-236130DF56D7}) (Version: 1.5.2 - Comp Cooking corp) <==== ATTENTION
2) Uruchom FRST. NA klawiaturze naciśnij jednocześnie
CTRL+
Y.Otworzy się Notatnik - wklej do niego:
RemoveDirectory: C:\Program Files (x86)\Fanlook
RemoveDirectory: C:\Users\ULA\AppData\Local\Fanlook
RemoveDirectory: C:\Users\Public\Documents\Google
RemoveDirectory:
C:\Users\ULA\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\5d696d521de238c3\Google Chrome.lnk
FirewallRules: [{75BEEAEA-DB54-4235-A8E3-B6F78CB05EAD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9F250605-BCD5-490C-8294-76E6313104AD}] => (Allow) C:\Program Files (x86)\Fanlook\Application\chrome.exe
HKLM-x32\...\RunOnce: [DeleteLaunchAR] => cmd.exe /C del "C:\Windows\Temp\LaunchAR.exe" <===== ATTENTION
HKLM-x32\...\RunOnce: [DeleteRemoveFolder] => cmd.exe /C del "C:\Windows\Temp\RemoveFolder.exe" <===== ATTENTION
R2 wiasvc; C:\ProgramData\Microsoft\Windows\Image\capCADF.tmp:ad [212994 ] () [File not signed] <==== ATTENTION
2017-06-03 11:54 - 2017-01-19 00:11 - 00000000 _____ C:\Users\Public\Documents\temp.dat
EmptyTemp:
Na klawiaturze naciśnij jednocześnie
CTRL+
S. W FRST kliknij na Fix (NAPRAW).