Funmoods worth to be added into several categories on 2-spyware.com Security portal. They think they don't do anything bad, that would be the browser plugins category, but spyware community around the world thinks differently. Funmoods hijacks your browser, search results and uses aggressive marketing strategy to turn visitors into customers. That activity fits to 2-spyware.com Browser hijackers category. Funmood display various advertisements to the users that makes them Adware. But regular people are tired with the activity of funmoods, their redirection to start.funmoods.com and they call this parasite - a virus.
How did I get infected with funmoods?
There are several ways how you can get infected with funmoods. You can install yourself, if you wanted to get some moods to your chats, and you did not know the consequences. Funmoods can be installed without explicit user consent. It hijacks your search page and redirect all search queries to spammy results with advertising links. Lots of ads are related to Russian women. Such as Meet Real Russian Women! Chat with Sexy Russian Women and women from some other countries.
How to get rid of funmoods?
Funmoods is difficult to remove as there is no uninstall process provided for every component of funmoods at once. We advice to use automated tools. The problem is that most tools do not detect funmoods as there are several opinions regarding clasification of Funmoods. Lately, some vendors tried to add new detection techniques, so we would recommend using Spyhunter to get rid of funmoods.. Another good product to remove funmoods is MalwareBytes anti-malware.
Funmoods provides some video removal guides to remove it from different web browsers.
If you have found Funmoods or Facemoods toolbar and you haven't installed it, remove it by going: Start menu -> Control Panel -> Add/Remove Programs or Uninstall a Program. Choose 'Uninstall' button if you see the FunMoods/FaceMoods in the list.
Change your homepage by following these steps:
Internet Explorer:
Open IE -> Tools -> Internet Options -> General tab. Enter Google or other address to make it the default start page.
Mozilla Firefox:
Open Mozilla Firefox, go to Tools -> Options -> General -> Startup. Now select 'Show a blank page' when Firefox Starts or set a certain website, like Google or similar.
Google Chrome:
Open Google Chrome, click on wench icon, go to settings and choose 'Manage search engines'. Change search engine to google or other and delete Certified toolbar from the list. Then Go to section “On start” and make sure you get blank page while creating new tab.
FunMoods manual removal:
Kill processes:
funmoodssrv.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escort.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortApp.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortEng.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escorTlbr.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\esrv.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid32
Unregister DLLs:%ProgramFiles%\Funmoods\1.5.23.22\bh\escort.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortApp.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortEng.dll
%ProgramFiles%\Funmoods\1.5.23.22\escorTlbr.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortShld.dll
Delete files:%AppData%\funmoods.crx
%AppData%\Google\Chrome\
%ProgramFiles%\Funmoods\1.5.23.22\funmoodssrv.exe
%ProgramFiles%\Funmoods\1.5.23.22\uninstall.exe
%ProgramFiles%\Funmoods\1.5.23.22\bh\escort.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortApp.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortEng.dll
%ProgramFiles%\Funmoods\1.5.23.22\escorTlbr.dll
%ProgramFiles%\Funmoods\1.5.23.22\escortShld.dll
Modern viruses are really hard to remove. They have random file names, random registry entries, they can immitale legal products and files.
Removal instructions sometimes can't Help to remove infection manually. Please take a look at our discussion where users like you share they experience in fighting the parasite:
(80 / 100)
ASK US:
HELP:
|
|
Everybody: PLEASE BEWARE OF DOWNLOADING THE FREECORDER VIDEO DOWNLOADER/CONVERTER PROGRAM BECAUSE IT WILL INSTALL THIS MESS EVEN THOUGH I took the time to make sure all the BOXES ARE UNCHECKED during the installation process, and ALL THE OFFERS of installing all their extra mess ARE DECLINED DURING THE INSTALLATION PROCESS. PLEASE BE CAREFUL!
I also want to thank the owners of this site for posting information as well as their solutions, along with making it possible for us victims as well, to help each other to find and share solutions for getting rid of the FunMoods demonic programs.
THANKS
Dont go near this crap!!!!!
malwarebytes free program is always available at cnetdownloads.com
THAT IS ALL YOU NEED
is this true that this website give some people gifts!!!!!!?!?!?!?!
I went ahead and ran the free version of malwarebytes, then went into firefox and removed the addons (it had installed dealcabby, funmoods, a couple others) and its gone. malwarebytes wiped funmoods out of the registry (there were about 30 hits). A quick scan does the trick
This very morning, having repeated yesterday’s run of MBAM, the program again detected 2 presences, which I had removed. I then started up FIREFOX and discovered that Funwoods seemed to have disappeared from the navigator or Google search engine. Haven’t the faintest idea of what happened and if Funwoods is going to stay totally away from my PC.
Combined effect of both MBAM and my angry mail, or only one or the other?
Whatever the case, this raises the following point : could it be that Funwoods is in a position or has the means and tools to have access to the innards of my Windows XP ? And do whatever it wants: such as removing the unwanted malware when called for or requested? A rather very disturbing and disquieting thougt for all of us.
i had installed ad-aware last night, and this morning the funmoods search home page came up again but after a couple of minutes seemed to go away on its own......(could it be the ad-aware program working on the background?) Im still not convinced with a sensation of (the killer seems to be dead but hes not really dead) so I installed and currently running malware bytes.
NOV 27, 2012 | 12:18PM EET
Alex replied:
Hello
Thanks for contacting us. Please follow the instructions below.
In Firefox:
To removetoolbar/New Tab
Open Firefox, go to Add-ons Manager (Ctrl+Shift+A) > Select “Funmoods” and click on Remove
To remove from Home page:
Open FireFox, go to Tools > Options > on “startup” section click on “Restore to Default” button Then click on “OK”
To remove from search engine:
Search button--- Manage Search Engines---- select “Funmoods”---- Remove
For a step by step uninstall guide, please watch our tutorial: http://www.youtube.com/watch?v=dT5PWzLDptc
---------------------------------
To remove from Internet Explorer Win7/Vista from toolbar:
Go to Start > Control Panel > Uninstall a program OR Programs and Features > Select “Funmoods” and click on Uninstall
To remove from Home page:
go to Tools > Internet Options > on “Home page” section click on “Use Default” Then click on “OK”
To remove from search engine:
go to Tools > Internet Options > on “Search” section click on “Settings” > select “Live Search” or “Google” or “Bing” and click on “Set Default” > select “Search” and click on “Remove” > OK > OK
New tab (Internet Explorer 8-9)
go to Tools > Internet Options > on “Tabs” section click on “Settings” > on “When a new tab is opened, open:” select “The new tab page” > OK > OK
----------------------------------
In Chrome, to remove toolbar:
Open Chrome, go to Options menu > Tools > Extensions > Click on the “bin” to remove
To remove as homepage:
Open Chrome, go to Options menu > Settings > on the “Appearance” section, check the “Show Home button” > Change > select “Use the New Tab page”
To remove as search engine:
Go to your browser----Click on the tools icon---- options------Change search defaults ----- settings ----- click the name of your preferred search engine---- set as default---- (to remove Funmoods search)----select Funmoods ----remove---- okay
-Or-
Open Chrome, go to Options menu > Settings > on the “Search” section choose Google on the drop down menu
For a step by step uninstall and reset homepage guide, please watch our tutorial: http://www.youtube.com/watch?v=dT5PWzLDptc
Kindly
Alex
Support Agent
wow...i click on the first page and boom it i run it and after rebooting my pc it gives me result of many many files remove,files that i do not even know about including the funmoods shit.
Thanks,9jeria.
Post Comment: