Home Malware Programs Bad Toolbars FunMoods

FunMoods

Posted: January 18, 2012

Threat Metric

Ranking: 1,717
Threat Level: 5/10
Infected PCs: 338,569
First Seen: January 18, 2012
Last Seen: October 16, 2023
OS(es) Affected: Windows

FunMoods Screenshot 1FunMoods may be classified as either adware or as a PUP (Potentially Unwanted Program) due to its predilection for inserting advertisements into online searches and its disingenuous installation/removal methods. While FunMoods is marketed in the form of an add-on that helps Chrome display various emoticons and smiley faces, FunMoods also includes other features that are less desirable than a smile, such as changing your browser settings to display a different homepage, altering your search results and requiring additional effort to be deleted from your PC. While SpywareRemove.com malware researchers can't classify FunMoods as anything worse than a low-level PC threat, if you do need to get rid of FunMoods, anti-malware scans should be considered the most efficient means of doing so.

FunMoods and the Smile that Darkens Your Day

Like other would-be emoticon plugins like SweetIM or Facemoods, FunMoods is a browser extension that offers a legitimate feature alongside various functions that FunMoods keeps quiet about – until after you download FunMoods and find out what FunMoods does for yourself.

While FunMoods does offer the smiley package that FunMoods claims to have, malware researchers have also seen other features in FunMoods of questionable merit, as listed here:

  • FunMoods may change Chrome's homepage (to start.funmoods.com, home.funmoods.com or another self-promoting site) and reset this change if you attempt to undo it.
  • FunMoods may place irrelevant advertising links in your online search results.
  • FunMoods may change your default search engine to one of its own preference.
  • Even removing FunMoods is made unnecessarily difficult, and SpywareRemove.com malware research team especially emphasizes that using Control Panel to uninstall FunMoods still will leave many of FunMoods's changes on your PC.

Detecting FunMoods once FunMoods is aboard shouldn't prove to be any kind of problem since FunMoods visibly alters Chrome's interface to include an additional toolbar for itself.

Kicking the FunMoods PUP to the Curb

FunMoods is often installed in freeware packages (such as Video Grabber or PDF Creator), although, in most cases, FunMoods-free versions of said software are available at reputable websites. Paying careful attention to the installation processes for such programs can help to prevent a potential FunMoods infection if you're uninterested in its services.

Strong browser protection, anti-malware software and a willingness to avoid suspicious applets, surveys and advertisements can all serve you well in keeping FunMoods's smiling face away from your PC. Deleting FunMoods, as in most cases with various types of adware and PUPs, should be handled by any available anti-malware program that's at your disposal.

FunMoods Screenshot 2FunMoods Screenshot 3

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 95.23 KB (95232 bytes)
MD5: 09bae50e8b3eb8eadcd0e3408d2ba0d2
Detection count: 1,651
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 97.79 KB (97792 bytes)
MD5: 9a680b2ca832439aaf55e6c1eae1aaeb
Detection count: 171
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%SystemDrive%\Documents and Settings\NetworkService\Datos de programa\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 105.47 KB (105472 bytes)
MD5: 5f3c086fdf17cc6b9cc058337eb31949
Detection count: 105
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\NetworkService\Datos de programa\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 99.32 KB (99328 bytes)
MD5: e6e2cef6dded1a9ad8906c0c60e1a2cd
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 101.37 KB (101376 bytes)
MD5: 6246030af2f2283d92c7a22bcfaf4711
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 105.47 KB (105472 bytes)
MD5: b7621f5f0412a701fa9abad2dd4cc60d
Detection count: 30
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 99.32 KB (99328 bytes)
MD5: 45a6f5d2427cce5ac1a6b6f1f87364cb
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%SystemDrive%\Users\<username>\AppData\Roaming\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 99.32 KB (99328 bytes)
MD5: d0a5716a7b85798fea424eb5037e6b98
Detection count: 23
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Roaming\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 279 KB (279006 bytes)
MD5: c774b95382d644b533dea073879c65df
Detection count: 19
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 99.32 KB (99328 bytes)
MD5: e02b5775e10188505232649c584a7dcc
Detection count: 19
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 94.72 KB (94720 bytes)
MD5: b5c3eac6e63f690575ca087f986c6b2b
Detection count: 16
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 101.37 KB (101376 bytes)
MD5: 41f951fbdcf8467e92befb5b27d7927c
Detection count: 16
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 1.21 MB (1219584 bytes)
MD5: 0e259e4b82811137a1e88cdfd349f412
Detection count: 16
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 3.52 MB (3526656 bytes)
MD5: 327942a224fcd0595fa15a7c9529c861
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 101.37 KB (101376 bytes)
MD5: b124e575b45e65e6432a3396c1a00dec
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 101.37 KB (101376 bytes)
MD5: c54ebf16f46eed72929aeaf0b8ae5b9e
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 99.32 KB (99328 bytes)
MD5: 4ad2dfde280461e96baf4c9a166e33c6
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 108.02 KB (108028 bytes)
MD5: 15e77ce205bfb1d221824b8933b8be0d
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 99.58 KB (99584 bytes)
MD5: e5b884ddfde6b470aed85d03d8f49aeb
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 105.47 KB (105472 bytes)
MD5: 320a054e3918170ee2d0e1fcabbd10ec
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 175.1 KB (175104 bytes)
MD5: accf1b719e95f2b16d279812c4d93641
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\FunmoodsChat\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 278.99 KB (278998 bytes)
MD5: 8ab33ae5cb61282008eafed2be66a698
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\FunmoodsChat\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 132.6 KB (132608 bytes)
MD5: d021a4ee6267369c27af944d844153e2
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%SystemDrive%\Documents and Settings\NetworkService\Application Data\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 126.97 KB (126976 bytes)
MD5: e5f3af873b125fc190e774ff5e357740
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\NetworkService\Application Data\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 105.47 KB (105472 bytes)
MD5: 79d8f7d4d111bb9daa30d8b263f5ca78
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%APPDATA%\Funmoods\UpdateProc\UpdateTask.exe File name: UpdateTask.exe
Size: 85.5 KB (85504 bytes)
MD5: a4b25fb924704a2b682d1fffb926859d
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Funmoods\UpdateProc
Group: Malware file
Last Updated: March 22, 2016
%ProgramFiles%\Funmoods\1.5.23.22\escortShld.dll File name: %ProgramFiles%\Funmoods\1.5.23.22\escortShld.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%ProgramFiles%\Funmoods\1.5.23.22\escorTlbr.dll File name: %ProgramFiles%\Funmoods\1.5.23.22\escorTlbr.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%ProgramFiles%\Funmoods\1.5.23.22\funmoodssrv.exe File name: %ProgramFiles%\Funmoods\1.5.23.22\funmoodssrv.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%ProgramFiles%\Funmoods\1.5.23.22\escortApp.dll File name: %ProgramFiles%\Funmoods\1.5.23.22\escortApp.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%ProgramFiles%\Funmoods\1.5.23.22\uninstall.exe File name: %ProgramFiles%\Funmoods\1.5.23.22\uninstall.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%AppData%\funmoods.crx File name: %AppData%\funmoods.crx
Mime Type: unknown/crx
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}{965B9DBE-B104-44AC-950A-8A5F97AFF439}{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}{A9DB719C-7156-415E-B49D-BAD039DE4F13}{EA28B360-05E0-4F93-8150-02891F1D8D3C}{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\InstlHKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\DataHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\ProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\ProgrammableHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\VersionIndependentProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ProgrammableHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\VersionIndependentProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\ProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\ProgrammableHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\VersionIndependentProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\InprocServer32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\ProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\ProgrammableHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\VersionIndependentProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\InprocServer32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\ProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\ProgrammableHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\VersionIndependentProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\InprocServer32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\ProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\ProgrammableHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\VersionIndependentProgIDHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}\ProxyStubClsid32HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}\TypeLibHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsidHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ProxyStubClsid32File name without pathfunmoods-speeddial.crxRegexp file mask%LOCALAPPDATA%\funmoods-speeddial_sf.crx%LOCALAPPDATA%\funmoods.crx%LOCALAPPDATA%\funmoods.exe%USERPROFILE%\Local Settings\Application Data\funmoods-speeddial_sf.crx%USERPROFILE%\Local Settings\Application Data\funmoods.crxHKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortApp.DLLHKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escort.DLLHKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escorTlbr.DLLHKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortEng.DLLHKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\esrv.EXEHKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\AppID\escort.DLLSOFTWARE\Classes\AppID\escortApp.DLLSOFTWARE\Classes\AppID\escortEng.DLLSOFTWARE\Classes\AppID\escorTlbr.DLLSOFTWARE\Classes\AppID\esrv.EXESOFTWARE\Classes\escort.escortIEPaneSOFTWARE\Classes\escort.escortIEPane.1SOFTWARE\Classes\esrv.funmoodsESrvcSOFTWARE\Classes\esrv.funmoodsESrvc.1SOFTWARE\Classes\funmoods.dskBndSOFTWARE\Classes\funmoods.dskBnd.1SOFTWARE\Classes\funmoods.funmoodsHlprSOFTWARE\Classes\funmoods.funmoodsHlpr.1SOFTWARE\Classes\funmoodsApp.appCoreSOFTWARE\Classes\funmoodsApp.appCore.1SOFTWARE\Classes\Wow6432Node\AppID\escort.DLLSOFTWARE\Classes\Wow6432Node\AppID\escortApp.DLLSOFTWARE\Classes\Wow6432Node\AppID\escortEng.DLLSOFTWARE\Classes\Wow6432Node\AppID\escorTlbr.DLLSOFTWARE\Classes\Wow6432Node\AppID\esrv.EXESoftware\funmoodsSoftware\funmoodsToolbarSoftware\Microsoft\Internet Explorer\DOMStorage\searchfunmoods.comSoftware\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FunmoodsSoftware\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}SOFTWARE\Wow6432Node\Classes\AppID\escort.DLLSOFTWARE\Wow6432Node\Classes\AppID\escortEng.DLLSOFTWARE\Wow6432Node\Classes\AppID\esrv.EXESOFTWARE\Wow6432Node\FunmoodsSOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}SOFTWARE\Wow6432Node\Microsoft\Tracing\FunmoodsSetup_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\FunmoodsSetup_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\FUNMOO~1_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\FUNMOO~1_RASMANCSSoftware\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}funmoods

Additional Information

The following directories were created:
%APPDATA%\Funmoods%PROGRAMFILES%\Funmoods%PROGRAMFILES(x86)%\Funmoods%USERPROFILE%\AppData\LocalLow\Funmoods
The following URL's were detected:
http://searchfunmoods.com/results.php?q

Related Posts

13 Comments

  • judi conway says:

    remove funmoods restore google

  • larry says:

    I just want it gone.

  • Rebecca Wold says:

    Remove Funmoods and replace MSN.com

  • Alexander Mitchell says:

    FunMoods "piggybacked" on to my PC with an Adobe download how the hell does one get rid of it?

  • Pooja says:

    New virus alert: Sex_TV_&amp;Epsilon;&amp;upsilon; .exe Sun Jan 16, 2011 17:32 pm This backdoor is sent by e-mail or by a inntast messaging program. If you click on a link like hxxp://sat2.110mb.com/w/data/Sex_TV_%26%23917%3B%26%23965%3B%26%23961%3B%26%239 you will be asked to download a archive. Its detection is 16 /41 (39.0%) on VirusTotal. If you run it, the virus will create %ProgramFiles%Outlook Expres .exe file and these registry entries: HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components{A3DCBA6B-C972-F007-9714-B49CC35869CE} HKEY_LOCAL_MACHINESOFTWAREBifrost HKEY_LOCAL_MACHINESYSTEMControlSet001ControlMediaResourcesmsvideo

  • thomas green says:

    please remove funmoods and put it back to google. thank you

  • thomas green says:

    coulod you please remove funmoods and restore google

  • merle graham says:

    i need to uninstall funmoods search

  • rose vilches says:

    Please remove funmoods and restore google chrome. Thank you so much

  • Anthea says:

    newsflash, computer can do math too...heh...but yeah, I am human. seems like a simple question/answer would deal with THAT issue. I am really upset about this funmoods thing. I thought I had gotten rid of it some time back, but yesterday I opened my browser after having shut down for a few hours, and guess WHAT? You GOT IT! I hadn't downloaded anything, but this sh*t appeared out of the blue just the same, and no matter what, it keeps reinserting itself where google should be. This is on IE, I seem to have it quelled on Chrome for the time being. But on IE, it will NOT allow any search to be available other than itself. I am so FED UP with crap like this. I want to beat the SNOT out of whomever is responsible for this spawn from hell!

  • Victor says:

    Need Funmoods removed

  • Dean Bowen says:

    funmoods is blocking my explorer homepage. how can i restore it.

  • yolande seguin says:

    Please remove funmoods and replace MSN.com canada in french. Thank you

Loading...