FunMoods

FunMoods Description

ScreenshotFunMoods is not a particularly high-level threat. However, there have been several reports of malware-like behavior associated with the FunMoods Toolbar. This toolbar, used to add smileys and other emoticons to email messages and Facebook conversations, has been linked to browser redirects to the Start.funmoods.com website and is very difficult to remove using normal means. In fact, many anti-malware software manufacturers identify FunMoods as a Trojan named either Trojan.ADH.2 or Generic.bfr!3CE4B0FBD940.

Although FunMoods is limited to infecting Windows computer systems, FunMoods is not associated with a single web browser. FunMoods is a toolbar that has been observed to work with several of the most popularly utilized web browser on the market. Some of the unwanted behaviors associated with FunMoods include the following:
  1. FunMoods may change your web browser settings so that your homepage is set to Start.funmoods.com, a 'feature' that cannot be changed as long as FunMoods is installed.
  2. FunMoods has been known to cause browser redirects to the page mentioned above. In fact, some computer users have reported being directed to this website after carrying out an online search on a reliable search engine, a sign of a browser hijacker infection.
  3. FunMoods has also been associated with poor system and web browser performance due to its software conflicts and the fact that FunMoods does not allow normal removal.
  4. Computer users that have installed FunMoods may experience unusual pop-up messages when browsing the Internet.

Although the symptoms associated with FunMoods are not particularly malicious, they may make your computer more vulnerable to other, more severe malware infections. FunMoods may leave many of its components on the infected computer if you try to remove FunMoods by going to the Windows Control Panel and using the Add/Remove Programs feature. ESG security researchers strongly advise using a reliable anti-malware program to remove FunMoods completely from the infected computer system. You cannot revert any of FunMoods' irritating symptoms by changing your web browser settings, these will simply be changed the next time you start up your web browser.

Infected with FunMoods? Scan Your PC for Free

Download SpyHunter’s Spyware Scanner
to Detect FunMoods

Security Doesn't Let You Download SpyHunter or Access the Internet?


Solutions: Your computer may have malware hiding in memory that prevents any program, including SpyHunter, from executing on your computer. Follow to download SpyHunter and gain access to the Internet:
  • Use an alternative browser. Malware may disable your browser. If you're using IE, for example, and having problems downloading SpyHunter, you should open Firefox, Chrome or Safari browser instead.
  • Use a removable media. Download SpyHunter on another clean computer, burn it to a USB flash drive, DVD/CD, or any preferred removable media, then install it on your infected computer and run SpyHunter's malware scanner.
  • Start Windows in Safe Mode. If you can not access your Window's desktop, reboot your computer in 'Safe Mode with Networking' and install SpyHunter in Safe Mode.
  • IE Users: Disable proxy server for Internet Explorer to browse the web with Internet Explorer or update your anti-spyware program. Malware modifies your Windows settings to use a proxy server to prevent you from browsing the web with IE.

If you still can't install SpyHunter? View other possible causes of installation issues.

Technical Information

File System Details

FunMoods creates the following file(s):
# File Name
1 %ProgramFiles%\Funmoods\1.5.23.22\funmoodssrv.exe
2 %ProgramFiles%\Funmoods\1.5.23.22\escorTlbr.dll
3 %ProgramFiles%\Funmoods\1.5.23.22\uninstall.exe
4 %ProgramFiles%\Funmoods\1.5.23.22\escortShld.dll
5 %ProgramFiles%\Funmoods\1.5.23.22\escortApp.dll
6 %PROGRAMFILES%\Funmoods
7 %USERPROFILE%\AppData\LocalLow\Funmoods
8 %AllUsersProfile%\[random]\*.lnk

Registry Details

FunMoods creates the following registry entry or registry entries:
HKEY..\..\..\..{RegistryKeys}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortEng.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\[RANDOM CHARACTERS]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escortApp.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\esrv.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current\Winlogon\"Shell" = "[RANDOM CHARACTERS].exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escort.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\escorTlbr.DLL

One Comment

  • darwin says:

    Mine started with 1clickdownloader then it installed this toolbar babylon and extensions: funmoods, photoit, 1clickdownloader, fastspeed (something…not sure). It freezes everything!! you have to force shutdown the computer and only MBAM can see it but not totally stop it! I have scanned my laptop thrice now,.. I’m not sure if it will reach to four. I think it’s pretty much a POWERFUL MALWARE than this site is suggesting. All your browser’s affected, it freezes your computer and anti-viruses can’t detect it

Leave a Reply

IMPORTANT! To be able to proceed, you need to solve the following simple math.
Please leave these two fields as-is:
What is 6 + 6 ?