Related Posts



How To Remove The “Fun Moods” Browser Hijacker Virus (Start.Funmoods.com, Face Moods)

What Is The Fun Moods Virus (Start.Funmoods.com)?

The Fun Moods virus (also known as Face Moods, funmoods) is adware and spyware published by Volonet LTD, categorized as a complete browser hijacker that is capable of changing internet browser settings and browser helped objects, such as the homepage (startup page), browser add-ons and extensions, and managed search engines (default search: start.funmoods.com) which cause internet searches and inputted URLs to redirect to Fun Mood’s search engine Start.Funmoods.com or other third party drive-by websites. Fun Moods is often referred to as a “redirection” virus because of this.

Start Page Fun Moods Virus

Like many browser hijackers, The Fun Moods virus is distrubuted with user consent, downloaded voluntaterly as freeware, but may also install onto infected computers and internet browsers along side (bundled with) other malware, Trojans, and viruses.

Funmoods.com (Fun Moods) claims they are not adware, nor spyware, and also state they are not responsible for any malware on an infected computer system which may have been contracted through them by a third party. Fun Moods purposely leaves the door wide open for other malware infections and third party programs, this is how they extort money from victims. Their terms claim they are not responsible for these actions in grave detail, yet malicious symptoms almost always transpire.

Funmoods

Funmoods.com freeware products range from toolbars and internet settings which claim to help enrich the social media experience by letting users use emoticons, etc. Please be aware, though this may sound realistic, it is not. Fun Moods is can be fatally dangerous if not removed from your computer and internet browser.

Fun Moods Virus Symptoms

  • Fun Moods creates directory files and registry entries on an infected system.
  • Fun Moods changes internet browser settings and BHOs (browser helper objects) such as homepage (startup page), extensions/toolbars, and more.
  • Fun Moods redirects infected internet browsers to funmoods.com, start.funmoods.com, and malicious third party websites.
  • Fun Moods has many symptoms of adware such as popup advertisements and other common adware infections.
  • Once Fun Moods (Funmoods) start to install on your computer it does not allow you to quit their installation unless you access Window’s Task Manager (CTRL+Shit+ESC) and manually end the Funmoods task from running. After this is done, Funmoods will continue to place a file on your desktop called “Continue Funmoods Installation” (pictured below).

Funmoods Setup Installation Files

How To Remove The Fun Moods Virus

Fun Moods installs files and values onto an infected system and affects many individual internet settings. Often some victims only have an add-on, extension, or toolbar installed onto their system while other victims have a dynamic file library.

Funmoods Removal Options

  1. Antivirus/Anti-Malware Software – Scan and remove malware. Continue to repair internet settings (home page, extensions) if needed.
  2. Manually Remove Funmoods And Repair Internet Settings – Remove Funmoods Toolbar, remove Funmoods start page from your browser, remove Funmoods default search, remove Funmoods newly opened tabs,  and remove extensions.
  3. System Restore – Restore your computer to a date and time before infection. Click here for complete Restore instructions.

1. Antivirus/Anti-Malware Software

The safest program to remove hijacker malware is Malwarebytes. 
Funmoods Malwarebytes
Malwarebytes has the largest sample rate of malware due to being the top downloaded Anti-Malware application for the past 2 years and has been documented to remove Funmoods malware (pictured above). Malwarebytes also offers free and paid versions.

2. Funmoods Manual Removal Steps

There are separate options to manually remove Fun Moods (Funmoods, Facemoods) from your computer and internet browser.

Remove Fun Moods (Face Moods) From Your Computer


To remove funmoods from your computer, navigate to the Control Panel in the Start menu, then click on Uninstall/Remove Programs.

Uninstall Facemoods Toolbar

Find the funmoods Toolbar (facemoods) and click Remove.

Facemoods Uninstall Success

Remove funmoods start page from your browser’s home page

To reset your homepage, go to your browser settings:

  1. Microsoft Internet Explorer- Go to Tools and then click Internet Options. On General tab, click Restore to Default.
  2. Mozilla Firefox 4 – Click the orange “Firefox” button on the top left then click Options. On General tab, click Restore to Default.
  3. Mozilla Firefox 3.6 – Go to Tools, click Options. On General tab, click to select your default homepage setting.
  4. Google Chrome – Click on the Wrench icon (top of browser), then go to Options and on Basics tab select your default homepage setting.
Remove funmoods from your browser’s default search

(this is the search located on top right in Explorer/Firefox and in the address bar of Chrome.)

  1. Internet Explorer- Go to Tools and select Internet Options. In the first tab labeled General, click Settings then select your preferred search provider and click Set as Default.
  2. Mozilla Firefox- Click the downward arrow button next to the search box. Then select Manage Search Engines. Select funmoods Search and click Remove.
  3. Google Chrome – Click the wrench icon and select Options. Make sure you are on the first tab “Basics” and then look for “Search” option to select your preferred provider.
Remove funmoods newly opened tabs on your browser
  1.  Internet Explorer 9 – to remove funmoods search from new tabs, go to Tools -> Internet options -> general -> tabs settings, and set the “when a new tab is opened, open” drop down, and choose “The new tab page”.
  2. Internet Explorer 7 and 8 – to remove from funmoods new tabs, the program has to be uninstalled completely.
  3. Mozilla Firefox – Go to Tools and then addons, click Options, then select Advanced and uncheck the first option “Use funmoods as enhanced search for new tab”.
Remove Funmoods Add-ons And Extensions
Please click an internet browser (below) to automatically scroll to significant directions (named anchor link).

  • Google Chrome
  • Mozilla Firefox
  • Microsoft Internet Explorer
  • Apple Safari

  • Google Chrome Extension (CRX):


     Step 1:

      Open Chrome, click on the Settings icon (wrench) and navigate to Tools > Extensions.

    Tools Extensions Google Chrome 
    Step 2:

      Select the Funmoods Toolbar plugin from the list of extensions, and click Uninstall or Disable. (The image below shows a toolbar for another popular form of similar adware, My Web Search)
      Funmoods Google Chrome Extension
    • To search which extensions are currently running on Chrome navigate to Tools > Task Manager


    Mozilla Firefox Extension (XPI):


    Step 1:

      Open Firefox, and navigate to Tools -> Add-ons (Ctrl+Shift+A).

    Tools Addons Firefox
    Step 2:

      Select Extensions and find the particular Funmoods/Facemoods Toolbar extension, and click disable and remove.

      How to block the Funmoods.com cookie
        1.From the Tools menu, select Options
        2.In the upper section of the Options window, click Privacy
        3.In the Cookies tab, click Exceptions
        4. In the new Exceptions – Cookies window, enterFunmoods.com in the Address of Website field and click Disable.


      Microsoft Internet Explorer:


       Step 1:

      Click the Tools button and then click Manage add-ons.

    Manage Add ons Internet Explorer
     Step 2:

      Under Show, click All add-ons or Toolbars and Extensions. (Depends which IE you use)

     Step 3:

      Select the Funmoods plugin from the list of software, and click disable.

      How to block the Funmoods.com cookie
        1. From the Tools menu of Internet Explorer, select Internet Options
        2. Select the Privacy tab and then click Sites. The Per site privacy actions window will be displayed
        3. In the Per site privacy actions window, enter Funmoods.com in the Address of Web site field
        4. Click Block
      Restricted site option

      Access: Tools(Alt-x) > Internet Options
      Tools Internet Options Internet Explorer
      Select the Security tab and click Restricted sites
      Internet Options Restrict Site IE
      Click the “Sites” button and individually enter: Funmoods.com
      Funmoods Virus

      Apple Safari Extension:


       Step 1:

      In settings, go to Preferences and click the Extensions tab.

    Preferences Safari
     Step 2:

      Remove/Disable Funmoods Toolbar extension or turn all extensions Off.

    Safari Extensions

    How to block the Funmoods.com cookie
      1. Click the general Safari menu icon and select Safari Preferences
      2. Select the Privacy tab, and check: Block cookies: “from third parties and advertisers”

    Block cookies on Apple Safari


    banner-1

    Leave a Reply

    Your email address will not be published.

    You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

    29 replies to “How To Remove The “Fun Moods” Browser Hijacker Virus (Start.Funmoods.com, Face Moods)

    1. Sally

      Thank you so much!!! I uninstalled+ everything else you suggested but didn’t install malwarebytes ran a check with AVG…didn’t find anything then read other peoples comments re: normal spyware detector thingy’s not detecting funmoods, so downloaded malwarebytes, scanned and sure enough there was still 2 of the buggers in my computer, thank you so much writing this page!!!!

    2. Charlotte Rich (@CharlotteRmusic)

      Thank you so much for posting this information. I removed the funmoods manually on all of my browsers as instructed. I uninstalled it from my computer using the control panel. I also scanned my computer with Ccleaner and AVG and now everything is clean. Does that mean its officially gone? I want to make sure its not running in the background anywhere or I may have missed something.

      1. Sean Doyle Post author

        It sounds like you were able to successfully remove funmoods, but if you suspect funmoods was installed via a third party download (from such sites as CNET downloads, etc) you may want to search your download history for anything suspicious or questionable.

        My suggestion to ensure funmoods is completely removed is to perform a free scan using Malwarebytes because of all scanning software Malwarebytes positively removes all files associated with funmoods, facemoods.

        Also, when using CCleaner check out the Tools > Startup section for any unwanted startups.

    3. Rish

      Funmoods crashed my Win 7 install. Now i am running Win 8 and it has come back. Does not show that it is installed in program manager and the browser. I had it deleted by Malwarebytes as KIS did nothing. Both KIS 2013 and Avast failed to detect it. Using Malwarebytes now. I hope it can sort it out.

    4. Jane

      If “badmood” say they are not spyware or a virus, Why my mcafee blocking the site? This is not fun and very annoying. he should change his name to bad mood. Thank you for this article. This article is very helpful.

    5. Leo

      Thank you. Norton IS did not detect fundmoods when I ran a full scan. Malwarebytes found 60 instances of funmoods. I deleted all. Hope this gets rid of the problem.
      Is Norton IS 2012 not good enough? I am relying on it.

    6. Anonymous

      Thanks very much for the step by step guide.

      To reiterate what others have posted, this was bundled with software from download.com – it can be any software as the one I installed was not listed in comments.

      Despite unchecking every box imaginable it still installed funmoods. I had Chrome running and Firefox and IE installed (but not running) and it installed itself on all three browsers. The installation happens silently without your consent. You will only be asked to restart your active / running browser – other browsers that are installed on your computer but not running will be affected but you won’t know till you open them the next time.

      CNET seriously need to sort their s*** out. Doesn’t matter how careful you are, you can still get hit if you use download.com.

      1. jo

        I also got it from download.CNET.com. Years ago I used cnet (was it c|net or so) because we delivered also our programs there. On those days we learnt that there is not coming any viruses or malware. But the days have changed…

        Just few days ago I said to one security SW seller that I don’t need his SW, because I use only safe sites ;-) This can still happen, we one trust too much.

        Thank you very much for the instructions :-)

      2. Lisa Falls

        Ironically, the only download I’ve done in the last probably three months was downloading malwarebytes from download.com. I had no problems before that, then suddenly had this funmood stuff and couldn’t figure out where it came from.

    7. Sarah Downing

      Thank you, Sean. I am not usually that stupid, but I idiotically installed this because it came with a program I felt I could trust. Either way, I soon realized it was causing havoc on my browsers and uninstalled it. Realizing that wasn’t enough (even after having run Malwarebytes and quarantined those puppies), I did the manual steps you suggested and they appear to be working. Much appreciated! Keep up the good work!:-).

    8. maria

      Thank you! I got this virus when I was downloading another program to remove another malware, fbdownloader. For some reason I forgot to use the site download.com which I usually use for downloads. In that site and probably several others, they have already checked for viruses and malware. This was really stupid. Thank´s again for helping us computer dummies out ;)!

    9. Pingback: How to Remove Common Browser Hijackers

      1. Smcs Studenka

        Thanks for this. BTW, downloading from downloads.com IS NOT safe. I was installing an extension renamer called… EXTENSION RENAMER and this crap was packaged in with it AND DID NOT ASK or NOTIFY that it was being installed. OBVIOUSLY CNET aka download.com IS NOT checking their software well enough.

        1. and also

          “Funmoods.com (Fun Moods) claims they are not adware, nor spyware, and also state they are not responsible for any malware on an infected computer system which may have been contracted through them by a third party. ”

          At least in my XP the CPU usage went to 100%. Firefox was using 99% until I removed the “fun”-toolbar.
          If that is a feature in other OS’s/browsers, then that sw in near to be a malware.