|
 LuSiD9
reality is plastic
 
Registered: 09/06/06
Posts: 3,817
Loc: The Bowels of Canada
Last seen: 9 days, 1 hour
|
 I can't get rid of this 'funmoods' shit 
#16240298 - 05/16/12 03:36 PM (1 year, 2 days ago) |
|
|
apparently, I somehow downloaded this 'funmoods' toolbar... no idea where it came from, but it's fucking with my computer in a bad way.
managed to get rid of the toolbar itself, well, disabled it at least... but any time I open up firefox I get this fucking funmoods homepage instead of google, nothing I do gets rid of it.
tried add/remove programs, didn't work..
spybot doesn't pick it up, neither does microsoft security essentials..
tried running malewarebytes but it seems to have disabled it 
wtf can I do?... do I need to reformat?
it's causing all sorts of freezing issues and keeps shutting down my laptop every 5 minutes
help!
--------------------
Nothing is true, everything is permissible.
Our laws make law impossible; our liberties destroy all freedom; our property is organized robbery; our morality an impudent hypocrisy; our wisdom is administered by inexperienced or mal-experienced dupes; our power wielded by cowards and weaklings; and our honour false in all its points. I am an enemy of the existing order for good reasons.
Nobel Prize genius Crick was high on LSD when he discovered the secret of life
|
LuSiD9
reality is plastic
Registered: 09/06/06
Posts: 3,817
Loc: The Bowels of Canada
Last seen: 9 days, 1 hour
|
 Re: I can't get rid of this 'funmoods' shit [Re: LuSiD9]
#16240326 - 05/16/12 03:44 PM (1 year, 2 days ago) |
|
|
here's my hijack this thing if it helps
Running processes:
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=bf4
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: uTorrentBar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (file missing)
O2 - BHO: wxDfast - {BFEB25B2-54F4-409F-8B7A-83A98EFFD97B} - C:\ProgramData\wxDfast\bhoclass.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (file missing)
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (file missing)
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [KGShareApp] C:\Program Files (x86)\Kodak\KODAK Share Button App\KGShare_App.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: intu-tt2011 - {B3B5DAD9-E96D-45B4-B636-B6CF2F773DE1} - C:\Program Files (x86)\TurboTax 2011\ic2011pp.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--------------------
Nothing is true, everything is permissible.
Our laws make law impossible; our liberties destroy all freedom; our property is organized robbery; our morality an impudent hypocrisy; our wisdom is administered by inexperienced or mal-experienced dupes; our power wielded by cowards and weaklings; and our honour false in all its points. I am an enemy of the existing order for good reasons.
Nobel Prize genius Crick was high on LSD when he discovered the secret of life
|
iateshaggy
i haxor 360s
Registered: 05/20/05
Posts: 4,277
Loc: 612 Warf Avenue, next to....
Last seen: 3 hours, 44 minutes
|
Re: I can't get rid of this 'funmoods' shit [Re: LuSiD9]
#16242116 - 05/16/12 09:43 PM (1 year, 2 days ago) |
|
|
did u try opening google and setting it as homepage?
--------------------
You are a filipina sex goddess who wants to fuck me until I fall asleep, so then you can tickle my balls and see if the legend of my diamond filled nutsuck is true. I am a white man from costa rica, who smells like lime jello.
I can flash/jtag/repair 360's, pm for details.
|
 mycomyst
Alchemist
Registered: 12/30/10
Posts: 40
|
Re: I can't get rid of this 'funmoods' shit [Re: LuSiD9]
#16242231 - 05/16/12 10:03 PM (1 year, 2 days ago) |
|
|
It's a piece of malware. I have cleaned it out of customer's machines. It redirects, among other things...you can find info on the net on how to get it off your computer. One tool I use is Malewarebytes, you shouldn't have to reformatto get rid of it.
|
shroominliketruman
Registered: 08/17/10
Posts: 111
Loc: The American Dream
Last seen: 14 days, 17 hours
|
Re: I can't get rid of this 'funmoods' shit [Re: mycomyst]
#16242703 - 05/16/12 11:25 PM (1 year, 2 days ago) |
|
|
Hey I have deal with all types of virus/trojan/malware issues.
I have found the best antivirus program to be NOD32. I just use the month long free trial and setup a new account every month. I am in the process of restoring my computer. Once you get a virus on your machine that a virus scann isn't removing or detecting its very difficult to get rid of it. The best way to keep that from happening is prevention, and being careful of what you download. Movies and videos are typically safe, but games and things like that from my experience aren't safe. I am using a program called Livedrive. A 2 week free trial and backing up all my information. Ive uploaded 83 GB on there in less then 24 hours so its pretty fast. I have to restore and download all my stuff and ill be good to go. Make sure if you do that you install your antivirus before you redownload all your information or you may get infected again.
--------------------
Music notes are like elements, existence is harmony.
|
cokane
Stranger
Registered: 09/16/08
Posts: 907
Last seen: 28 days, 23 hours
|
|
Autoruns for Windows might help http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
What about combo fix? People like to use that one.
Try safe mode and disconnecting the machine from the internet.
Like others have said you don't have to wipe your machine. But you could spend hours or days trying to remove whatever is on your machine, and not be 100% sure the Malware is gone. The best way to ensure its gone is by reformatting the hard drive; which is done be reinstalling the OS. I reinstalled Windows on my main computer yesterday and my machine is pretty much the same as it was before the new install. I have also installed a few operating systems in my time so its not a big deal to me. I use this website to download and install software its super http://ninite.com/ and I keep all of my important files backed up.
--------------------
Microsoft Certified Technology Specialist (Windows 7)
CompTIA A+ & Security+
TrollTIA Lurking+
|
shroominliketruman
Registered: 08/17/10
Posts: 111
Loc: The American Dream
Last seen: 14 days, 17 hours
|
Re: I can't get rid of this 'funmoods' shit [Re: cokane]
#16243736 - 05/17/12 05:10 AM (1 year, 1 day ago) |
|
|
Hey cokane that ninite.com software looks really cool. It helps you update all the basic things you need on your computer? or you can add your own programs on it that you want when you restore?
--------------------
Music notes are like elements, existence is harmony.
|
LuSiD9
reality is plastic
Registered: 09/06/06
Posts: 3,817
Loc: The Bowels of Canada
Last seen: 9 days, 1 hour
|
Re: I can't get rid of this 'funmoods' shit [Re: cokane]
#16243742 - 05/17/12 05:11 AM (1 year, 1 day ago) |
|
|
Quote:
iateshaggy said:
did u try opening google and setting it as homepage?
yes... it just gets set back to funmoods
Quote:
mycomyst said:
One tool I use is Malewarebytes
I can't even run run malewarebytes for some reason now... worked fine before that fucking toolbar showed up
Quote:
shroominliketruman said:
I have found the best antivirus program to be NOD32. I just use the month long free trial and setup a new account every month.
I will never put that on my computer again... ever
Quote:
cokane said:
Try safe mode and disconnecting the machine from the internet.
tried that
Quote:
cokane said:
Autoruns for Windows might help http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
What about combo fix? People like to use that one.
what is that exactly?
from what I've read, this is a fucking PAIN to get rid of.... and just recently got even worse... the hackers that made it have made it even harder to get rid of... hence the malewarebytes not working now (I even tried uninstalling, downloading new copy and re-installing it to no avail)
--------------------
Nothing is true, everything is permissible.
Our laws make law impossible; our liberties destroy all freedom; our property is organized robbery; our morality an impudent hypocrisy; our wisdom is administered by inexperienced or mal-experienced dupes; our power wielded by cowards and weaklings; and our honour false in all its points. I am an enemy of the existing order for good reasons.
Nobel Prize genius Crick was high on LSD when he discovered the secret of life
Edited by LuSiD9 (05/17/12 06:09 AM)
|
iateshaggy
i haxor 360s
Registered: 05/20/05
Posts: 4,277
Loc: 612 Warf Avenue, next to....
Last seen: 3 hours, 44 minutes
|
Re: I can't get rid of this 'funmoods' shit [Re: LuSiD9]
#16243898 - 05/17/12 07:13 AM (1 year, 1 day ago) |
|
|
+1 for nod32, i use eset smart security (full suite for nod 32) and couldn't be happier with it. i use mynodlogin to update my license.
--------------------
You are a filipina sex goddess who wants to fuck me until I fall asleep, so then you can tickle my balls and see if the legend of my diamond filled nutsuck is true. I am a white man from costa rica, who smells like lime jello.
I can flash/jtag/repair 360's, pm for details.
|
shroominliketruman
Registered: 08/17/10
Posts: 111
Loc: The American Dream
Last seen: 14 days, 17 hours
|
Re: I can't get rid of this 'funmoods' shit [Re: iateshaggy]
#16243923 - 05/17/12 07:33 AM (1 year, 1 day ago) |
|
|
Why do you hate NOD 32. The virus I have on my computer hasn't been detected by any virus scanner. I went through like 4 different ones since ive had the problem?
--------------------
Music notes are like elements, existence is harmony.
|
cokane
Stranger
Registered: 09/16/08
Posts: 907
Last seen: 28 days, 23 hours
|
|
cokane said:
Autoruns for Windows might help http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
What about combo fix? People like to use that one.
what is that exactly?
Autoruns tells you what programs automatically start running when the machine is booted. You can use Autoruns to see what is running, but the best part about Autoruns is the ability to stop/turn-off programs from running when the machine is booting; basically you can try to cock block bad applications/malware that are running on your machine. This guy explains it pretty good http://youtu.be/BWAWONv6Cg8
Combofix is a freeware (a legitimate spyware remover created by sUBs), Combofix was designed to scan a computer for known malware, spyware (SurfSideKick, QooLogic, and Look2Me as well as any other combination of the mentioned spyware applications) and remove them,ComboFix allows the manual removal of spyware infections , It ‘s a specialized effective cleaning tool, which is useful compared to other malware and spyware removers.
http://www.combofix.org/
You could look into SmithFraudFix as well, but I am just guessing and hoping one of these programs will fix you machine. http://siri.geekstogo.com/SmitfraudFix.php
--------------------
Microsoft Certified Technology Specialist (Windows 7)
CompTIA A+ & Security+
TrollTIA Lurking+
|
iateshaggy
i haxor 360s
Registered: 05/20/05
Posts: 4,277
Loc: 612 Warf Avenue, next to....
Last seen: 3 hours, 44 minutes
|
|
Quote:
shroominliketruman said:
Why do you hate NOD 32. The virus I have on my computer hasn't been detected by any virus scanner. I went through like 4 different ones since ive had the problem?
i don't hate it, i love it. that is why i got the full suite for it. nod32 is just the av program made by eset. eset smart security is their full security solution.
--------------------
You are a filipina sex goddess who wants to fuck me until I fall asleep, so then you can tickle my balls and see if the legend of my diamond filled nutsuck is true. I am a white man from costa rica, who smells like lime jello.
I can flash/jtag/repair 360's, pm for details.
|
mycomyst
Alchemist
Registered: 12/30/10
Posts: 40
|
Re: I can't get rid of this 'funmoods' shit [Re: iateshaggy]
#16247404 - 05/17/12 11:09 PM (1 year, 1 day ago) |
|
|
+1 for combofix, it works well! MSDART or ERD for autoruns, if it shows up there (not all malwere will). If it does, right click on that autorun and choose 'explore' and go to the .exe of that file and see what it is named ( it can be different). What I will do then is use regedit (in safe mode) to remove any regestry entries with that name. Once that's all done, Malewarebytes should work, run it and get rid of anything else it finds, followed by a scan with a good anti virus program ( I use MS Security Essentials). Good luck hope you get off your machine.
|
FalconSays
Metaphysical Intuitive
Registered: 11/15/12
Posts: 1
Loc: Las Vegas, NV
|
((((Thank You!!!))))->Re: I can't get rid of this 'funmoods' shit [Re: mycomyst]
#17222421 - 11/15/12 03:38 AM (5 months, 29 days ago) |
|
|
I had that freak'n funmood malware all of about 5 minutes before I searched and immediately found this forum. . . .
Thank you to the people that posted the solution. I LOVE autorun and combofix! Works like a charm.
~Karen
|
Idiot
I Am Moron!
Registered: 11/27/05
Posts: 6,437
Loc: 41.90231, 12.45390 
Last seen: 5 days, 19 hours
|
((((Thank You!!!))))->Re: I can't get rid of this 'funmoods' shit [Re: FalconSays]
#17226135 - 11/15/12 09:56 PM (5 months, 29 days ago) |
|
|
I threw your hijackthis log into their analyzer and it came up with this as the problem. It looks like it just sets up funmoods as your start page.
Code:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=bf4
I'm pretty late to this thread, did you remove this already?
--------------------
Customize your Shroomery experience!
Do not argue with an idiot. He will drag you down to his level and beat you with experience.
|
LuSiD9
reality is plastic
Registered: 09/06/06
Posts: 3,817
Loc: The Bowels of Canada
Last seen: 9 days, 1 hour
|
Re: ((((Thank You!!!))))->Re: I can't get rid of this 'funmoods' shit [Re: Idiot]
#17233798 - 11/17/12 06:03 AM (5 months, 27 days ago) |
|
|
Quote:
FalconSays said:
I had that freak'n funmood malware all of about 5 minutes before I searched and immediately found this forum. . . .
Thank you to the people that posted the solution. I LOVE autorun and combofix! Works like a charm.
~Karen
 
Quote:
Idiot said:
I threw your hijackthis log into their analyzer and it came up with this as the problem. It looks like it just sets up funmoods as your start page.
Code:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=bf4
I'm pretty late to this thread, did you remove this already?
I did, yes... can't remember how though...
now it's this 'snap.do' shit... just as much, if not more of a pain in the ass to remove...
my girlfriend really has to stop stop streaming popular t.v. shows... seems the only time we get this kinda shit is when she watches full seasons pretty much back to back episodes
--------------------
Nothing is true, everything is permissible.
Our laws make law impossible; our liberties destroy all freedom; our property is organized robbery; our morality an impudent hypocrisy; our wisdom is administered by inexperienced or mal-experienced dupes; our power wielded by cowards and weaklings; and our honour false in all its points. I am an enemy of the existing order for good reasons.
Nobel Prize genius Crick was high on LSD when he discovered the secret of life
|
|
Images only 
Threaded
Previous
Index
Next
Edit 
Reply 
~FalconSays
