TROJ_PAM_000005043E.T3

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Funmoods>funmoods>Instl
3. Still in the left panel, locate and delete the key:
   Install
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Funmoods>funmoods>Instl
5. Still in the left panel, locate and delete the key:
   Install
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE>Microsoft>Internet Explorer>SearchScopes
7. Still in the left panel, locate and delete the key:
   {0D7562AE-8EF6-416d-A838-AB665251703A}
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
9. Still in the left panel, locate and delete the key:
   {4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
10. Again Still in the left panel, locate and delete the key:
    escorTlbr.DLL
11. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
12. Still in the left panel, locate and delete the key:
    funmoods.dskBnd.1
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>funmoods.dskBnd.1
14. Still in the left panel, locate and delete the key:
    CLSID
15. Again Still in the left panel, locate and delete the key:
    funmoods.dskBnd
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>funmoods.dskBnd
17. Still in the left panel, locate and delete the key:
    CLSID
18. Again Still in the left panel, locate and delete the key:
    CurVer
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
20. Still in the left panel, locate and delete the key:
    {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
22. Still in the left panel, locate and delete the key:
    ProgID
23. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
24. Again Still in the left panel, locate and delete the key:
    Programmable
25. Again Still in the left panel, locate and delete the key:
    InprocServer32
26. Again Still in the left panel, locate and delete the key:
    TypeLib
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
28. Still in the left panel, locate and delete the key:
    {4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
30. Still in the left panel, locate and delete the key:
    1.0
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}>1.0
32. Still in the left panel, locate and delete the key:
    FLAGS
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}>1.0>0
34. Still in the left panel, locate and delete the key:
    win32
35. Again Still in the left panel, locate and delete the key:
    HELPDIR
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
37. Still in the left panel, locate and delete the key:
    {C87FC351-A80D-43E9-9A86-CF1E29DC443A}
38. Again Still in the left panel, locate and delete the key:
    {09C554C3-109B-483C-A06B-F14172F1A947}
39. Again Still in the left panel, locate and delete the key:
    escort.DLL
40. Again Still in the left panel, locate and delete the key:
    escort.escortIEPane.1
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane.1
42. Still in the left panel, locate and delete the key:
    CLSID
43. Again Still in the left panel, locate and delete the key:
    escort.escortIEPane
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane
45. Still in the left panel, locate and delete the key:
    CLSID
46. Again Still in the left panel, locate and delete the key:
    CurVer
47. Again Still in the left panel, locate and delete the key:
    {965B9DBE-B104-44AC-950A-8A5F97AFF439}
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{965B9DBE-B104-44AC-950A-8A5F97AFF439}
49. Still in the left panel, locate and delete the key:
    ProgID
50. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
51. Again Still in the left panel, locate and delete the key:
    Programmable
52. Again Still in the left panel, locate and delete the key:
    InprocServer32
53. Again Still in the left panel, locate and delete the key:
    TypeLib
54. Again Still in the left panel, locate and delete the key:
    funmoods.funmoodsHlpr.1
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>funmoods.funmoodsHlpr.1
56. Still in the left panel, locate and delete the key:
    CLSID
57. Again Still in the left panel, locate and delete the key:
    funmoods.funmoodsHlpr
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>funmoods.funmoodsHlpr
59. Still in the left panel, locate and delete the key:
    CLSID
60. Again Still in the left panel, locate and delete the key:
    CurVer
61. Again Still in the left panel, locate and delete the key:
    {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
63. Still in the left panel, locate and delete the key:
    ProgID
64. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
65. Again Still in the left panel, locate and delete the key:
    Programmable
66. Again Still in the left panel, locate and delete the key:
    InprocServer32
67. Again Still in the left panel, locate and delete the key:
    TypeLib
68. Again Still in the left panel, locate and delete the key:
    {D7EE8177-D51E-4F89-92B6-83EA2EC40800}
69. Again Still in the left panel, locate and delete the key:
    escortApp.DLL
70. Again Still in the left panel, locate and delete the key:
    funmoodsApp.appCore.1
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>funmoodsApp.appCore.1
72. Still in the left panel, locate and delete the key:
    CLSID
73. Again Still in the left panel, locate and delete the key:
    funmoodsApp.appCore
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>funmoodsApp.appCore
75. Still in the left panel, locate and delete the key:
    CLSID
76. Again Still in the left panel, locate and delete the key:
    CurVer
77. Again Still in the left panel, locate and delete the key:
    {A9DB719C-7156-415E-B49D-BAD039DE4F13}
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A9DB719C-7156-415E-B49D-BAD039DE4F13}
79. Still in the left panel, locate and delete the key:
    ProgID
80. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
81. Again Still in the left panel, locate and delete the key:
    Programmable
82. Again Still in the left panel, locate and delete the key:
    InprocServer32
83. Again Still in the left panel, locate and delete the key:
    TypeLib
84. Again Still in the left panel, locate and delete the key:
    {D7EE8177-D51E-4F89-92B6-83EA2EC40800}
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
86. Still in the left panel, locate and delete the key:
    1.0
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D7EE8177-D51E-4F89-92B6-83EA2EC40800}>1.0
88. Still in the left panel, locate and delete the key:
    FLAGS
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D7EE8177-D51E-4F89-92B6-83EA2EC40800}>1.0>0
90. Still in the left panel, locate and delete the key:
    win32
91. Again Still in the left panel, locate and delete the key:
    HELPDIR
92. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>AppID>{EA28B360-05E0-4F93-8150-02891F1D8D3C}
93. Still in the left panel, locate and delete the key:
    Instl
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{EA28B360-05E0-4F93-8150-02891F1D8D3C}>Instl
95. Still in the left panel, locate and delete the key:
    Data
96. Again Still in the left panel, locate and delete the key:
    {1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}
98. Still in the left panel, locate and delete the key:
    1.0
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}>1.0
100. Still in the left panel, locate and delete the key:
     FLAGS
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}>1.0>0
102. Still in the left panel, locate and delete the key:
     win32
103. Again Still in the left panel, locate and delete the key:
     HELPDIR
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
105. Still in the left panel, locate and delete the key:
     {59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
107. Still in the left panel, locate and delete the key:
     ProxyStubClsid
108. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
109. Again Still in the left panel, locate and delete the key:
     TypeLib
110. Again Still in the left panel, locate and delete the key:
     {2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
111. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
112. Still in the left panel, locate and delete the key:
     ProxyStubClsid
113. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
114. Again Still in the left panel, locate and delete the key:
     TypeLib
115. Again Still in the left panel, locate and delete the key:
     {54291324-7A3D-4F11-B707-3FB6A2C97BD9}
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
117. Still in the left panel, locate and delete the key:
     ProxyStubClsid
118. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
119. Again Still in the left panel, locate and delete the key:
     TypeLib
120. Again Still in the left panel, locate and delete the key:
     {C0585B2F-74D7-4734-88DE-6C150C5D4036}
121. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C0585B2F-74D7-4734-88DE-6C150C5D4036}
122. Still in the left panel, locate and delete the key:
     ProxyStubClsid
123. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
124. Again Still in the left panel, locate and delete the key:
     TypeLib
125. Again Still in the left panel, locate and delete the key:
     {EF0588D6-1621-4A75-B8BE-F4BC34794136}
126. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EF0588D6-1621-4A75-B8BE-F4BC34794136}
127. Still in the left panel, locate and delete the key:
     ProxyStubClsid
128. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
129. Again Still in the left panel, locate and delete the key:
     TypeLib
130. Again Still in the left panel, locate and delete the key:
     {5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
132. Still in the left panel, locate and delete the key:
     ProxyStubClsid
133. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
134. Again Still in the left panel, locate and delete the key:
     TypeLib
135. Again Still in the left panel, locate and delete the key:
     {23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
137. Still in the left panel, locate and delete the key:
     ProxyStubClsid
138. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
139. Again Still in the left panel, locate and delete the key:
     TypeLib
140. Again Still in the left panel, locate and delete the key:
     {23C70BCA-6E23-4A65-AD2E-1389062074F1}
141. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{23C70BCA-6E23-4A65-AD2E-1389062074F1}
142. Still in the left panel, locate and delete the key:
     ProxyStubClsid
143. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
144. Again Still in the left panel, locate and delete the key:
     TypeLib
145. Again Still in the left panel, locate and delete the key:
     {34C1FDF7-02C1-4F23-B393-F48B16E071D1}
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
147. Still in the left panel, locate and delete the key:
     ProxyStubClsid
148. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
149. Again Still in the left panel, locate and delete the key:
     TypeLib
150. Again Still in the left panel, locate and delete the key:
     {0D80F1C5-D17B-4177-AC68-955F3EF9F191}
151. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
152. Still in the left panel, locate and delete the key:
     ProxyStubClsid
153. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
154. Again Still in the left panel, locate and delete the key:
     TypeLib
155. Again Still in the left panel, locate and delete the key:
     {D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
156. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
157. Still in the left panel, locate and delete the key:
     ProxyStubClsid
158. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
159. Again Still in the left panel, locate and delete the key:
     TypeLib
160. Again Still in the left panel, locate and delete the key:
     {77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
162. Still in the left panel, locate and delete the key:
     ProxyStubClsid
163. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
164. Again Still in the left panel, locate and delete the key:
     TypeLib
165. Again Still in the left panel, locate and delete the key:
     {295CACB4-51F5-46FD-914E-C72BAAE1B672}
166. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{295CACB4-51F5-46FD-914E-C72BAAE1B672}
167. Still in the left panel, locate and delete the key:
     ProxyStubClsid
168. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
169. Again Still in the left panel, locate and delete the key:
     TypeLib
170. Again Still in the left panel, locate and delete the key:
     {B12E99ED-69BD-437C-86BE-C862B9E5444D}
171. Again Still in the left panel, locate and delete the key:
     escortEng.DLL
172. Again Still in the left panel, locate and delete the key:
     f
173. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>f
174. Still in the left panel, locate and delete the key:
     CLSID
175. Again Still in the left panel, locate and delete the key:
     CurVer
176. Again Still in the left panel, locate and delete the key:
     {F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
177. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
178. Still in the left panel, locate and delete the key:
     ProgID
179. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
180. Again Still in the left panel, locate and delete the key:
     Programmable
181. Again Still in the left panel, locate and delete the key:
     InprocServer32
182. Again Still in the left panel, locate and delete the key:
     TypeLib
183. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>AppID>{EA28B360-05E0-4F93-8150-02891F1D8D3C}>instl
184. Still in the left panel, locate and delete the key:
     dfltLng
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Google>chrome>Extensions
186. Still in the left panel, locate and delete the key:
     fdloijijlkoblmigdofommgnheckmaki
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
188. Still in the left panel, locate and delete the key:
     funmoods
189. Again Still in the left panel, locate and delete the key:
     {960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
190. Again Still in the left panel, locate and delete the key:
     esrv.EXE
191. Again Still in the left panel, locate and delete the key:
     esrv.funmoodsESrvc.1
192. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.funmoodsESrvc.1
193. Still in the left panel, locate and delete the key:
     CLSID
194. Again Still in the left panel, locate and delete the key:
     esrv.funmoodsESrvc
195. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.funmoodsESrvc
196. Still in the left panel, locate and delete the key:
     CLSID
197. Again Still in the left panel, locate and delete the key:
     CurVer
198. Again Still in the left panel, locate and delete the key:
     {75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
199. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
200. Still in the left panel, locate and delete the key:
     ProgID
201. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
202. Again Still in the left panel, locate and delete the key:
     Programmable
203. Again Still in the left panel, locate and delete the key:
     LocalServer32
204. Again Still in the left panel, locate and delete the key:
     TypeLib
205. Again Still in the left panel, locate and delete the key:
     {960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
206. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
207. Still in the left panel, locate and delete the key:
     1.0
208. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}>1.0
209. Still in the left panel, locate and delete the key:
     FLAGS
210. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}>1.0>0
211. Still in the left panel, locate and delete the key:
     win32
212. Again Still in the left panel, locate and delete the key:
     HELPDIR
213. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Funmoods>funmoods>Instl>Install
3. In the right panel, locate and delete the entry:
   Start Page = "http://www.{BLOCKED}oft.com/isapi/redir.dll?prd
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>AboutURLs
5. In the right panel, locate and delete the entry:
   Tabs = "http://start.{BLOCKED}ds.com/?f
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Funmoods>funmoods>Instl>Install
7. In the right panel, locate and delete the entry:
   SearchAssistant = "http://ie.{BLOCKED}h.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
8. Again In the right panel, locate and delete the entry:
   Use Custom Search URL = "0"
9. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
10. In the right panel, locate and delete the entry:
    Use Custom Search URL = "0"
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes>{0D7562AE-8EF6-416d-A838-AB665251703A}
12. In the right panel, locate and delete the entry:
    URL = "http://start.{BLOCKED}ds.com/?a
13. Again In the right panel, locate and delete the entry:
    DisplayName = "Search"
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes
15. In the right panel, locate and delete the entry:
    DefaultScope = "{0D7562AE-8EF6-416d-A838-AB665251703A}"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escorTlbr.DLL
17. In the right panel, locate and delete the entry:
    AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}>InprocServer32
19. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
21. In the right panel, locate and delete the entry:
    AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Toolbar
23. In the right panel, locate and delete the entry:
    {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} = "Funmoods Toolbar"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
25. In the right panel, locate and delete the entry:
    Policy = "3"
26. Again In the right panel, locate and delete the entry:
    AppName = "funmoodssrv.exe"
27. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\Funmoods\funmoods\1.5.11.16"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
29. In the right panel, locate and delete the entry:
    NoExplorer = "1"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escort.DLL
31. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{965B9DBE-B104-44AC-950A-8A5F97AFF439}>InprocServer32
33. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{965B9DBE-B104-44AC-950A-8A5F97AFF439}
35. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}>InprocServer32
37. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
39. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escortApp.DLL
41. In the right panel, locate and delete the entry:
    AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A9DB719C-7156-415E-B49D-BAD039DE4F13}>InprocServer32
43. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A9DB719C-7156-415E-B49D-BAD039DE4F13}
45. In the right panel, locate and delete the entry:
    AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{EA28B360-05E0-4F93-8150-02891F1D8D3C}>Instl>Data
47. In the right panel, locate and delete the entry:
    hrdId = "68ad0fd00000000000000050569c013f"
48. Again In the right panel, locate and delete the entry:
    instlDay = "3c6d"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}>TypeLib
50. In the right panel, locate and delete the entry:
    Version = "1.0"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}>TypeLib
52. In the right panel, locate and delete the entry:
    Version = "1.0"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{54291324-7A3D-4F11-B707-3FB6A2C97BD9}>TypeLib
54. In the right panel, locate and delete the entry:
    Version = "1.0"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C0585B2F-74D7-4734-88DE-6C150C5D4036}>TypeLib
56. In the right panel, locate and delete the entry:
    Version = "1.0"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EF0588D6-1621-4A75-B8BE-F4BC34794136}>TypeLib
58. In the right panel, locate and delete the entry:
    Version = "1.0"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}>TypeLib
60. In the right panel, locate and delete the entry:
    Version = "1.0"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}>TypeLib
62. In the right panel, locate and delete the entry:
    Version = "1.0"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{23C70BCA-6E23-4A65-AD2E-1389062074F1}>TypeLib
64. In the right panel, locate and delete the entry:
    Version = "1.0"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{34C1FDF7-02C1-4F23-B393-F48B16E071D1}>TypeLib
66. In the right panel, locate and delete the entry:
    Version = "1.0"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0D80F1C5-D17B-4177-AC68-955F3EF9F191}>TypeLib
68. In the right panel, locate and delete the entry:
    Version = "1.0"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}>TypeLib
70. In the right panel, locate and delete the entry:
    Version = "1.0"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}>TypeLib
72. In the right panel, locate and delete the entry:
    Version = "1.0"
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{295CACB4-51F5-46FD-914E-C72BAAE1B672}>TypeLib
74. In the right panel, locate and delete the entry:
    Version = "1.0"
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escortEng.DLL
76. In the right panel, locate and delete the entry:
    AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}>InprocServer32
78. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
80. In the right panel, locate and delete the entry:
    AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
81. Again In the right panel, locate and delete the entry:
    vrsni = "1.5.11.16"
82. Again In the right panel, locate and delete the entry:
    afltId = "down"
83. Again In the right panel, locate and delete the entry:
    aflt = "down"
84. Again In the right panel, locate and delete the entry:
    smplGrp = "none"
85. Again In the right panel, locate and delete the entry:
    tlbrId = "base"
86. Again In the right panel, locate and delete the entry:
    vrsnTs = "1.5.11.161:10:56"
87. Again In the right panel, locate and delete the entry:
    tlbrSrchUrl = "http://start.{BLOCKED}ds.com/results.php?f
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>chrome>Extensions>fdloijijlkoblmigdofommgnheckmaki
89. In the right panel, locate and delete the entry:
    path = "%Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx"
90. Again In the right panel, locate and delete the entry:
    version = "1.4.5"
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Funmoods>funmoods>Instl
92. In the right panel, locate and delete the entry:
    InstallDir = "%Program Files%\Funmoods\funmoods\1.5.11.16"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>funmoods
94. In the right panel, locate and delete the entry:
    DisplayName = "Funmoods on IE and Chrome"
95. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\Funmoods\funmoods\1.5.11.16\uninstall.exe"
96. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe"
97. Again In the right panel, locate and delete the entry:
    NoModify = "1"
98. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>esrv.EXE
100. In the right panel, locate and delete the entry:
     AppID = "{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}"
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}>LocalServer32
102. In the right panel, locate and delete the entry:
     ThreadingModel = "apartment"
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}
104. In the right panel, locate and delete the entry:
     AppID = "{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}"
105. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. In the right panel, locate the registry value:
   Start Page = "http://start.{BLOCKED}ds.com/?f
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start Page = "http://www.microsoft.com/isapi/redir.dll?prd
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Search
6. In the right panel, locate the registry value:
   SearchAssistant = "http://start.{BLOCKED}ds.com/results.php?f
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   SearchAssistant = "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
8. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %Application Data%\funmoods.exe
   • %Application Data%\facemoods.bmp
   • %Application Data%\dealply.bmp
   • %Application Data%\bloson.bmp
   • %Application Data%\lateral1.bmp
   • %Application Data%\lateral2.bmp
   • %Application Data%\lateral3.bmp
   • %User Temp%\nsa2.tmp\LangDLL.dll
   • %User Temp%\nsa2.tmp\nsRandom.dll
   • %User Temp%\nsa2.tmp\System.dll
   • %User Temp%\nsa2.tmp\modern-header.bmp
   • %User Temp%\nsa2.tmp\nsDialogs.dll
   • %User Temp%\nsa2.tmp\inetc.dll
   • %Application Data%\temp.u2d
   • %User Temp%\nsa2.tmp\md5dll.dll
   • %Application Data%\optimizador-condor-3.0.zip
   • %User Temp%\nsz4.tmp\UserInfo.dll
   • %User Temp%\nsz4.tmp\System.dll
   • %User Temp%\nsz4.tmp\nsisos.dll
   • %User Temp%\nsz4.tmp\mt.dll
   • %User Temp%\nsz4.tmp\Time.dll
   • %User Temp%\nsz4.tmp\Processes.dll
   • %User Temp%\FNMD\FM\1.5.11.16\FM4ffx.exe
   • %User Temp%\FNMD\FM\1.5.11.16\FM4ie.exe
   • %User Temp%\nsz4.tmp\InetLoad.dll
   • %User Temp%\FNMD\FM\1.5.11.16\nsis.js
   • %User Temp%\nsz4.tmp\NSISdl.dll
   • %User Temp%\nsm9.tmp
   • %User Temp%\nsn6.tmp\UserInfo.dll
   • %User Temp%\nsn6.tmp\System.dll
   • %User Temp%\nsn6.tmp\nsisos.dll
   • %Program Files%\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll
   • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll
   • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll
   • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll
   • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
   • %Program Files%\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx
   • %Program Files%\Funmoods\funmoods\1.5.11.16\uninstall.exe
   • %User Temp%\nsd8.tmp\nsisos.dll
   • %User Temp%\nsd8.tmp\System.dll
   • %User Temp%\nsd8.tmp\mt.dll
   • %User Temp%\nsd8.tmp\Time.dll
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\Documents and Settings\Wilbert
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsa2.tmp
   • %User Temp%\nsz4.tmp
   • %Program Files%\Mozilla Firefox
   • %Program Files%\Mozilla Firefox\extensions
   • %Program Files%\Mozilla Firefox\searchplugins
   • %User Temp%\FNMD
   • %User Temp%\FNMD\FM
   • %User Temp%\FNMD\FM\1.5.11.16
   • %User Temp%\nsn6.tmp
   • %Program Files%\Funmoods
   • %Program Files%\Funmoods\funmoods
   • %Program Files%\Funmoods\funmoods\1.5.11.16
   • %Program Files%\Funmoods\funmoods\1.5.11.16\bh
   • %User Temp%\nsd8.tmp
   • %User Temp%\mt_ffx
   • %User Temp%\mt_ffx\Funmoods
   • %User Temp%\mt_ffx\Funmoods\funmoods
   • %User Temp%\mt_ffx\Funmoods\funmoods\1.5.11.16
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.