Nightmare issue with facemoods hyjacking my firefox when opens. I know others having as have seen online. In root system. Help

Question

Hello. Facemoods has hijacked my browser. First noticed yesterday 6-30-11. I did not sign up for. I did much research and have tried different solutions. In addition to what is written below for trouble shooting. I also tried taking off Firefox 4 (mistake) from my control panel to see if that would solve ... does not. Downloaded Firefox 5 and then sadly none of the extensions I have (like 6 of them) including my Kapersky Security were compatible. So I then tried to reinstall Firefox 4 and found out not available for security vulnerabilities reasons - so reinstalled older 3.5 or 3.6 (sorry not sure on exact number) Firefox so at least I have. Does not matter what version I use or if in safe mode with networking - still this hyjacked nightmare occurs. I know is in root system. I can still get google.com by changing in address bar after facemoods page loads - but must click in upper edge of page to get address bar. Still this is tracking my every move and then allows. From research I did this is what Facemoods does: The search toolbar it installs hijacks my current search engine and inject advertisements in all my searches - regardless of whether I choose to use Goodle, Bing, Yahoo or any other major search engine. It is sapping my computers RAM. Then they can install upgrades (though again I did NOT Sign up for. One can not get rid of this junk program by going to Control Panel though they say one can.
Again this is what happened as another wrote:
"start.facemoods.com" has replaced my NetError page... How do I reset this?
http://start.facemoods.com/results.php?f=5&a=ppcb2&q=hfcx is the new 'net error' page for all my web browsers.
The facemoods program installed itself on my computer w/o permission. I uninstalled the program, cleared all traces of facemoods that "Malewarebytes" and "Spybot - Search and Destroy" could find, and now I have a new default net error page directed to the given link above for all my browsers.
I figured uninstalling and then reinstalling would do the trick, I even upgraded to Firefox 4, and still no luck. I wonder if this is because of not deleting all the data such as passwords and bookmarks."
How can I fix this?
I know is a PUPSC per Spybot. Another person wrote on Firefox help ...
""PUPSC" is, but it sounds like it is similar to "PUP" which means "Potentially Unwanted Program". These are generally programs which get flagged by a heuristic virus scanner. Heuristic scanners look for programs which exhibit virus like behavior, instead of looking for known viruses. The downside to these, is that they can produce a lot of false positives.
One website that I saw claims that facemoodssrv.exe does a lot of suspicious things:
* Writes to another Process's Virtual Memory (Process Hijacking)
* Enables a COM Object/Server on the Local Machine
* Can communicate with other computer systems using HTTP protocols
* Registers a Dynamic Link Library File
* This process creates other processes on disk
* Injects code into other processes
* Performs DNS look ups to resolve URL IP addresses
* Uses rootkit techniques to conceal its presence, interrogation or removal
* Executes a Process
This would certainly explain why facemoods gets flagged as a "PUPSC" - this is definitely suspicious behavior! Mind you, facemoods isn't' necessarily a virus because it does these things. In fact, these make sense to me, as I think that facemoods is a program which "injects" smiley graphics in the place of plain text emoticons. In order to do this, you would have to figure out how to convince your web browser to replace a plain text emoticon. Mind you: this IS suspicious virus-like behavior. I personally wouldn't touch it with a ten foot pole. This isn't safe, and should (almost) never be done. The only exception that I can think about are anti-virus programs which use root-kit like behavior to make them harder for a virus to deactivate/sabotage/cripple.
Anyways, even if facemoods is legit, it is also possible that a virus writer has taken the facemoods code and modified it for their own purposes. They then package this with another harmless program. This way when an anti-virus catches it, it flags facemoodssrv.exe as a virus. Because facemoods may engage in risky activities normally, the virus writer may hope that virus scanners won't catch it, or that the user will disregard the warnings. Thus the virus gets away with doing malicious things, because it looks similar to what facemoods normally does.
If there is an application which is installing facemoods without your permission, my advice is to treat it like a virus. Don't trust add/remove programs to remove it correctly.
My question is this: Are the above listed behaviors normal for facemoods?

Answer 1

Your example uses straight text links.  Nothing fancy, no complicated JavaScripts are used.  Just a lot of manual linking.
Example:  http://www.aidenart.com/Concept%20Art%20Pages/ConceptImage1.html
PREVIOUS: http://www.aidenart.com/Concept%20Art%20Pages/ConceptPage2Arga.html
MAIN: http://www.aidenart.com/ConceptArtMain.html
NEXT: http://www.aidenart.com/Concept%20Art%20Pages/ConceptPostitTiratsu.html
Each page contains a different PREVIOUS and NEXT link depending on where it appears within the site.
Hopefully this answers your question.
Nancy O.
Alt-Web Design & Publishing
Web | Graphics | Print | Media  Specialists 
http://alt-web.com/
http://twitter.com/altweb