mwsBar.dll
My Web Search Bar for Internet Explorer, FireFox, email clients, and messenger clients by Mindspark Interactive Network (Signed)
Warning 31 antivirus scanners has detected malware in various versions of mwsBar.dll.
Overview
mwsbar.dll has 4 known versions, the most recent one is 2, 3, 98, 80. During installation, a run registry key for all users is added that will cause the program to run each time any user logs on to Windows. It is installed as an Internet Explorer extension as a Browser Helper Object, often without any obvious user interface, and will start when IE loads. The average file size is about 806.39 KB. It is an authenticode code-signed executable issued to Mindspark Interactive Network by the certification authority VeriSign. The library is loaded into Internet Explorer as a BHO (browser helper object).
What is mwsbar.dll?
My Web Search by the Mindspark Interactive Network is a browser toolbar, part of the Fun Web Products suite of potentially unwanted applications such as Smiley Central, Cursor Mania, Popular Screensavers and others. The toolbar provides access to search engine results and a 404 Error Redirector among other things to your browser. The My Web Search toolbar could slow down your PC and uses cookies to track your web surfing usage and habits.
About mwsbar.dll (from Mindspark Interactive Network)
“MyWebSearch brings together the most comprehensive collection of search tools available to provide you with the information you need when you need it.”
 Details
|
| File name: | mwsbar.dll |
| Publisher: | MyWebSearch.com |
| Product name: | My Web Search Bar for Internet Explorer, FireFox, email clients, and messenger clients |
| Description: | My Web Search |
| Typical file path: | C:\Program Files\mywebsearch\bar\1.bin\mwsbar.dll |
| Certificate |
| Issued to: | Mindspark Interactive Network |
| Authority (CA): | VeriSign |
| Expiration date: | Wednesday, May 6, 2015 |
Behaviors
(Note, the behaviors below are for all versions of mwsbar.dll, select a unique version for details.)
Internet Explorer Browser Helper Object
Located in the registry at 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects'
- BHO CLSID: {07B18EA1-A523-4961-B6BB-170DE4475CCA}
Startup files (all users) run
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
- 'My Web Search Bar' → rundll32 C:\Program Files1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
Internet Explorer toolbars
Located in the registry at 'SOFTWARE\Microsoft\Internet Explorer\Toolbar'
- CLSID: {07B18EA9-A523-4961-B6BB-170DE4475CCA}
Internet Explorer web browsers
Located in the registry at 'SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser'
- CLSID: {07B18EA9-A523-4961-B6BB-170DE4475CCA}
Startup files (all users) run once
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
- 'MyWebSearch bar Uninstall' → rundll32 C:\Program Files2\UNINST~1.DLL,O -2
Malware detections
Based on 40+ industry antivirus scanners, 31 of them detected the following malware.
| Antivirus engine | Engine version | Detection | File version |
| AhnLab V3 Internet Security |
2013.04.03 |
PUP/Win32.MyWebSearch |
2, 3, 98, 9 |
| AhnLab V3 Internet Security |
2012.10.23 |
PUP/Win32.MyWebSearch |
2, 3, 98, 59 |
| AhnLab V3 Internet Security |
2012.11.13.04 |
PUP/Win32.MyWebSearch |
2, 3, 98, 80 |
| avast! |
6.0.1289.0 |
Win32:FunWeb-K [PUP] |
2, 3, 98, 9 |
| avast! |
6.0.1289.0 |
Win32:FunWeb-K [PUP] |
2, 3, 78, 25 |
| AVG |
2014.0.3629 |
AdInstaller.FunWeb |
2, 3, 98, 9 |
| AVG |
2014.0.3629 |
Zango |
2, 3, 98, 59 |
| AVG |
2014.0.3629 |
AdInstaller.FunWeb |
2, 3, 78, 25 |
| AVG |
2014.0.3629 |
Zango |
2, 3, 98, 80 |
| Clam AntiVirus |
0.97.3.0 |
Adware.FunWebProducts-5 |
2, 3, 98, 9 |
| Clam AntiVirus |
0.97.3.0 |
Adware.FunWebProducts-5 |
2, 3, 98, 59 |
| Clam AntiVirus |
0.97.3.0 |
Adware.FunWebProducts-5 |
2, 3, 78, 25 |
| Clam AntiVirus |
0.97.3.0 |
Adware.FunWebProducts-5 |
2, 3, 98, 80 |
| Comodo Internet Security |
15799 |
Application.Win32.WebToolbar.MyWebSearch |
2, 3, 98, 9 |
| Emsisoft Anti-Malware |
5.1.0.11 |
Adware.Win32.MyWebSearchToolbar!A2 |
2, 3, 78, 25 |
| eSafe |
7.0.17.0 |
Win32.Trojan |
2, 3, 98, 9 |
| eSafe |
7.0.17.0 |
Win32.Toolbar.MyWebS |
2, 3, 78, 25 |
| ESET NOD32 |
7.8187 |
a variant of Win32/Toolbar.MyWebSearch.K |
2, 3, 98, 9 |
| ESET NOD32 |
7.7615 |
a variant of Win32/Toolbar.MyWebSearch.K |
2, 3, 98, 59 |
| ESET NOD32 |
7.7686 |
a variant of Win32/Toolbar.MyWebSearch.K |
2, 3, 98, 80 |
| Kingsoft |
2012.9.4.139 |
Win32.Troj.Generic.a.(kcloud) |
2, 3, 98, 59 |
| Kingsoft |
2012.9.22.155 |
Win32.Troj.Generic.a.(kcloud) |
2, 3, 98, 80 |
| NOD32 |
7127 |
a variant of Win32/Toolbar.MyWebSearch.K |
2, 3, 78, 25 |
| Norman |
6.08.06 |
W32/MyWebSearch.ALX |
2, 3, 78, 25 |
| SUPERAntiSpyware |
5.6.0.1008 |
PUP.MyWebSearch |
2, 3, 98, 9 |
| SUPERAntiSpyware |
5.6.0.1008 |
PUP.MyWebSearch |
2, 3, 98, 59 |
| SUPERAntiSpyware |
5.6.0.1008 |
PUP.MyWebSearch |
2, 3, 98, 80 |
| VIPRE Antivirus |
16524 |
MyWebSearch.J (v) (not malicious) |
2, 3, 98, 9 |
| VIPRE Antivirus |
13652 |
MyWebSearch.J (v) (not malicious) |
2, 3, 98, 59 |
| VIPRE Antivirus |
11901 |
MyWebSearch.J (v) (not malicious) |
2, 3, 78, 25 |
| VIPRE Antivirus |
13956 |
MyWebSearch.J (v) (not malicious) |
2, 3, 98, 80 |
All file variations of mwsbar.dll
Distribution by Windows OS
| OS version | distribution |
| Microsoft Windows XP |
43.48% |
|
| Windows 7 Ultimate N |
34.78% |
|
| Windows 7 Ultimate |
13.04% |
|
| Windows 7 Home Premium |
8.70% |
|
Distribution by country
United States installs about 46.15% of My Web Search Bar for Internet Explorer, FireFox, email clients, and messenger clients.
