Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Additional versions

1, 0, 0, 5	91.89%
1, 0, 0, 5	5.41%
1, 0, 0, 4	2.70%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

m3outlcn.dll (My Web Search Bar by MyWebSearch.com)
M3IEOVR.DLL (My Web Search Bar by Mindspark Interactive Network)
M3DLGHK.DLL (My Web Search Bar by Mindspark Interactive Network)
M3AUXSTB.DLL (My Web Search Bar by Mindspark Interactive Network)
m3highin.exe (My Web Search Bar by Mindspark Interactive Network)
mwsoeplg.dll (My Web Search Bar, Fun Buddy Icons, and Smiley Central by MyWebSearch.com)
uninstall fun web products.dll (My Web Search Bar for Internet Explorer, FireFox, email clients, and messenger clients by Mindspark Interactive Network)
F3REGHK.DLL (My Web Search Bar for Internet Explorer and FireFox by Mindspark Interactive Network)
F3HKSTUB.DLL (My Web Search Bar for Internet Explorer and FireFox by Mindspark Interactive Network)
MWSOESTB.DLL (My Web Search Bar for Internet Explorer, email clients, and messenger clients by Mindspark Interactive Network)
mwsbar.dll (My Web Search Bar for Internet Explorer, FireFox, email clients, and messenger clients by Mindspark Interactive Network)
m3srchmn.exe (My Web Search Bar for Internet Explorer and FireFox by Mindspark Interactive Network)
MWSOEMON.EXE (My Web Search Bar for Internet Explorer, email clients, and messenger clients by Mindspark Interactive Network)

PE file structure

Show functions

Import table

advapi32.dll

OpenThreadToken, RevertToSelf, RegCreateKeyExA, RegSetValueExA, RegCloseKey, OpenServiceA, ControlService, DeleteService, OpenSCManagerA, CreateServiceA, StartServiceA, QueryServiceStatus, CloseServiceHandle, RegisterEventSourceA, ReportEventA, DeregisterEventSource, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, ImpersonateNamedPipeClient, InitializeSecurityDescriptor, DuplicateTokenEx

kernel32.dll

LocalAlloc, Sleep, GetModuleFileNameA, FormatMessageA, CreateDirectoryA, CopyFileA, DeleteFileA, MoveFileA, _lclose, _lwrite, _llseek, _lcreat, _lopen, GetLocalTime, GetCurrentThread, GetCurrentThreadId, WaitForMultipleObjects, lstrcpyA, DisconnectNamedPipe, WriteFile, GetOverlappedResult, ReadFile, ConnectNamedPipe, SetLastError, ResetEvent, CreateNamedPipeA, CreateEventA, SetEvent, FreeResource, ExpandEnvironmentStringsA, LockResource, LoadResource, FindResourceA, GetVersionExA, lstrcmpiA, LocalFree, CreateProcessA, GetLastError, WaitForSingleObject, CloseHandle, EnterCriticalSection, LeaveCriticalSection, CreateThread, lstrlenA, HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, DebugBreak, DeleteCriticalSection, InitializeCriticalSection, GetModuleHandleA, GetCommandLineA, ExitProcess, GetStartupInfoA, GetProcAddress, lstrcpynA

shlwapi.dll

SHDeleteValueA, SHDeleteKeyA

user32.dll

CharNextA, wsprintfA

mwssvc.exe

My Web Search Bar by Mindspark Interactive Network (Signed)

Remove mwssvc.exe

Version:	1, 0, 0, 5
MD5:	bb74024a1d4e4808562c090980151653
SHA1:	0bf68c783cc795482ddde89ad1f750e80f78f636
SHA256:	1481ace90584c46406259c653d2bd3457a2e5f44781e907731c9a618f96c7442

Warning 13 antivirus scanners has detected malware.

What is mwssvc.exe?

My Web Search Bar is part of My Web Search by the Mindspark Interactive Network, a browser toolbar, part of the Fun Web Products suite of potentially unwanted applications such as Smiley Central, Cursor Mania, Popular Screensavers and others. The toolbar provides access to search engine results and a 404 Error Redirector among other things to your browser.

About mwssvc.exe (from Mindspark Interactive Network)

“MyWebSearch brings together the most comprehensive collection of search tools available to provide you with the information you need when you need it.”

Overview

MWSSVC.EXE is malware that runs as a service under the name My Web Search Service (MyWebSearchService) within the local user context. The file is digitally signed by Mindspark Interactive Network.

Details

File name:	MWSSVC.EXE
Publisher:	MyWebSearch.com
Product name:	My Web Search Bar
Typical file path:	C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE
File version:	1, 0, 0, 5
Product version:	2, 3, 0, 0
Size:	33.52 KB (34,320 bytes)
Certificate
Issued to:	Mindspark Interactive Network
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MyWebSearchService' (My Web Search Service)
MyWebSearchService

Malware detections

Based on 40+ industry antivirus scanners, 13 of them detected the following malware.

Antivirus engine	Engine version	Detection
Agnitum	5.5.1.3	Adware.Agent!98ycrZJuFqI
AhnLab V3 Internet Security	2013.04.05	PUP/Win32.MyWebSearch
avast!	6.0.1289.0	Win32:FunWeb-K [PUP]
AVG	2014.0.3629	AdInstaller.FunWeb
CAT Quick Heal	4.13.12.00	WebToolbar.MyWebSearch.em.n4 (Not a Virus)
Clam AntiVirus	0.97.3.0	Suspect.Adware.MWS
Comodo Internet Security	15822	Application.Win32.WebToolbar.MyWebSearch
ESET NOD32	7.8195	Win32/Toolbar.MyWebSearch
Kingsoft	2013.1.8.219	Win32.Troj.Generic.(kcloud)
Norman	7.00.22	Suspicious_Gen2.IXFHO
Rising Antivirus	24.56.01.04	Trojan.Win32.Generic.12800AD1
SUPERAntiSpyware	5.6.0.1008	PUP.MyWebSearch
VIPRE Antivirus	16574	MyWebSearch.J (v) (not malicious)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00174155%	0.028634%
Kernel CPU:	0.00156157%	0.013761%
User CPU:	0.00017998%	0.014873%
Kernel CPU time:	78,044 ms/min	100,923,805ms/min
CPU cycles:	58,729/sec	17,470,203/sec
Memory
Private memory:	904 KB	21.59 MB
Private (maximum):	1.86 MB
Private (minimum):	423 KB
Non-paged memory:	904 KB	21.59 MB
Virtual memory:	23.67 MB	140.96 MB
Virtual memory (peak):	33.86 MB	169.69 MB
Working set:	450 KB	18.61 MB
Working set (peak):	2.95 MB	37.95 MB
Page faults:	2,127/min	2,039/min
I/O
I/O read transfer:	1.54 KB/sec	1.02 MB/min
I/O read operations:	7/sec	343/min
I/O write transfer:	28 Bytes/sec	274.99 KB/min
I/O write operations:	7/sec	227/min
I/O other transfer:	7 Bytes/sec	448.09 KB/min
I/O other operations:	11/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	156	600

Process properties

Integrety level:	System
Platform:	32-bit
Command lines:	C:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe C:\progra~1\mywebs~1\bar\2.bin\mwssvc.exe C:\progra~2\mywebs~1\bar\3.bin\mwssvc.exe C:\progra~2\mywebs~1\bar\1.bin\mwssvc.exe
Owner:	User
Windows Service
Service name:	MyWebSearchService
Display name:	My Web Search Service
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads