mwsBar.dll

My Web Search Bar for Internet Explorer, FireFox, Netscape, email clients, and messenger clients

Fun Web Products

The module mwsBar.dll, “My Web Search Bar” by Fun Web Products has been detected as adware by 19 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘mwsBar BHO’.
Publisher:
MyWebSearch.com  (signed by Fun Web Products)

Product:
My Web Search Bar for Internet Explorer, FireFox, Netscape, email clients, and messenger clients

Description:
My Web Search Bar

Version:
2, 3, 50, 59

MD5:
e25aedc0631dc96c4ea7d1fe38000f05

SHA-1:
c1735f23c3d0ad25ce0ab5ac4779a68327badc64

SHA-256:
e8dca36f0ef3d674f01569b8c4af3d1fe5a786917f88871fe73e173b9b7a41e2

Scanner detections:
19 / 68

Status:
Adware

Explanation:
Part of the MyWebSearch/Mindspark/Ask web browser extension and toolbar.

Analysis date:
4/19/2024 11:40:14 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.MyWebSearch
2014.06.26

avast!
Win32:PUP-gen [PUP]
2014.9-160210

AVG
MyWebSearch
2017.0.2838

Clam AntiVirus
Adware.FunWebProducts-5
0.98/21411

Dr.Web
Adware.MWS.origin
9.0.1.041

ESET NOD32
Win32/Toolbar.MyWebSearch
10.10002

Fortinet FortiGate
Riskware/MyWebSearch
2/10/2016

F-Prot
W32/Mywebsearch.B.gen
v6.4.5.1.85

K7 AntiVirus
Unwanted-Program
13.66.2813

McAfee
MWS
5600.6494

Prevx
Low Risk Adware
3.0

Reason Heuristics
PUP.MyWebSearch.Mindspark (M)
16.2.10.10

SUPERAntiSpyware
9332

Total Defense
Win32/MyWebSearch.H
37.0.11021

Trend Micro House Call
TROJ_SPNR.0BLH12
7.2.41

Trend Micro
TROJ_SPNR.0BLH12
10.465.10

Vba32 AntiVirus
Trojan.BHORA.02092
3.12.26.3

VIPRE Antivirus
30670

ViRobot
2010.8.31.4017

File size:
441.4 KB (452,016 bytes)

Product version:
2, 3, 50, 59

Copyright:
Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009

Original file name:
mwsBar.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\mywebsearch\bar\1.bin\mwsbar.dll

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
12/17/2008 4:00:00 PM

Valid to:
1/20/2010 3:59:59 PM

Subject:
CN=Fun Web Products, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Fun Web Products, L=White Plains, S=New York, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7469E97907F383E4FF81AE9B045C64AA

Registration
CLSIDs:
{07B18EA1-A523-4961-B6BB-170DE4475CCA}, {07B18EA9-A523-4961-B6BB-170DE4475CCA}, {07B18EAB-A523-4961-B6BB-170DE4475CCA}, {53CED2D0-5E9A-4761-9005-648404E6F7E5}

ProgIDs:
MyWebSearchToolBar.SettingsPlugin.1, MyWebSearchToolBar.ToolbarPlugin.1

COM registered:
Yes

File PE Metadata
Compilation timestamp:
10/7/2009 8:14:05 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:Fk7Ih8MhYzCH5qe1Hzj6NaZPQ353vMZnTwoHX:m7IJhY2Zq6TeePQ3mZk+

Entry address:
0x1E189

Entry point:
FF, 74, 24, 0C, FF, 74, 24, 0C, FF, 74, 24, 0C, E8, AA, E2, FE, FF, C2, 0C, 00, FF, 15, C0, 31, 04, 10, 33, C0, C3, A1, 50, DA, 04, 10, 56, 85, C0, 75, 13, FF, 74, 24, 08, 50, FF, 35, F0, D9, 04, 10, FF, 15, 50, 31, 04, 10, 5E, C3, 8B, 0D, 54, DA, 04, 10, 8B, 15, 4C, DA, 04, 10, FF, 05, 54, DA, 04, 10, 23, D1, 8B, 34, 90, 8B, 44, 24, 08, 83, C0, 08, 50, 6A, 00, 56, FF, 15, 50, 31, 04, 10, 85, C0, 74, 07, 89, 30, 83, C0, 08, 5E, C3, 33, C0, 5E, C3, 8B, 44, 24, 04, 0F, AF, 44, 24, 08, 50, E8, 9D, FF, FF, FF...
 
[+]

Entropy:
6.2443

Code size:
264 KB (270,336 bytes)

Internet Explorer BHO
Display name:
mwsBar BHO

CLSID:
{07B18EA1-A523-4961-B6BB-170DE4475CCA}


Remove mwsBar.dll - Powered by Reason Core Security