Yahoo! Assistant

Last updated

Yahoo Assistant, formerly named 3721 Internet Assistant, is a Browser Helper Object for Internet Explorer developed by Beijing 3721 Technology Co. Ltd, and was renamed to Yahoo Assistant after Beijing 3721 Technology was acquired by Yahoo.

Contents

3721 Internet Assistant, together with 3721 Chinese Keywords, are known as Spyware by Microsoft AntiSpyware, and malware or browser hijacker by some others, such as Panda Antivirus. However, Yahoo China filed a lawsuit against Beijing Sanjiwuxian Internet Technology Co. Ltd, the developer of the 360Safe antispyware for identifying Yahoo Assistant as malware in 360Safe. [1]

Distribution

3721 Internet Assistant was originally released as a normal client-server application. However, it turned to use ActiveX technology to install itself on a client system later and was also shipped with many sharewares as default install options. 3721 Internet Assistant was also blamed for its use of a flaw in Microsoft Internet Explorer to install itself automatically when a user is browsing an array of 3721 sponsored personal and commercial websites with Microsoft Internet Explorer. Yahoo! Assistant is also included in 3721 Chinese Keywords and Yahoo! Mail Express, but sometimes the whole package of Internet Assistant, Chinese Keywords and Mail Express is named "Yahoo Assistant" in some sharewares. The company says the automatic installation ended in September 2005 and now asks user's permission before installing, [2] however, CA Inc. reported that during Yahoo! Assistant installation, extra components are installed without obtaining user's consent. [3]

This software is also bundled with the Chinese client of the CGA Gaming platform Archived 2006-10-21 at the Wayback Machine .

Features

3721 claims 3721 Internet Assistant includes many useful features, such as IE setting repair, security shield, removal of internet history information and blocking ads. However, it installs various windows hooks that will slow down the system, and tries to install the hooks repeatedly. Some users also reported that Internet Assistant buttons reappeared immediately after their manual removal using Internet Explorer customization features, and Blue Screen of Death appeared when using Internet Assistant.

Internet Explorer extension hijacking

3721 Internet Assistant will enable/disable other Internet Explorer extensions, except the advertisement links and extensions installed by Yahoo products.

Concealment and resistance to user termination

3721 Internet Assistant runs under multiple rundll32.exe processes. If one of them is killed in Windows Task Manager, it will immediately be restarted by others, thereby resisting efforts by a user to terminate the application.

A driver named CnsMinKP.sys is installed with 3721 Internet Assistant, along with several hidden Windows services.

After uninstallation, several files are left on the system, but they are not visible in Windows Explorer. They can be found by using tools such as Total Commander or in the DOS box.

Removal of antispyware program

Yahoo Assistant also removes 360Safe, an antispyware program of a competitor, without notifying the user. [4] On August 15, 2007, a Beijing court ruled this behavior as unfair competition.

Uninstall

3721 Internet Assistant, together with 3721 Chinese Keywords, according to Interfax, are regarded by Chinese internet users as "Hooligan" or "Zombie" applications. The uninstall program of the pair provided by 3721 simply redirects users to the 3721 website (in Simplified Chinese thus not recognizable except by Chinese speakers), and the default option of the web page is to keep 3721 Internet Assistant after the uninstallation. After following the web uninstallation wizard and a reboot, many 3721 files will still remain on the client system. The pair were ranked #1 by Beijing Association of Online Media in its list of Chinese Malware at 2005.

Related Research Articles

<span class="mw-page-title-main">Adware</span> Software with, often unwanted, adverts

Adware, often called advertising-supported software by its developers, is software that generates revenue for its developer by automatically generating online advertisements in the user interface of the software or on a screen presented to the user during the installation process. The software may generate two types of revenue: one is for the display of the advertisement and another on a "pay-per-click" basis, if the user clicks on the advertisement. Some advertisements also act as spyware, collecting and reporting data about the user, to be sold or used for targeted advertising or user profiling. The software may implement advertisements in a variety of ways, including a static box display, a banner display, full screen, a video, pop-up ad or in some other form. All forms of advertising carry health, ethical, privacy and security risks for users.

<span class="mw-page-title-main">Spyware</span> Malware that collects and transmits user information without their knowledge

Spyware is software with malicious behaviour that aims to gather information about a person or organization and send it to another entity in a way that harms the user by violating their privacy, endangering their device's security, or other means. This behaviour may be present in malware and in legitimate software. Websites may engage in spyware behaviours like web tracking. Hardware devices may also be affected.

<span class="mw-page-title-main">Spybot – Search & Destroy</span> Spyware removal software

Spybot – Search & Destroy (S&D) is a spyware and adware removal computer program compatible with Microsoft Windows. Dating back to the first Adwares in 2000, Spybot scans the computer hard disk and/or RAM for malicious software.

<span class="mw-page-title-main">Browser Helper Object</span> Plug-in module for Internet Explorer

A Browser Helper Object (BHO) is a DLL module designed as a plugin for the Microsoft Internet Explorer web browser to provide added functionality. BHOs were introduced in October 1997 with the release of version 4 of Internet Explorer. Most BHOs are loaded once by each new instance of Internet Explorer. However, in the case of Windows Explorer, a new instance is launched for each window.

<span class="mw-page-title-main">AVG AntiVirus</span> Antivirus computer program

AVG AntiVirus is a line of antivirus software developed by AVG Technologies, a subsidiary of Avast, a part of Gen Digital. It is available for Windows, macOS and Android.

Norton AntiVirus is an anti-virus or anti-malware software product founded by Peter Norton, developed and distributed by Symantec since 1990 as part of its Norton family of computer security products. It uses signatures and heuristics to identify viruses. Other features included in it are e-mail spam filtering and phishing protection.

<span class="mw-page-title-main">SpywareBlaster</span> Microsoft Windows software

SpywareBlaster is an antispyware and antiadware program for Microsoft Windows designed to block the installation of ActiveX malware.

<span class="mw-page-title-main">CA Anti-Spyware</span> Spyware detection program

CA Anti-Spyware is a spyware detection program distributed by CA, Inc. Until 2007, it was known as PestPatrol.

<span class="mw-page-title-main">Microsoft Defender Antivirus</span> Anti-malware software

Microsoft Defender Antivirus is an antivirus software component of Microsoft Windows. It was first released as a downloadable free anti-spyware program for Windows XP and was shipped with Windows Vista and Windows 7. It has evolved into a full antivirus program, replacing Microsoft Security Essentials in Windows 8 or later versions.

Norton Internet Security, developed by Symantec Corporation, is a discontinued computer program that provides malware protection and removal during a subscription period. It uses signatures and heuristics to identify viruses. Other features include a personal firewall, email spam filtering, and phishing protection. With the release of the 2015 line in summer 2014, Symantec officially retired Norton Internet Security after 14 years as the chief Norton product. It was superseded by Norton Security, a rechristened adaptation of the Norton 360 security suite.

Browser hijacking is a form of unwanted software that modifies a web browser's settings without a user's permission, to inject unwanted advertising into the user's browser. A browser hijacker may replace the existing home page, error page, or search engine with its own. These are generally used to force hits to a particular website, increasing its advertising revenue.

<span class="mw-page-title-main">WinFixer</span> Rogue security software

WinFixer was a family of scareware rogue security programs developed by Winsoftware which claimed to repair computer system problems on Microsoft Windows computers if a user purchased the full version of the software. The software was mainly installed without the user's consent. McAfee claimed that "the primary function of the free version appears to be to alarm the user into paying for registration, at least partially based on false or erroneous detections." The program prompted the user to purchase a paid copy of the program.

Christopher Boyd, also known by his online pseudonym Paperghost, is a computer security researcher.

Criticism of Windows XP deals with issues with security, performance and the presence of product activation errors that are specific to the Microsoft operating system Windows XP.

<span class="mw-page-title-main">Rogue security software</span> Form of malicious software

Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on their computer. It is a form of scareware that manipulates users through fear, and a form of ransomware. Rogue security software has been a serious security threat in desktop computing since 2008. An early example that gained infamy was SpySheriff and its clones, such as Nava Shield.

Norton 360, developed by Gen Digital Inc., is an "all-in-one" security suite for the consumer market. Originally released in 2007, it was discontinued in 2014; its features were carried over to its successor, Norton Security.

MS Antivirus is a scareware rogue anti-virus which purports to remove virus infections found on a computer running Microsoft Windows. It attempts to scam the user into purchasing a "full version" of the software. The company and the individuals behind Bakasoftware operated under other different 'company' names, including Innovagest2000, Innovative Marketing Ukraine, Pandora Software, LocusSoftware, etc.

AV Security Suite is a piece of scareware and malware, or more specifically a piece of rogue security software, which poses as a pre-installed virus scanner on a victim's computer system. It is currently known to affect only Microsoft Windows systems, although it may simply operate under a different name on other platforms to better cloak itself within their user interfaces, as its disguise is a key component of its success. In the task manager, it appears as a string of a random characters that end with "tssd.exe" – an example is "yvyvsggtssd.exe." It also can show a random string of characters that end with "shdw.exe".

SmartScreen is a cloud-based anti-phishing and anti-malware component included in several Microsoft products, including operating systems Windows 8 and later, the applications Internet Explorer, Microsoft Edge. SmartScreen intelligence is also used in the backend of Microsoft's online services such as the web app Outlook.com and Microsoft Bing search engine.

WiperSoft is an anti-spyware program developed by Wiper Software. It is designed to help users protect their computers from such threats as adware, browser hijackers, worms, potentially unwanted programs (PUPs), trojans, and viruses. Currently available only for Microsoft Windows.

References

  1. "Business & Financial News, U.S & International Breaking News | Reuters". Archived from the original on March 20, 2007. Retrieved August 28, 2006.
  2. http://australianit.news.com.au/articles/0,7204,20420041^15841^^nbv^,00.html%5B%5D
  3. http://www3.ca.com/securityadvisor/blogs/posting.aspx?pid=93143&id=90744%5B%5D
  4. "Yahoo上网助手自杀式破坏360safe的程序代码分析" [Yahoo Internet Assistant Destroys 360safe Program Code Analysis]. cnbeta.com. October 10, 2006. Archived from the original on July 23, 2012.