3721 Internet Assistant
| Industry | Software |
|---|---|
| Headquarters | Beijing , China |
| Products | 3721 Internet Assistant (Yahoo Assistant) |
Yahoo Assistant, originally known as 3721 Internet Assistant, is a Browser Helper Object designed for Internet Explorer and created by Beijing 3721 Technology Co. Ltd. The product was rebranded following its acquisition by Yahoo.
Both 3721 Internet Assistant and 3721 Chinese Keywords have been identified as Spyware by Microsoft AntiSpyware and classified as malware or browser hijackers by security vendors such as Panda Antivirus. In response, Yahoo China initiated legal action against Beijing Sanjiwuxian Internet Technology Co. Ltd, the developer behind the 360Safe antispyware, for labeling Yahoo Assistant as malicious software.
Distribution
Initially launched as a client-server application, 3721 Internet Assistant transitioned to using ActiveX controls for its installation and was frequently included as a default option in numerous shareware packages. It exploited a vulnerability in Microsoft Internet Explorer to install automatically when users accessed websites affiliated with 3721. Yahoo! Assistant is integrated within 3721 Chinese Keywords and Yahoo! Mail Express, and occasionally the entire suite is marketed under the name "Yahoo Assistant" in shareware distributions. While the company asserts that automatic installations ceased by September 2005, requiring explicit user permission thereafter, CA Inc. reported that additional components were still installed without user consent during setup procedures.
The software is also distributed alongside the Chinese client of the CGA Gaming platform.
Features
The promotional material for 3721 advertises 3721 Internet Assistant as providing functionalities such as repairing IE settings, offering security protection, clearing internet history, and blocking advertisements. Nevertheless, it embeds multiple Windows hooks that can impair system performance and exhibit self-reinstalling behavior. Users have noted that buttons related to Internet Assistant reappear after being manually removed through Internet Explorer’s customization options, with some encountering system instability while using the tool.
Internet Explorer extension control
The 3721 Internet Assistant has the capability to activate or deactivate other Internet Explorer extensions, except for advertisement links and extensions installed by Yahoo products.
Concealment and termination resistance
The program runs several instances of rundll32.exe processes that monitor each other and automatically restart if terminated via the Windows Task Manager, complicating efforts to stop it.
It also installs a driver named CnsMinKP.sys along with multiple hidden Windows services. Following uninstallation, leftover files remain concealed from Windows Explorer but can be uncovered using specialized detection utilities.
Removal of competitor antispyware
Yahoo Assistant is known to uninstall 360Safe—an antispyware competitor—without informing users. This practice was deemed an act of unfair competition by a Beijing court in 2007.
Uninstall
In China, both 3721 Chinese Keywords and 3721 Internet Assistant are commonly referred to as "Hooligan" or "Zombie" software due to their persistence. The uninstallation process redirects users to the 3721 website (in Simplified Chinese), where the default choice preserves the software even after attempting removal. Numerous 3721 components remain present after rebooting. In 2005, these programs were ranked first on the Beijing Association of Online Media’s list of Chinese Malware.