Yahoo Assistant
| Company type | Software |
|---|---|
| Industry | Computer software |
| Fate | Acquired by Yahoo |
| Successor | Yahoo Assistant |
| Headquarters | Beijing , China |
Area served | China |
| Products | Browser Helper Object for Internet Explorer |
| Owner | Yahoo (after acquisition) |
| Parent | Yahoo (after acquisition) |
Yahoo Assistant, previously known as 3721 Internet Assistant, is a Browser Helper Object designed for Internet Explorer, originally developed by Beijing 3721 Technology Co. Ltd and rebranded following its acquisition by Yahoo.
Both 3721 Internet Assistant and 3721 Chinese Keywords have been identified as Spyware by Microsoft AntiSpyware and categorized as malware or browser hijacker by security firms such as Panda Antivirus. Nevertheless, Yahoo China initiated legal action against Beijing Sanjiwuxian Internet Technology Co. Ltd, the creators of the 360Safe antispyware, for labeling Yahoo Assistant as malware.
Distribution
Initially launched as a client-server program, 3721 Internet Assistant transitioned to using ActiveX controls for self-installation and was frequently included as a default option within various shareware packages. It has faced criticism for exploiting a vulnerability in Microsoft Internet Explorer that allowed it to install automatically when users visited websites sponsored by 3721. The Yahoo! Assistant is bundled within 3721 Chinese Keywords and Yahoo! Mail Express, and the entire suite is sometimes marketed under the name "Yahoo Assistant" in third-party shareware distributions. The company claims that automatic installation ceased in September 2005, now requiring explicit user approval; however, CA Inc. reported that additional components might still be installed without user consent.
This software is also distributed alongside the Chinese client of the CGA Gaming platform.
Features
The developers of 3721 advertise 3721 Internet Assistant as providing functionalities such as repairing Internet Explorer settings, offering security protection, clearing internet history, and blocking advertisements. Despite these claims, it introduces multiple Windows hooks that can negatively impact system performance and persistently attempts to reinstall itself. Users have experienced recurring appearances of Internet Assistant interface elements after manual removal, along with system instability issues including Blue Screen errors attributed to this software.
Internet Explorer extension hijacking
3721 Internet Assistant exerts control over other Internet Explorer extensions by enabling or disabling them at will, with exceptions made only for advertisements and extensions installed by Yahoo.
Concealment and resistance to termination
The software runs several instances of rundll32.exe processes that monitor and restart one another if terminated through the Windows Task Manager, effectively preventing users from shutting it down. Additionally, it installs a device driver named CnsMinKP.sys alongside multiple hidden Windows services. After uninstallation, residual files remain concealed from standard view in Windows Explorer but can be accessed using alternative tools like Total Commander or command-line interfaces.
Removal of antispyware program
Yahoo Assistant has been documented removing competing antispyware software 360Safe without obtaining user permission. In 2007, a Beijing court deemed this practice to constitute unfair competition.
Uninstall
Among Chinese users, 3721 Internet Assistant and 3721 Chinese Keywords are labeled as "Hooligan" or "Zombie" applications due to their persistence. Their uninstaller redirects users to the 3721 website (displayed in Simplified Chinese), where the default option is set to retain 3721 Internet Assistant. Even after completing the web-based uninstallation process and rebooting the system, numerous files remain on the computer. In 2005, these programs were ranked first on the Beijing Association of Online Media's list of Chinese Malware.