McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program." It is a minimal web browser that directs the user to use the yapsearch.com search portal. It appears to be primarily a front-end for the IE HTML rendering engine. Upon installation a shortcut is created in the Start Menu Startup folder to ensure the program is launched at each system boot. In testing it was not possible to navigate by entering direct URLs or search terms into the browser's address bar. All such attempts resulted in "page not found" errors. The only functional page was accessible by pressing the "home" button, which brought up the yapsearch.com portal. All results returned using the portal resulted in lists of commercial links, often directing to other shopping search portals. When selecting any link in the results lists from yapsearch.com, a new full instance of IE was launched to display the contents. Several redirections occurred when selecting any of these links, and it appears likely that a primary function of the software is gaining clickthrough commissions for referrals to the sites listed in the results.

This software is also known to be associated with or direct the user to pornographic material when trying to enter specific URLs or search terms into the address bar.

The application does display a license agreement when installed. The license is sparse and rendered in poor/incorrect English. The agreement does not clearly indicate the funtionality of the software.

Full text of EULA presented during installation (latest version as of 4/18/06):
'This program is delivering on the Freeware and "AS IS" basis, that means that you use this program at your's own risk and the author doesn't account for any damage - direct or indirect - that can be caused by the program. The Author (Enigma Global Inc.) guarantees that the program doesn't have any "bookmarks", "Grecian horses" and all the other harmful coding (if the distributive is permanent), however doesn't guarantee the ideal work of the program. you can freely distribute the program (and change the distributive). If you use changed distributive the guarantee of harmful coding absence will disappear. Distributive permanence will be guaranteed, if hash MD5 of distributive is identical to the one on the author's site. The author (Enigma Global Inc.) doesn't account for the principles, results or methods of the program work, because this program was created and is distributed now only with educational and familiarizing aims. You are obliged not to use the program for illegal purposes, not to decompile it, not to disassemble it and not to change the program code anyhow. The author doesn't account for the your failure to carry out these requirements. You are obliged not to prosecute the author in the criminal or administrative court or in some other way for something that is connected to the program. Contact Us. If you have any questions about the Yapbrowser software contact us: yapbrowser@yapsearch.com'

Privacy

A privacy policy is not displayed during installation. Several redirects were seen to occur when selecting links from results returned using the yapsearch.com portal with the browser. Any privacy risk would appear limited to the search terms sent to yapsearch.com, and clickstream data of the first links selected from any yapsearch.com results. As new full IE instances are opened to continue further navigation separate from YapBrowser, further transfer or interception of clickstream data seems unlikely.

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

Files Added

• Installer: yapbrowser.exe (253 KB)
  MD5: 46A87752982C6447DB7C8EDC52616819
• %ProgramFiles%\yapbrowser\yapbrowser.exe (204 KB)
  MD5: E90008549A6E776838E18558336AF10D
• %ProgramFiles%\yapbrowser\uninstall.ini (1 KB)
• %ProgramFiles%\yapbrowser\uninstall.exe (20 KB)
  MD5: 8FDE804D40DE5E735C717470A494EC9A
• %ProgramFiles%\yapbrowser\license.txt (1 KB)
• C:\documents and settings\all users\start menu\programs\yapbrowser\yapbrowser.lnk (1 KB)
• C:\documents and settings\all users\start menu\programs\yapbrowser\uninstall.lnk (1 KB)
• C:\documents and settings\all users\start menu\programs\startup\yapbrowser.lnk (1 KB)
• C:\documents and settings\all users\desktop\yapbrowser.lnk (1 KB)

Registry

The following registry keys are created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
  \Uninstall\YapBrowser

Network Impact

Additional overhead in bandwidth due to many redirects which occur when navigating yapsearch.com results through the browser.

Removal

Aliases

Aliases

N/A