HelpExpress

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 HXDL AL is part of an automated helpdesk software called Aveo Attune. HXDL AL downloads and runs a file called hxiul.exe. Hxiul.exe sets up an uninstall entry in the control panel ("add/remove programs") which can be used to remove HXDL.EXE. This is unconfirmed since there are reports that it will reinstall itself upon removal, a signature indication of a trojan. Attune is billed as a "revolutionary service" that provides targeted "Intelligram messages." These messages are said to provide the user with information about products, services, or common computer problems. Attune runs quietly in the background and automatically updates it's "Intelligrams" when the user is connected to the Internet.

Vendor Notes:

 from the web site: 'HelpExpress is a revolutionary service that provides end-users with targeted, "plain English" messages to help them avoid common computer problems. HelpExpress may also let users know when they need a specific product, service, or upgrade to optimize the use of their computer. HelpExpress runs quietly in the background and automatically updates its messages when users connect to the Internet. Subsequently, when a user is about to encounter a situation that is known to cause problems, HelpExpress displays the Message that contains the solution. Alset Inc., the maker of HelpExpress, is dedicated to making computers easier to use while ensuring user privacy. Offer end-users an easier and more helpful way to purchase products and services to keep their PCs running smoothly. For example, a printer manufacturer or retailer can use Alset's HelpExpress Service to send targeted messages to their customers before they run out of ink. Users would see the message "Your printer is running out of ink. Would you like to purchase an ink cartridge now?" If they say Yes, HelpExpress then guides them, step-by-step, through purchasing the correct ink cartridge directly from the printer manufacturer's or retailer's web site.' - http://www.alsetresearch.com/alset/product.htm

'To install HelpExpress, simply double click on the HXDL.exe file. HXDL.exe will trickle down all the elements necessary to run HelpExpress in the background while you are on the Internet. HelpExpress will also automatically update itself unobtrusively while you have an established internet connection. 'In many cases, your computer vendor will have installed HelpExpress for you.' 'HelpExpress runs quietly in the background and automatically updates its messages when when a user is about to encounter a situation that is known to cause problems, HelpExpress displays the Message that contains the solution.' 'Alset's HelpExpressTM Service enables its partners to send customers messages that are helpful, timely and relevant. These messages help people prevent PC problems, upsell and upgrade products, and perform other critical computing functions to enhance the computing experience.'

Alias:

 Adware/HelpExpress [Panda], Aveo Attune, HXDL, WIN32/HXDL AL

Category:

Adware: Software that displays popup/popunder ads when the primary user interface is not visible or which do not appear to be assocaited with the product.

Spyware: Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior. Many spyware products will collect referrer info (information from your web browser which reveals what URL you linked from), your IP address (a number that is used by computers on the network to identify your computer), system information (such as time of visit, type of browser used, the operating system and platform, and CPU speed.) Spyware products sometimes wrap other commercial products, and are introduced to machines when those commercial products are installed. See also Adware.

Variants:
  • Alset Network
  • Help Express
  • HXDL
    		•

    Similar Pests:

    		 Adware · Spyware

    Origins

    Group:

    		 Alset Research Inc.

    Vendor:

    		 Alset Network - formerly Aveo Attune. May be multiple vendors. Aveo and Attune are registered trademarks of Alset Inc., Aveo is affiliated with Incova Group, Inc. and owned by the same individual that founded Cypress Research Corportion. Megaphone and PhonePho are registered trademarks of Incova Group Inc. Aveo has now been bought by Cyberfast. H/HXDL_AL and Aveno Attune has been purchased by Alset, Inc. Cyberfast has received considerable criticism regarding their business practices.

    By This Group:

    		 Alset Network ·

    Mailing Address:

    		 Alset Research Inc., 555 Bryant St #307, PALO ALTO, CA 94301

    Phone:

    		 866-217-2900

    EMail:

    		 phurley100@yahoo.com

    URL:

    		 http://www.alsetresearch.com/

    Date of Origin:

    		 Variants from July, 2003 to August, 2004

    Distribution

    Distribution:

    		 The program containing HXDL.EXE is apparently bundled with many distribution partner companies. These companies include Amazon.com, AskSam, Aveo Inc., Best Buy, Canon Software, CorelDraw, Cosmi, Dell Computer, Directv, E-Color, Earthlink, evesham, Four Dits, GetRight, Guildhall, Hewlett-Packard, IBM, iCD Publishing, ID4 Limited, ItsAllFreeSoftware, Kensington, Logitech, McAfee, Micro Warehouse, Paramagnus, Radiate, Topics Entertainment, US Robotics, WeatherBug, WebHelp, Xoom, HelpExpress, and Perfect Video and Photo Editor software.

    Prevalence:
  • Help Express: 5.0%
  • HelpExpress: 10.7%
    • More Info

    Clot Factor:
  • Help Express: 25

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • Help Express: Insufficient data to report growth
  • HelpExpress: Insufficient data to report growth
    		•

    Operation

    Advertising:

    		 Yes.

    Storage Required:
  • HelpExpress: at least 1701 KB
    		•

    Restart:
  • HKLM\software\microsoft\windows\currentversion\run\emsw.exe
  • HKLM\software\microsoft\windows\currentversion\run\helpexp.exe
  • HKLM\software\microsoft\windows\currentversion\run\hxdl.exe
  • HKLM\software\microsoft\windows\currentversion\run\hxiul.exe
  • HKCU\software\microsoft\windows\currentversion\run\emsw.exe
  • HKCU\software\microsoft\windows\currentversion\run\helpexp.exe
  • HKCU\software\microsoft\windows\currentversion\run\hxdl.exe
  • HKCU\software\microsoft\windows\currentversion\run\hxiul.exe
    Autostarting Pests
    		•

    Risks

    Privacy Issues:

    		 The ratings groups TRUST-e cited Aveo in violation of the privacy agreement, and ordered its privacy seal off its websites. http://www.truste.org/news/padvisories/users_aveo_seal.html

    Privacy Policy:

    		 www.alset.com (under construction no information)

    Risk:

    		 Grave threat to privacy and confidentiality. Runs without permission, and continues to run after its carrier (see below) has been uninstalled.

    Detection and Removal

    Caution!!!:

    		 Do not uninstall HelpExpress if you value the service that it offers.

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Uninstall "Attune" and "HelpExpress" from "Add/Remove Programs" in the Windows® Control Panel.
    1. Run MSCONFIG - > Startup - Uncheck AttuneClientEngine (this will prevent HXDL.EXE from being re-downloaded.
    2. Reboot from startup disk choosing minimum boot and delete all HXDL.EXE files and rmdir alset and all subdirectories.
    3. Reboot to Windows
    4. CAREFULLY edit the Registry to remove the appropriate keys for HXDL.EXE under HKEY_CURRENT_USER, Software: "Alset, HX, HXDL"
    5. Look for reference to Aveo Attune in C:\WINDOWS or PROGRAM FILES and delete. Note:
      • Renaming HXDL.EXE to HDXL.XEX in Windows/ME will not work. Message received will be "Program in use."
      • Renaming both HXDL modules to XEX (there are two) will result in both modules being re-created to HXDL.EXE and the program hxdl will reactivate.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove AutoRun Reference:

    Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
    If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\emsw.exe, delete it and reboot the machine immediately.
    If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\helpexp.exe, delete it and reboot the machine immediately.
    If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\hxdl.exe, delete it and reboot the machine immediately.
    If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\hxiul.exe, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\emsw.exe, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\helpexp.exe, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\hxdl.exe, delete it and reboot the machine immediately.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\hxiul.exe, delete it and reboot the machine immediately.



    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Remove Directories:

    Remove these directories (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • http://www.truste.org
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 03, 2005