W32/Helpud.AB is a trojan. The trojan will infect Windows systems.

The trojan arrives as an attachment to email messages spammed by another malware or a malicious user.

Upon execution, the trojan copies itself as (Random characters).dll and (Random characters).exe in Windows \Help folder.

The trojan modifies registry at the following location to load itself during each startup;

HKEY_CLASSES_ROOT\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

The trojan also injects itself into various running process in memory.

This trojan first appeared on June 19, 2008.

 Other names of W32/Helpud.AB Trojan:

This trojan is also known as TROJ_HELPUD.AB.