Win32/Helompy

Win32/Helompy has been discovered and diagnosed as a self-replicating worm that propagates by infecting different kinds of removable drives.
 
Worms, like Win32/Helompy, are renowned for their ability to spread their fear-inducing viruses from one computer to another without receiving any brand of human help whatsoever and Win32/Helompy is no exception to this rule. Without any form of human intervention, this threat is able to spread and distribute its malware-laced computer infection by copying itself to the root of removable drives.

The Win32/Helompy Payload

The primary reason for Win32/Helompy's malicious creation and existence is that Win32/Helompy actively works to log and steal various kinds of authentication details (e.g. user names and passwords) that correspond to a variety of commonly used websites, such as Gmail accounts and Facebook pages. Win32/Helompy attempts to log and steal these kinds of personal information by connecting to a remote server/host, using keylogging-type activities to capture the targeted information and then uploading the captured, stolen data and information to the remote server.
 
This is Win32/Helompy's ultimate payload because once the stolen information has been uploaded to the remote server, it is there for this security threat's malicious creators to access and do whatever they will with.
 
This privacy invasive-type of behavior means that Win32/Helompy poses a serious data security risk to any and all computer systems that this malicious Worm is able to infect successfully. Special attention should be paid to removing this malicious computer security violation from any computers that have been affected by Win32/Helompy's dangerous presence.
 
If you have spotted this malicious security threat lurking somewhere on your system, it is very important that you immediately work to remove this threat from your computer system. Procure a complex malware removal solution to annihilate Win32/Helompy from your vulnerable system before Win32/Helompy has had the chance to harm your machine permanently.

Specifics on Win32/Helompy's Data Capturing Behavior

To allow for the maximum data capturing capacity, Win32/Helompy may attempt to alter various bits of registry data, which will enable the threat to disable an infected system's 'auto-complete' Internet Explorer Settings. The following information shows this specific registry modification:
 
In the registry subkey: HKCU\Software\Microsoft\Internet Explorer\Main
Changes the value, setting it at: 'Use FormSuggest'
With data: 'no'
 
Once disabling these Internet Explorer settings, Win32/Helompy automatically begins to monitor various application windows and logging data by utilizing the malicious practice of keystroke recording. Reports show that Win32/Helompy particularly targets and monitors Windows applications that contain any of the following keywords and strings in their title:
 
- Welcome to Facebook! | Facebook
- Gmail: Email from Google
- PayPal
- Yahoo! Mail: The best web-based email!
- bank
- Sign
- Login
- Password
- Connect to Remote Host
- alas.matf.bg.ac.yu
- my.EUnet.rs
 
Lastly, after capturing data, Win32/Helompy steals the data by utilizing HTTP and employing a server-side script to forward the stolen information to a remote server.

Other Notable Details of Win32/Helompy

Upon installation, Win32/Helompy remains hidden on the compromised systems and constantly runs in the background.
 
When this malicious threat is running in the background of an infected system's administrator user account, this worm seeks to drop copies of its infection into the following system locations:
 
- d:/programs
- c:/win
- %windir%/cidd_p
- %TEMP%\_Rar\
o example: %TEMP%\000335A7_Rar
 
Additionally, in the wild, Win32/Helompy was discovered functioning and hiding as one of the two file names: configuration.exe and Isass.exe. Note that, regardless of which of these two particular file names Win32/Helompy may be executing its infection under, both are marked by the file attributes: 'read only,' 'hidden,' and 'system.'
 
This provided information applies, specifically, to Win32/Helompy infections that have gained access to a compromised system's administrator-level account successfully, thus can take advantage of the administrator privileges that this success allows them. Some of the details provided may differ if this threat can only access a user account successfully with limited privileges.

Technical Details