W32/Remad is a worm. The worm will infect Windows systems and spreads through removable media.

Upon execution, the worm creates driver.exe in the Windows System folder and wuaucll.exe in the Windows folder.

It modifies the registry at the following location, to execute itself every time an exe file is executed:

HKEY_CLASSES_ROOT\exefile\shell\open\command

It also modifies the registry at the following location, to execute itself every time the Windows starts:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

The worm terminates some of the security-related services.

The worm periodically connects to mmm.021mm8.com/pop/api.asp using Internet Explorer and checks the title of the page:

If the title of the page contains "beginop", it will treat the next string as an URL and load it using Internet Explorer.
If the title of the page contains "beginpd", it may listen on TCP port 14012 and may send some sensitive information.

This worm first appeared on March 26, 2007.

 Other names of W32/Remad Worm:

This Worm is also known as W32.Remadworm.