Welcome to Spyware Removal News
How to remove Win32/Alcan (Win32/Alcan removal) |
Win32/Alcan is a worm that spreads via peer-to-peer networking applications. It may prevent system utilities from working and/or infect the computer with other malware. Win32/Alcan has the file icon of an installation application and displays a window that appears to be an installation wizard. Regardless of what you choose on this wizard, Win32/Alcan installs itself and is running, even when the window is no longer visible. If you press the "Next" button, it will display a fake error message, such as "Setup cannot continue on windows NT based systems , Click ok to end Setup". Win32/Alcan creates a hidden folder for itself under the "Program Files" folder and copies itself there. It will set a registry key to make itself run on startup out of this folder. This hidden folder will have a name like "winupdates" or "msconfigs".
It will share itself out via P2P networks using filenames it gathered from various websites.
When run, it attempts to disable a number of system tools by creating files matching their filename but with a ".com" extension instead of a ".exe" extension. When run from the Run window or a command prompt without explicitly specifying the extension, Windows will report the error "The NTVDM CPU has encountered an illegal instruction". The tools affected by this are: cmd, netstat, ping, regedit, taskkill, tasklist, and tracert. Additionally, taskmgr is opened and locked by Win32/Alcan so that it may not be run. Attempts to run it will cause Windows to give the error "Another program is currently using this file".
Some versions of Win32/Alcan will install other malicious software, such as Win32/Rbot, onto your computer. Malicious Software Encyclopedia: Win32/Alcan
20% off PC Tools Spyware Doctor
20% off PC Tools Spyware Doctor Offer Expires 06/30/08
Coupon Code: pctools20
More Spyware Removal News
- Third party software leaves users open to security risks
- FBI used spyware to catch cable cutting extortionist
- Warning over PCs still at risk from Conficker
- How to remove Spyware Protect 2009 (Spyware Protect 2009 removal)
- How to remove WinSpywareProtect (WinSpywareProtect removal)
- Updated Conficker Ropes Victims into Rogue Antivirus Scam
- Microsoft warns of monster patch day next week
- Microsoft: Scareware, PDF exploits rise
- How to remove XP Shield (XP Shield removal)
- SRI releases Conficker scanner source code
- Spam in the Neighborhood
- The Confounding Case of Conficker
- Attackers exploit critical PowerPoint vulnerability
- Microsoft: Old Worm Copies Conficker for New Twist
- Simple Conficker test for end users
- Malicious sites jump 200 percent
- Confickers Big Day Passes Quietly, but Was It Really a Bust?
- Monthly Malware Statistics: March 2009
- GhostNet shows extent of online spying
- How to remove Spyware Guard 2008 and Spyware Guard 2009 (Spyware Guard 2008 and Spyware Guard 2009 removal)