Worm:Win32/Alcan.D

Worm:Win32/Alcan.A has the file icon of an installation application and displays a window that appears to be an installation wizard.  Regardless of what you choose on this wizard, Worm:Win32/Alcan.A installs itself and is running, even when the window is no longer visible.  If you press the "Next" button, it will display a fake error message, "Setup cannot continue on windows NT based systems , Click ok to end Setup".  Following is an example screenshot of the setup wizard:

 

Worm:Win32/Alcan.A:

Creates value: outlook
with data: "c:\program files\outlook\outlook.exe /auto"
in registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

Worm:Win32/Alcan.A also attempts to disable a number of system tools by creating files matching their filename but with a ".com" extension instead of a ".exe" extension.  When run from the Run window or a command prompt without explicitly specifying the extension, Windows will report the error "The NTVDM CPU has encountered an illegal instruction".  The tools affected by this are: cmd, netstat, ping, regedit, taskkill, tasklist, and tracert.  Additionally, taskmgr is opened and locked by Worm:Win32/Alcan.A so that it may not be run.  Attempts to run it will cause Windows to give the error "Another program is currently using this file".