Worm:Win32/Alcan.B

Worm:Win32/Alcan.B has the file icon of an installation application and displays a window that appears to be an installation wizard.  Regardless of what you choose on this wizard, Worm:Win32/Alcan.B installs itself and is running, even when the window is no longer visible.  If you press the "Next" button, it will display a fake error message, "Version has expired please download software update".  Following is an example screenshot of the setup wizard displayed by Worm:Win32/Alcan.B:

 

Worm:Win32/Alcan.B:

Creates value: winupdates
with data: "c:\program files\winupdates\winupdates.exe /auto"
in registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

Worm:Win32/Alcan.B also attempts to disable a number of system tools by creating files matching their filename but with a ".com" extension instead of a ".exe" extension.  When run from the Run window or a command prompt without explicitly specifying the extension, Windows will report the error "The NTVDM CPU has encountered an illegal instruction".  The tools affected by this are: cmd, netstat, ping, regedit, taskkill, tasklist, and tracert.  Additionally, taskmgr is opened and locked by Worm:Win32/Alcan.B so that it may not be run.  Attempts to run it will cause Windows to give the error "Another program is currently using this file".