Worm:Win32/Alcan.I

When Worm:Win32/Alcan.I first runs, it takes the following actions:

Note: The default location of the Windows system folder is C:\Windows\System32 (Windows XP, Vista); C:\Winnt\System32 (Windows NT/2000), C:\Windows\System (Windows 95/98/ME)

 

On a scheduled basis, Worm:Win32/Alcan.I restarts any of the following supported peer-to-peer file sharing applications:

Limewire
Morpheus
Morpheus Ultra
BearShare
Shareaza

Worm:Win32/Alcan.I copies itself to the file share paths for the supported peer-to-peer file sharing applications by first creating a hidden folder named "_" in the applicable share. The worm then checks several hard-coded Web site URLs to obtain a file name to use for copies of itself it creates in these shares. If a file name cannot be obtained from these Web sites, Worm:Win32/Alcan.I uses the default name 'xzxzxzxzxzxz.exe'.

 

To avoid detection, on a scheduled basis, Worm:Win32/Alcan.I re-hides the folders it has created in the various shares