I have written a Brute Force Uninstaller script to stop the processes related to the Alcan worm. Running this script will also give you back the use of task manager and regedit. Your system32 folder will be visible again, as well.

It is very important to note that running this script will NOT completely rid your system of all remnants of this infection. You should still follow up with your HijackThis log in our Malware Forum, so that one of our Staff can guide you to a fully clean system. Running this tool will clear the worst of the damage from Alcan, but it is impossible for me to make it all inclusive to get rid of all of it. This script is only meant to get your system back to a “usable” and more stable state, while you await help to clear the rest of the infection(s).

I will try to keep the script up-to-date as much as possible when new variants appear. The updating depends on how quickly I can get new files sent to me, so please be patient if I cannot update it for a few days.

Please follow these instructions exactly as shown in order to achieve the best results:

1. Please download Brute Force Uninstaller to your desktop.

• Right click the BFU folder on your desktop, and choose Extract All
• Click "Next"
• In the box to choose where to extract the files to,
• Click "Browse"
• Click on the + sign next to "My Computer"
• Click on "Local Disk (C:) or whatever your primary drive is
• Click "Make New Folder"
• Type in BFU
• Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

2. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

3. Open My Computer and navigate to the c:\BFU folder.

• Start the Brute Force Uninstaller by doubleclicking BFU.exe
• Behind the scriptline to execute field click the folder icon and select alcanshorty.bfu
• Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.)
• Wait for the complete script execution box to pop up and press OK.
• Press exit to terminate the BFU program.

If you have any questions about the use of BFU, please read my BFU Instructions

4. Download and run HijackThis . Please choose the default location of C:\Program Files\ as the destination.

• Double click HijackThis to open it
• Click the "Do a system scan and save a logfile" button. A notepad page will automatically open with your log.
• Please go to the Malware Forum and click on the "New Topic" button on the right side of your screen.
• Make a title for your post, such as "Alcan worm", and be sure to let us know you already ran this script.
• In the large message box, please copy and paste your ENTIRE HijackThis log.
• Click the "Post new Topic" button at the bottom.

Credit to Kat for reshaping this tutorial.

This post has been edited by Metallica: Nov 27 2008, 04:44 AM

This topic has been left open to allow specific questions and comments related ONLY to this guide. It's NOT for posting HJT logs, links to your logs, or any other general malware help. Replies not following these rules will be deleted. Thanks for your cooperation.

Does this AUTOMATICALLY stop the processes involved with the worm?
I have recieved mine from downloading LimeWire.
Help! I need somebody! Help!
Not just anybody! Help!
You know I need someone! HELP!

ddrsensation,

Please follow these steps and post your log in the Malware Removal forum so you can get help:

Download and run HijackThis . Please choose the default location of C:\Program Files\ as the destination.

• Double click HijackThis to open it
• Click the "Do a system scan and save a logfile" button. A notepad page will automatically open with your log.
• Please go to the Malware Forum and click on the "New Topic" button on the right side of your screen.
• Make a title for your post, such as "Alcan worm"
• In the large message box, please copy and paste your ENTIRE HijackThis log.
• Click the "Post new Topic" button at the bottom.

We can't help you in this part of the forum

You need to post your HijackThis log in the Malware Removal forum

the link for the hiijackthis isnt working.


this makes me very sad,

The new link is here. Please choose the installer to download.