Virus Alert

Maurice A. O'Sullivan mauros at iol.ie
Mon Oct 25 13:03:57 EDT 1999


At 22:00 24/10/99 -0400, Ronald & Kimberly Wong <dogtoy at atlantic.net> wrote:

>it is called Troj_pretty_park.


This has been around for some months.
Here, from the Symantec  Anti-Virus Research Centre, is the full 
information on it, plus how to get rid of the changes it makes on your system.
***********************************
PrettyPark.Worm

Aliases:  Trojan  Horse,  W32.PrettyPark,  Trojan.PSW.CHV,  CHV   Infection
Length:  37,376  Area  of  Infection:  C:\Windows\System,  Registry,  Email
Attachments   Likelihood:   Common   Detected   as   of:   June   1,   1999
Characteristics: Worm, PrettyPark.EXE, Files32.VXD




Description

This is a worm program that behaves similar  to  Happy99  Worm.  This  worm
program was originally  spread  by  email  spamming  from  a  French  email
address.

The attached program file is named "PrettyPark.EXE". The original report of
this worm was submitted through our exclusive Scan&Deliver  system  on  May
28, 1999 from France.

When the attached program  called  "PrettyPark.EXE"  is  executed,  it  may
display the 3D pipe screen  saver.  It  will  also  create  a  file  called
FILES32.VXD in  the  WINDOWS\SYSTEM  directory  and  modify  the  following
registry entry value from "%1" %*  to  FILES32.VXD  "%1"  %*  without  your
knowledge:

HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command

Once  the  worm  program  is  executed,  it  will  try  to   email   itself
automatically every 30 minutes (or 30 minutes after it is loaded) to  email
addresses registered in your Internet address book.

It will also try to connect to an  IRC  server  and  join  a  specific  IRC
channel. The worm will send information to IRC every  30  seconds  to  keep
itself connected, and to retrieve any commands from the IRC channel.

Via  IRC,  the  author  or  distributor  of  the  worm  can  obtain  system
information including the computer name, product name, product  identifier,
product key, registered owner, registered organization, system  root  path,
version, version number, ICQ identification numbers, ICQ nicknames, victims
email address, and Dial Up Networking username and passwords. In  addition,
being connected to IRC opens a  security  hole  in  which  the  client  can
potentially be used to receive and execute files.

Norton AntiVirus will detect PrettyPark.Worm as "Trojan Horse" with June 1,
1999 virus definitions. With the June 9, 1999  definitions  or  later,  the
worm will be detected as "PrettyPark.Worm."

Repair Information

Removing this worm manually:

1.Using REGEDIT, modify the Registry entry

HKEY_LOCAL_MACHINE\Software\Classes\exefile\ shell\open\command

from

FILES32.VXD "%1" %* to "%1" %*

(You may launch REGEDIT through Windows  Start-menu-RUN.  Then  search  for
"FILES32.VXD" in REGEDIT.)

2.Delete WINDOWS\SYSTEM\FILES32.VXD 3.Delete the  "Pretty  Park.EXE"  file.
4.Reboot your computer.

You need to do step #2 above;  otherwise,  executable  files  may  not  run
properly if you simply delete FILES32.VXD
**************************************************

Here is some good advice ( from today's " The Times" ) on dealing with any 
virus that depends on an attachment.

 >>The simple rule is no matter who
  has sent an attachment, save it
  and scan it with antivirus software.
  If you don't have an anti-virus
  program, download a trial version
  of the Norton program
  www.symantec.com/region/uk/-
  click on "Trial Products" and follow
  instructions. The latest version of
  Norton Anti-Virus can scan e-mails
  and attachments as they arrive.

  Make sure that the program is
  updated regularly.
<<<

I trust this will re-assure those who have been infected, and help others 
to avoid this.

Regards
Maurice


Maurice A. O'Sullivan  [ Bray, Ireland ]
mauros at iol.ie

[ subscribed to MSN Messenger
o_sullivanmauric at hotmail.com  ]





More information about the B-Greek mailing list