Re: Virus Alert

From: Maurice A. O'Sullivan (mauros@iol.ie)
Date: Mon Oct 25 1999 - 13:03:57 EDT


<x-flowed>At 22:00 24/10/99 -0400, Ronald & Kimberly Wong <dogtoy@atlantic.net> wrote:

>it is called Troj_pretty_park.

This has been around for some months.
Here, from the Symantec Anti-Virus Research Centre, is the full
information on it, plus how to get rid of the changes it makes on your system.
***********************************
PrettyPark.Worm

Aliases: Trojan Horse, W32.PrettyPark, Trojan.PSW.CHV, CHV Infection
Length: 37,376 Area of Infection: C:\Windows\System, Registry, Email
Attachments Likelihood: Common Detected as of: June 1, 1999
Characteristics: Worm, PrettyPark.EXE, Files32.VXD

Description

This is a worm program that behaves similar to Happy99 Worm. This worm
program was originally spread by email spamming from a French email
address.

The attached program file is named "PrettyPark.EXE". The original report of
this worm was submitted through our exclusive Scan&Deliver system on May
28, 1999 from France.

When the attached program called "PrettyPark.EXE" is executed, it may
display the 3D pipe screen saver. It will also create a file called
FILES32.VXD in the WINDOWS\SYSTEM directory and modify the following
registry entry value from "%1" %* to FILES32.VXD "%1" %* without your
knowledge:

HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command

Once the worm program is executed, it will try to email itself
automatically every 30 minutes (or 30 minutes after it is loaded) to email
addresses registered in your Internet address book.

It will also try to connect to an IRC server and join a specific IRC
channel. The worm will send information to IRC every 30 seconds to keep
itself connected, and to retrieve any commands from the IRC channel.

Via IRC, the author or distributor of the worm can obtain system
information including the computer name, product name, product identifier,
product key, registered owner, registered organization, system root path,
version, version number, ICQ identification numbers, ICQ nicknames, victims
email address, and Dial Up Networking username and passwords. In addition,
being connected to IRC opens a security hole in which the client can
potentially be used to receive and execute files.

Norton AntiVirus will detect PrettyPark.Worm as "Trojan Horse" with June 1,
1999 virus definitions. With the June 9, 1999 definitions or later, the
worm will be detected as "PrettyPark.Worm."

Repair Information

Removing this worm manually:

1.Using REGEDIT, modify the Registry entry

HKEY_LOCAL_MACHINE\Software\Classes\exefile\ shell\open\command

from

FILES32.VXD "%1" %* to "%1" %*

(You may launch REGEDIT through Windows Start-menu-RUN. Then search for
"FILES32.VXD" in REGEDIT.)

2.Delete WINDOWS\SYSTEM\FILES32.VXD 3.Delete the "Pretty Park.EXE" file.
4.Reboot your computer.

You need to do step #2 above; otherwise, executable files may not run
properly if you simply delete FILES32.VXD
**************************************************

Here is some good advice ( from today's " The Times" ) on dealing with any
virus that depends on an attachment.

>>The simple rule is no matter who
  has sent an attachment, save it
  and scan it with antivirus software.
  If you don't have an anti-virus
  program, download a trial version
  of the Norton program
  www.symantec.com/region/uk/-
  click on "Trial Products" and follow
  instructions. The latest version of
  Norton Anti-Virus can scan e-mails
  and attachments as they arrive.

  Make sure that the program is
  updated regularly.
<<<

I trust this will re-assure those who have been infected, and help others
to avoid this.

Regards
Maurice

Maurice A. O'Sullivan [ Bray, Ireland ]
mauros@iol.ie

[ subscribed to MSN Messenger
o_sullivanmauric@hotmail.com ]

---
B-Greek home page: http://sunsite.unc.edu/bgreek
You are currently subscribed to b-greek as: [cwconrad@artsci.wustl.edu]
To unsubscribe, forward this message to leave-b-greek-329W@franklin.oit.unc.edu
To subscribe, send a message to subscribe-b-greek@franklin.oit.unc.edu

</x-flowed>



This archive was generated by hypermail 2.1.4 : Sat Apr 20 2002 - 15:40:43 EDT