The file has an icon showing a cartoon character from South Park. Recently several facilities in the DOE complex have received copies of variant D of the PrettyPark. The file contains a copy of the worm and the registry change causes that file to be run every time you run an executable program on your system. After infecting your system, it uses the addresses in your Internet address book, and tries to e-mail itself to all your addresses every 30 minutes. This worm also tries to connect to a IRC server where it can retrieve other commands to be run from a specific IRC channel.
Worm is listed by most anti-virus vendors.
This vulnerability allows embedded code to run just by viewing the e-mail message. The script is in a html scripted e-mail message itself, you don't need an attachment to transmit the infection. Patches for this vulnerability have been available for more than a year. See the following CIAC Bulletin for more information about this vulnerability and the location of patches. This e-mail message is an example of Social Engineering to trick the recipient into executing the malicious code.