# MA-010.061999: MyCERT Advisory - W32/PrettyPark Worm

**Date:** 09 Jun 1999  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-010.061999  
**Advisory ID:** MA-010.061999

---

1.0 Description
#### 1.1 Overview
The "Pretty Park" also known as "Trojan.PSW.CHV" and "TROJ\_PSW.CHV", is a worm program that behaves the same as the [Happy99.exe](/en/services/advisories/mycert/1999/main/detail/148/index.html) virus. This malicous program also acts as a password stealing trojan and a backdoor all at the same time. The program originally spreads by email attachment named "Pretty Park.exe", and was reported to widespread in Central Europe in June 1999.
#### 1.2 Limitation
1.2.1 The worm comes in a format of the Windows PE executable and is known to infect Windows 95/98/NT files.
1.2.2 A machine can only be infected when the executable file attach to the email is executed.
### 2.0 Technical Matters
#### 2.1 Installation
When the attached program called "PrettyPark.EXE" is executed, it may display a 3D pipe screensaver. It will also copy itself to WINDOWS/SYSTEM folder as FILES32.VXD file and then modifies the Registry to be run each time any EXE file starts when Windows is active. The worm does it either by creating a new key in the HKEY\_CLASSES\_ROOT as exefile\shell\open\command or through the following registry, and modify the registry value from "%1" %\* to FILES32.VXD "%1" %\* without your knowledge:
HKEY\_LOCAL\_MACHINE\Software\Classes\exefile\shell\open\command
In fact, FILES32.VXD is not a VxD driver of Win 95/98, but just a Windows executables. The Trojan uses the VXD via the shell to run other PE executable files. If the FILES32.VXD file is deleted and the Registry is not corrected, no .EXE file will ever be started in Windows further on.
#### 2.2 Functionality
Once the worm program is executed, it will opens an Internet connection and activates two of its routines.
2.2.1 The first routine that activates once in every 30 seconds, tries to connect to one of IRC chat servers listed below and send a message to a user (possibly the author of this worm program) which allows him to monitor the infected machine.
The list of IRC servers the worm tries to connect to includes:
irc.twiny.net
irc.stealth.net
irc.grolier.net
irc.club-internet.fr
ircnet.irc.aol.com
irc.emn.fr
irc.anet.com
irc.insat.com
irc.ncal.verio.net
irc.cifnet.com
irc.skybel.net
irc.eurecom.fr
irc.easynet.co.uk
The worm may also be used as a backdoor (remote access tools) by its author to gather information on system configuration details, drives list, directories info as well as confidential information such as Internet access passwords and telephone numbers, Remote Access Service login names and passwords, ICQ numbers etc. The backdoor is also able to create/remove directories, send/receive files, delete and execute files.
2.2.2 The second routine which is activated once per 30 minutes, opens Address Book file, reads email addresses from there, and sends messages to these addresses. The Subject field contains the text:
C:\CoolProgs\Pretty Park.exe
The message has an attachment copy of the worm as Pretty Park.EXE file. If someone receives this message and runs the attached file his system will be infected.
### 3.0 Possible Steps
#### 3.1 Prevention
It is important to note that one should practise safe computing practices and avoid opening email attachments that may contain viruses, worms or other malicious programs. Scan all files received before opening or executing them in order to detect the virus before infections can occur. Also, always update the virus list in your respective antivirus software so that the software may detect the presence of a new virus.
#### 3.2 Detection and Removal
3.2.1 As of today, the followings are the sites that have detection and/or removal for this worm. However, do visit your respective anti-virus vendor sites from time to time for their updates.
**Norton Antivirus**
http://www.symantec.com/avcenter/download.html
**McAfee and Dr. Solomon**
http://www.mcafeeb2b.com/naicommon/download/dats/find.asp
**F-Secure Anti-Virus**
http://www.datafellows.com/download-purchase/updates.shtml
**Sophos Anti-Virus**
http://www.sophos.com/downloads/ide/index.html#pretty
**Trend Micro**
http://www.antivirus.com/download/pattern.htm
For other products, please refer to our web site below for the list of known antivirus sites:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
3.2.2 Removing this worm manually:
1. Goto the directory C:\WINDOWS\SYSTEM\ and delete the FILES32.VXD file.
2. Using REGEDIT (Click Start --> Run --> type "regedit"), modify the Registry entry:
HKEY\_LOCAL\_MACHINE\Software\Classes\exefile\shell\open\command
or
HKEY\_CLASSES\_ROOT under exefile\shell\open\command,
from **FILES32.VXD "%1" %\* to "%1" %\*.**
NOTE : You may launch REGEDIT through Windows Start-menu-RUN. Then search for "FILES32.VXD" in REGEDIT.
3. Delete the "Pretty Park.EXE" file.
4. Reboot your computer.
You need to do step #2 above; otherwise, executable files may not run properly if you simply delete FILES32.VXD
### 4.0 More Information
To obtain more information on this virus, please refer to the following site :
4.1 **AVERT**
http://vil.mcafee.com/dispVirus.asp?virus\_k=10175
4.2 **Symantec Antivirus Research Center**
http://www.symantec.com/avcenter/venc/data/prettypark.worm.html
4.3 **Data Fellows Computer Virus Information Pages**
http://www.f-secure.com/v-descs/prettyp.shtml
4.4 **Trend Micro**
http://www.antivirus.com/vinfo/security/sa060499.htm
4.5 **Sophos Anti-Virus**
http://www.sophos.com/virusinfo/analyses/w32pretty.html