Alert level

Worm:Win32/PrettyPark.B@mm

(?)

Encyclopedia entry
Updated: Apr 17, 2011  |  Published: Feb 02, 2010

Aliases
  • I-Worm/PrettyPark.60928 (AhnLab)
  • W32/PrettyPark.60928 (Command)
  • I-Worm/Pretty_Park (AVG)
  • I-Worm.Prettypark (BitDefender)
  • Win32.HLLW.PrettyPark (Dr.Web)
  • Win32/PrettyPark.B (ESET)
  • PrettyPark.51433 (Frisk (F-Prot))
  • Email-Worm.Win32.PrettyPark (Kaspersky)
  • W32/Pretty.gen@MM (McAfee)
  • PrettyPark.60928 (Norman)
  • Trojan.PrettyPark (other)
  • W32/Pretty (Sophos)
  • W32.PrettyPark.Gen (Symantec)
  • WORM_PRETTYPARK (Trend Micro)
  • I-Worm.PrettyPark.A1 (VirusBuster)
  • South Park trojan (other)

Alert Level (?)
Severe

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.
Detection last updated:
Definition: 1.61.1453.0
Released: Jul 11, 2009 		Detection initially created:
Definition: 1.45.287.0
Released: Oct 07, 2008

 

Summary

Worm:Win32/PrettyPark.B@mm is a worm that spreads via e-mail attachments. It allows backdoor access and control of an infected computer.

Top

 

Symptoms

System changes
The following system changes may indicate the presence of this malware:
  • The presence of the following file:
    <system folder>\files32.vxd
  • The presence of the following registry modifications:
    Modified value: "(default)"
    From data: ""%1" %*"
    To data: "files32.vxd "%1" %*"
    In subkey: HKLM\SOFTWARE\Classes\exefile\shell\open\command
  • You receive an e-mail message with the attachment "pretty park.exe" that has the following icon:

Top

 

Technical Information (Analysis)

Worm:Win32/PrettyPark.B@mm is a worm that spreads via e-mail attachments. It allows backdoor access and control of an infected computer.
Installation
Worm:Win32/PrettyPark.B@mm copies itself as the following file:
 
  • <system folder>\files32.vxd
 
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
 
It modifies the system registry so that its copy is run every time a file of type EXE is run:
 
Modifies value: "(default)"
From data: ""%1" %*"
To data: "files32.vxd "%1" %*"
In subkey: HKLM\SOFTWARE\Classes\exefile\shell\open\command
 
When run, Worm:Win32/PrettyPark.B@mm creates a hidden window named "#32770". It also runs the following files:
 
  • <system folder>\files32.vxd - the worm copy
  • sspipes.exe - 3D Pipes screensaver; available in certain versions of Windows; if this file is not available it attempts to run the following screensaver:
    • Canalisations 3D.scr
Spreads via...
E-mail
Worm:Win32/PrettyPark.B@mm sends e-mail messages to contacts in the user's Windows Address Book. Messages are sent approximately every 30 minutes after the worm runs. The e-mail it sends out has the following format:
 
To: <contact from Windows Address Book>
Subject: c:\coolprogs\pretty park.exe
Attachment: "pretty park.exe"
 
The file icon of the file "pretty park.exe" resembles the fictitious South Park character Kyle Broflovski:
 
When attached, the file name may appear in Windows 8.3 convention as "pretty~1.exe".
Payload
Allows backdoor access and control
Worm:Win32/PrettyPark.B@mm connects to one of several predefined IRC servers using random UDP and TCP ports to accept commands from a remote attacker. The commands it may perform include:
 
  • Retrieving computer logon credentials
  • Retrieving chat client logon details
  • Uploading, downloading, running, and deleting arbitrary files
Additional Information
If the worm copy "<system folder>\files32.vxd" is removed, an error may result whenever an EXE file is run, due to the registry changes done by the worm. Additional recovery steps may be necessary.
 
Analysis by Patrick Nolan

Top

 

Prevention

Take these steps to help prevent infection on your computer.


Top

 

Recovery

Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see http://www.microsoft.com/security/antivirus/av.aspx.
Additional recovery steps
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
322756 How to back up and restore the registry in Windows
 
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
 
To remove/modify the changes that Worm:Win32/PrettyPark.B@mm has made to your computer, follow these steps:
 
1) Click Start and then click Run.
2) In the Open box, type regedit and then click OK.
3) Locate and then click on the following registry key:
HKCR\exefile\shell\open\command
4) On the right panel, right-click on the following registry entry and select Modify:
(default)
5) Under Value Data, delete the following string:
files32.vxd
such that the Value Data contains the following remaining string:
""%1" %*"
6) Click OK.
7) Close Registry Editor.

Top

Provide feedback