PrettyPark.Worm

This worm program behaves similarly to Happy99 Worm. It was originally spread by email. When the attached program file, PrettyPark.exe, is executed, it may display the 3D pipe screen saver.

Once the worm program is executed, it tries to email itself automatically every 30 minutes (or 30 minutes after it is loaded) to email addresses registered in your Internet address book.

It also tries to connect to an IRC server and join a specific IRC channel. The worm sends information to IRC every 30 seconds to keep itself connected, and to retrieve any commands from the IRC channel.

Protection

• Initial Rapid Release version June 4, 1999
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version June 4, 1999
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date June 4, 1999

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 3 - 9
• Geographical Distribution: High
• Threat Containment: Moderate
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: High