The Pretty Park Worm

What is the Pretty Park worm?

The Pretty Park worm was first reported in May 1999. It affects 32-bit Windows operating systems, such as Win95, Win98, and Windows NT. It is spread through e-mail and its behavior is similar to the Happy99 worm. Typically, a person may receive an e-mail message with the following subject line:

Subject: C:\CoolProgs\Pretty Park.exe

The e-mail has an attachment, a program named PrettyPark.exe. If the recipient runs this program, the worm seeks to replicate itself by sending copies to addresses in the recipient's e-mail address book. The program also tries to connect to a specific IRC channel which the program's author may use to download certain information about the infected computer, including the dialup account and password. More information is available at Symantec's Antivirus Research Center and at Network Associates' Virus Info Center.

You can protect yourself by deleting any mail you receive with a subject line "C:\CoolProgs\Pretty Park.exe" and, most importantly, by not opening the attached program file, PrettyPark.exe.

How can I remove the Pretty Park worm?

Both Symantec's and Network Associates' Web sites give information on how to remove the worm. Symantec's Norton Antivirus and Network Associates' McAfee VirusScan can protect computers from becoming infected by the worm, but cannot remove the worm after a computer has become infected. Once your computer is infected, you must follow the steps described on the above pages to remove the worm.

If you are affiliated with Boston University, you can download and install the latest version of Network Associates' McAfee VirusScan for free, as Boston University has a site license for this product. Please visit BU's anti-virus software Web site for more information. This site will prompt you for your BU login name and password before allowing access.

I received e-mail saying that a message I sent to someone at Boston University could not be delivered because my message might contain the Pretty Park worm. What should I do?

It appears that your system may be infected. As described above, the Pretty Park worm has probably used your address book to send infected e-mail to a number of your correspondents. To avoid sending the worm on to new recipients, you must remove the worm from your computer, as described in the Web sites mentioned above.

Return to main virus information page