VIRUS-DISCUSSION-L Archives

Archiver > VIRUS-DISCUSSION > 2000-03 > 0953321534


From: "Marilyn" <>
Subject: [VIRUS] Pretty Park
Date: Fri, 17 Mar 2000 14:32:14 -0500


To remove the PrettyPark worm:

On the Windows taskbar, click Start > Run.
Type REGEDIT, then click OK.
Modify the following Registry value:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\ shell\open\command

and change

files32.vxd "%1" %*

to

"%1" %*

For clarity, these seven characters are the following: double quote, percent
sign, the numeral one, double quote, space, percent sign, and asterisk.
Don't forget the space.


Delete the PrettyPark.exe file.
Restart your computer.
Delete the \Windows\System\Files32.vxd file.
Safe Computing

Because of Worms and Trojan Horse programs, you must practice safe
computing. Be suspicious of executable file attachments (for example, .exe,
.shs, or MS Word, or MS Excel files), especially ones from newsgroups or
unknown sources. For continuous protection, always run Norton AntiVirus
Auto-Protect and use LiveUpdate to make sure you have the latest virus
definitions.




Norton AntiVirus users can protect themselves from this virus by downloading
the current virus definitions either through LiveUpdate or from the Download
Virus Definition Updates page.

Write-up by: Raul K. Elnitiarta & Eric Chien
June 1, 1999
Updated: February 28, 2000

Tell a Friend about this Write-Up




This thread: