{"id":754,"date":"2013-02-27T20:25:28","date_gmt":"2013-02-28T04:25:28","guid":{"rendered":"http:\/\/e-olio.com\/cknow\/cms\/?p=754"},"modified":"2013-05-07T22:25:45","modified_gmt":"2013-05-08T05:25:45","slug":"pretty-park","status":"publish","type":"post","link":"https:\/\/www.cknow.com\/cms\/vtutor\/pretty-park.html","title":{"rendered":"Pretty Park"},"content":{"rendered":"

This is a combination beast: a worm, a password-stealing Trojan, and a backdoor.<\/strong><\/p>\n<\/div>This is a combination beast: a worm, a password-stealing Trojan, and a backdoor. June 1999 it was active across Europe and another outbreak was noted March 2000. There are a number of variants.<\/p>\n

As a worm, the beast attaches itself to E-mail messages as the file PRETTY PARK.EXE. The associated icon shows a character from the cartoon show South Park.<\/p>\n

\"Pretty<\/p>\n

When first run, the worm looks for an active copy in memory. If not found, it registers itself as a hidden application (i.e., it won’t show up in the Windows Task List) and runs its install routine. This routine copies the worm to your Windows System directory as the file FILES32.VXD and then modifies the registry so that this file runs when any EXE file executes. (If you just delete FILES32.VXD and don’t fix the registry then EXE files won’t run any longer.)<\/p>\n

If an error occurs during install the worm tries to run the 3D Pipes screen saver (SSPIPES.SCR) and, if not found, the CANALISATION3D.SCR screen saver.<\/p>\n

Continuing, the worm next opens an Internet connection and runs two routines; one every 30 seconds and the other every 30 minutes. The first attempts to make an IRC chat connection to one of 13 servers. An attempted message is sent and via this the worm author could monitor which computers are now infected. The IRC server list includes:<\/p>\n