How To Remove Pretty Park Worm
A pretty worm at the park 
This worm is not pretty as it’s sounded. This is a email worm like Happy99.exe. Pretty Park Worm is also known as prettypark.exe, files32.exe, or prettyorg.exe. The Windows system can get easily affected to this worm. Once pretty park is up and running it will try to automatically email itself every 30 minutes after it is loaded to every email addresses in your address book.
This not so pretty worm will also try to connect to an IRC server and will join a specific channel. To make itself connected and also to retrieve any IRC commands, it tries to sends information every 30 seconds. This is very dangerous because the author can get a hand and access to any information that includes computer name, product name, product identifier, product key, registered owner, registered organization, system root path, version, version number, ICQ identification numbers, ICQ nicknames, victim’s email address, and username and passwords. In addition, being connected to IRC opens a security hole in which the client can potentially be used to receive and execute files.
When Pretty Park is executed it creates a file called files32.vxd in the C:\Windows\System directory and modifies the following registry key located at
HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command
from “%1″ %*
to
files32.vxd “%1″ %*
A new variant of the Pretty Park Worm also creates a similar change to the following registry key.
HKEY_CLASSES_ROOT\exefile\shell\open\command
Below is the steps on how you can manually remove this worm. The procedure below requires registry modification, I highly suggest that you make a backup of your registry before your proceed.
1. Click Start –> Run.
2. Type REGEDIT, then click OK.
3. Modify the following Registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
and change
files32.vxd “%1″ %*
to
“%1″ %*
4. Repeat the above step for the following Registry Key
HKEY_CLASSES_ROOT\exefile\shell\open\command
5. Find and Delete the PrettyPark.exe file.
6. Restart your computer.
7. Find and delete Files32.vxd located c:\Windows\System\Files32.vxd.
Want a more easier way to remove this worm? Download the pretty park remover below
Related posts:
- How to remove SCVHOST.exe (W32/YahLover.Worm.gen or Win32/Autorun.R.worm)
- How to remove W32:Navidad (Navidad.Exe)
- How to Remove Worm MyMP3.vbs
- How to Remove MSBLAST.exe worm virus
- How to remove FUN.XLS
- How to Remove Happy99.exe (ska)
- How to fix “Registry editing has been disabled by your administrator”
- How to Remove JAY.EXE and MVEO.EXE Virus
- How to Remove Virus from USB Device
- How to remove TAGA LIPA ARE! Virus
10 Comments
I hate worms…. Especially when we are talking about the virtual kind. Pretty park certainly sounds like a pretty (horrible headache).
-Randy
It tries to sends information every 30 seconds. This is very dangerous because the author can get a hand and access to any information that includes computer name, product name, product identifier, product key, registered owner,
Worm is very horrible things… I’m very suck if my computer have infected by either virus or worm…
When a worm affects our system we can remove them by certain programs.We can follow these set of programs and remove the park worms.
Thanks for the guide, worms are a pain to clear out of windows xp.
Buy PSP Go´s last blog ..Free Rock Band Unplugged Demo With PSP Go
I bet this can be removed with a Spyware application like Spybot Search and Destroy. Be careful if you go ahead and modify the registry as you can seriously mess up your computer if you delete the wrong entries.
Lumineers´s last blog ..Lumineers
I’ve had this affect me previously and I had trouble getting rid of it. I appreciate having the correct procedure for eradicating it.
Making A Will´s last undefined ..If you register your site for free at
Wonderful article,thanks for putting this together! “This is obviously one great post. Thanks for the valuable information and insights you have so provided here. Keep it up!”
s likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of prettypark.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.
This is a definately a dangerous virus. To keep yourself alert of ever getting infected of a virus that emails it self out, and to keep your contacts safe, make a new contact in Outlook (or your email client) and name it “! 0000″ without the quotes. Then don’t give it an email address. You will be given an error when the virus tries to email itself as this new contact will always be the first one in your list.