Goals Staff

Help Desk and Frequently Asked Questions

Watch Out for PrettyPark.exe.

TROJ_PrettyPark, alias TROJ_PSW.CHV, is a worm program that can be fast spreading via the Internet. It comes in the format of a Windows PE executable called prettyorg.exe (shown left) and works under Windows 95/98/NT. It is a memory resident program of 58KB in length. On execution, the trojan copies itself to FILES32.VXD into the windows system directory, such as C:\Windows\System, and then creates a new key as exefile\shell\open\command in HKEY_CLASSES_ROOT. In fact, FILES32.VXD is not a VxD driver of Win95/98, but just a Windows executable. The trojan uses the VXD via the shell to run other PE executable files. It has been reported that the program sends email to everyone in the users address book, but this has not been confirmed by us.

If you find that you have this please get a virus protection program to eradicate this from your system.