It comes in the form of a Windows PE executable called prettyorg.exe, via email. It is a memory resident program that sends itself to all users in the address book of the infected computer.

Important:
Do not delete the dropped file FILES32.VXD from your local drive before modifying the registry, otherwise Windows will refuse to run any applications and the following steps will not be carried out.

To remove TROJ_PRETTY_PARK, please follow these steps:

1 Run the following file, CleanPPark.reg from it's location, this will correct the registry modifications made by TROJ_PRETTY_PARK

2 Restart your system in MS-DOS mode by clicking:
Start
Shut Down
Restart your system in MS-DOS mode.

3 You should be at C:\windows>
Type "cd system" and hit ENTER
Now type "del files32.vxd" and hit ENTER to delete the file.

4 Reboot the system again and rescan for the virus.

If you delete FILES32.VXD before changing the registry entries, please do this:

1 Save the file CleanPPark.REG to your floppy disk

2 Click on:
Start
Run
BrowseA: drive and find the CleanPPark.REG and then press Enter.