South Park' Trojan Storms E-Mail
Latest variant could clog networks, repeatedly sending itself by Outlook Express.
March 6, 2000, 10:05 a.m. PT

  The cult cartoon series South Park has taken television by storm.
 Now a Trojan horse bearing the same name is ready to take your e-mail by storm.
 The Trojan, which made its first appearance on the Internet last June, 
is on the loose once again, antivirus software vendors warned last week.
The Trojan spreads by sending itself as an e-mail attachment to all the 
addresses listed in a user's Outlook Express program. 
It attempts to do that every 30 minutes, 
and has the potential to cause storms of e-mail that can clog up a company's network,
 the vendors say.
The attachment contains an icon of the character Kyle from the animated series South Park,
 and will appear as though it has come from someone known to the recipient, vendors say.
The Trojan has been reported on Windows NT and 9x machines at dozens of large corporations,
 government organizations, universities, and Internet companies, 
primarily in the U.S. but also in Asia and Europe, says Martin Skov, 
a product marketing manager with Network Associates' McAfee software division.
Known as W32/Pretty.worm.unp, the Trojan is a variant of the W32/PrettyPark.worm
 that first surfaced last June and has been dormant for the most part ever since.
The new variant differs in that it is not compressed, which made it a little harder to detect initially, Skov says
The Trojan may also try to connect to an Internet relay chat server, 
and could potentially use the connection to get information such as the 
computer name and registered owner, as well as dial-up networking and user names stored on that computer, Skov says. Network Associates hasn't received a report of that happening yet, he adds.
While its payload isn't considered too severe, in the sense that it doesn't delete data,
antivirus vendors upgraded their rating on the Trojan from medium to high risk,
 primarily because of its ability to spread quickly and clog networks.
 Network Associates received 70 reports of it in the first four days of the week, 
compared with 150 reports in the prior two-week period. 
The firm first discovered it in mid-February.
Outlook Express users should be aware of e-mails that carry the subject line "C:/coolprogs/prettypark.exe." 
File attachments are called "Pretty park.exe" and in some cases "Pretty~1.exe."