Currently, anti-virus software makers report that PrettyPark's impact is limited to Windows users and the Microsoft Outlook mail program address book. Still at issue is how widespread the e-mail and self-replicating capabilities of the virus are, and if there are any other vulnerable e-mail programs besides Outlook.
Pedro Bustamante of Panda Software, who describes PrettyPark as a worm with Trojan capabilities, is reporting an increase in customer reports since Monday. "We're really not sure how this thing is spreading, but we've had 50 more reports over just a few days, which indicates to us that it's definitely out there and replicating," Bustamante said.
Trend Micro, which describes the virus as a Trojan worm, is reporting a slight increase as well, but says that the reports are limited to European clients.
Jump in IRC numbers
According to Steve Trilling of Symantec, consumers are being hit harder by the virus because they are less likely to update their anti-virus software than large companies or businesses, and may not even know that they're infected.
Symantec is monitoring the Internet relay chat (IRC) room that PrettyPark victims are unknowingly sent to by the virus maker for the likely purpose of retrieving system passwords and form data. The company reports that as of Wednesday night there are at least 2,500 individuals on the channel, up from 600 on Monday.
"The victims have no idea that they are being sent there, but it happens every time (they) get on the Internet," Trilling said.
Trilling said that PrettyPark is definitely a threat, but Symantec doesn't have any evidence that data is being retrieved from victims via the IRC room. "This virus is real and spreading, but it's nothing in scale-comparison to Melissa," which struck thousands of PC users in March, he said.
French origins
PrettyPark was first distributed in a spam sent from a French Internet service provider during the last week of May.
The virus is sent as an attachment labeled "PrettyPark.exe" or" Prettyorg.exe".
Once executed, the program will run the Windows pipes screen saver while it infects your system, which takes less than 30 seconds.
Some versions of the virus feature a file icon depicting "Kyle," a character from Comedy Central's satirical TV cartoon series, "South Park." Once PrettyPark is unleashed, the virus e-mails clones of itself to addresses in the victim's Outlook address book, then runs a routine that connects its victim to the custom IRC channel every 30 seconds while they're on the Internet.
Users can protect themselves against PrettyPark by updating their anti-virus software and not opening e-mail attachments.
Microsoft Corp. (Nasdaq:MSFT) and Comedy Central declined to comment for this article.
