Pretty Park: Hoax or virus?

July 17, 2000 Sophos Press Release

Recently some customers have become confused by an email that is circulating around the internet.

The email reads:

Hi Everyone,
DO NOT OPEN "PRETTY PARK." It is a virus that will erase your whole "C" drive. It will come to you in the form of an e-mail from a familiar person. I repeat DO NOT OPEN. DELETE RIGHT AWAY. I don't know how it gets into your address book, but a "friend" sent it to me. Luckily for me I had not opened it yet. She was not as lucky and now she can't even start her computer! Forward this to everyone in your address book. I would rather receive this warning 25 times then not receive it once!

Sophos researchers advise that although there is a virus called Pretty Park (also known as W32/Pretty) it does not work as described above.

A detailed analysis of the genuine W32/Pretty virus can be read here.

It is possible that the above email did not start as a deliberate hoax, but as a well-intentioned but misguided warning to other computer users.

Sophos has described a policy which can prevent hoaxes and unwanted virus scares from spreading inside your company.