Pretty Park: Hoax or virus?

Sophos Press Release

Recently some customers have become confused by an email that is circulating around the internet.

The email reads:

Hi Everyone,
DO NOT OPEN "PRETTY PARK." It is a virus that will erase your whole "C" drive. It will come to you in the form of an e-mail from a familiar person. I repeat DO NOT OPEN. DELETE RIGHT AWAY. I don't know how it gets into your address book, but a "friend" sent it to me. Luckily for me I had not opened it yet. She was not as lucky and now she can't even start her computer! Forward this to everyone in your address book. I would rather receive this warning 25 times then not receive it once!

Sophos researchers advise that although there is a virus called Pretty Park (also known as W32/Pretty) it does not work as described above.

A detailed analysis of the genuine W32/Pretty virus can be read here.

It is possible that the above email did not start as a deliberate hoax, but as a well-intentioned but misguided warning to other computer users.

Sophos has described a policy which can prevent hoaxes and unwanted virus scares from spreading inside your company.


More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs - a global network of threat intelligence centers. Sophos is headquartered in Oxford, U.K., and is publicly traded on the London Stock Exchange under the symbol “SOPH.” More information is available at www.sophos.com/company.