W32/Pretty.worm.unp:

Infection:
The virus is transfered via E-mail. As soon as the attachment is opened the payload is started. The attachment contains an .EXE-file, which is represented by Kyle  from SouthPark. The Email looks like:

Subject:	C:\CoolProgs\Pretty Park.exe
Text:	Test Pretty Park.exe :)
Attachment:	(sometimes "Pretty~1.exe", too)

Payload:
The virus tries to send E-mails to all adresses in the Outlook adressbook every 30 minutes.
A second routine tries to connect to the IRC-server. If it gets a connection, it tries to hold it by sending data, to gat all commands from the IRC-channel. As long as this is possible, the virus author could use the virus as a trojan. He can get information from you, such as computer name,registered users, passwords etc.

Deleting the virus:

1. Use a virusscan and note all infected virusfiles. Do not remove the virus! If you did, follow steps 10-12.
2. Start Regedit (Start => Run => 'Regedit' or 'Regedt32' under NT)
3. Remove the references of the virus from the following registry keys:
   HKEY_CLASSES_ROOT\exefile\shell\open\command\
   HKEY_LOCAL_MACHINE\exefile\CLASSES\exefile\shell\open\command\
   HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command (if exists)
   
   All this keys should only contain the value "%1%*".
4. If possible, remove all keys, that start the virus, under:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
   and
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
5. Remove the registry key (if it exists)
   HKEY_CLASSES_ROOT\.dl
   and close the registry-editor.
6. Edit the WIN.INI under Windows und delete all references to the virus under the run-line in [windows].
7. Edit the SYSTEM.INI und remove the virus from the shell-line under [boot].
8. Restart your PC.
9. Remove all virusprograms (find under 1). If a removal is impossible, retry 1-8.
10. If you have deleted the virus before correcting the registry, you should repair this immediately. Start your PC in MS-DOS mode and create a file UNDO.REG. Edit this file by entering the following commands:
    REGEDIT4
    [HKEY_CLASSES_ROOT\exefile\shell\open\command]
    @="\"%1\" %*"
    [HKEY_LOCAL_MACHINE\exefile\CLASSES\exefile\shell\open\command]
    @="\"%1\" %*"
11. Save the file in the windows directory as UNDO.REG.
12. Start Windows and start (Start => Run) the UNDO.REG-file. The registryfiles should be imported.

Remarks:
The virus is the unpacked version of the virus W32/PrettyPark.worm.

more reports:
http://vil.nai.com/vil/wm98500.asp