E-mails sent by the virus look like this:
Subject: Servus Alter!
Hier ist das Spiel, das du unbedingt wolltest!;-)
Attachment: South Park.exe
Texts are German and mean: "Hi there! Here's the game you we're
The virus copies itself to a file called c:\winguard.exe and registers
itself to run on each system start with this registry key:
F-Secure does not have direct reports of South Park being in the wild.
[Analysis: Mikko Hypponen, F-Secure Corporation]