Virus name:   Ganda.

Status:   Real.

Origins:   A new e-mail worm surfaced in March 2003 that purports to show screensavers of U.S. spy satellite pictures of Iraq or animations that are either patriotic or that mock President Bush, a computer security company warned Thursday.

The worm, dubbed Ganda-A, spreads by sending itself to e-mail addresses on an infected machine and tries to disable anti-virus and other security software and infect certain files on the hard disk.

Ganda, which does not appear to be spreading and is rated low risk, sends e-mail in English or Swedish. It is signed by "Uncle Roger in Hornsand, Sweden," who complains in a message about being discriminated against in the Swedish school system.

Subject lines include:
  • Screensaver advice.
  • Spy pics.
  • GO USA !!!!
  • G.W Bush animation.
  • Is USA a UFO?
  • Is USA always number one?
  • LINUX.
  • Nazi propaganda?
  • Catlover.
  • Disgusting propaganda.
Ganda also sends a message in Swedish to e-mail addresses apparently belonging to Swedish journalists.

Additional Information:
    W32.Ganda.A@mm W32.Ganda.A@mm   (Symantec)
    W32/Ganda@MM W32/Ganda@MM   (McAfee)
Last updated:   27 January 2008