Virus name:   Ganda.

Status:   Real.

Origins:   A new e-mail worm surfaced in March 2003 that purports to show screensavers of U.S. spy satellite pictures of Iraq or animations that are either patriotic or that mock President Bush, a computer security company warned Thursday.

The worm, dubbed Ganda-A, spreads by sending itself to e-mail addresses on an infected machine and tries to disable anti-virus and other security software and infect certain files on the hard disk.

Ganda, which does not appear to be spreading and is rated low risk, sends e-mail in English or Swedish. It is signed by "Uncle Roger in Hornsand, Sweden," who complains in a message about being discriminated against in the Swedish school system.

Subject lines include:

• Screensaver advice.
• Spy pics.
• GO USA !!!!
• G.W Bush animation.
• Is USA a UFO?
• Is USA always number one?
• LINUX.
• Nazi propaganda?
• Catlover.
• Disgusting propaganda.

Ganda also sends a message in Swedish to e-mail addresses apparently belonging to Swedish journalists.

Additional Information:

	W32.Ganda.A@mm   (Symantec)
	W32/Ganda@MM   (McAfee)

Last updated:   27 January 2008

Urban Legends Reference Pages © 1995-2013 by Barbara and David P. Mikkelson.
This material may not be reproduced without permission.
snopes and the snopes.com logo are registered service marks of snopes.com.