Fact Check

Ganda Virus

Information about the 'Ganda' worm.

Published March 23, 2003


Virus name:   Ganda.

Status:   Real.

Origins:   A new e-mail worm surfaced in March 2003 that purports to show screensavers of U.S. spy satellite pictures of Iraq or animations that are either patriotic or that mock President Bush, a computer security company warned Thursday.

The worm, dubbed Ganda-A, spreads by sending itself to e-mail addresses on an infected machine and tries to disable anti-virus and other security software and infect certain files on the hard disk.

Ganda, which does not appear to be spreading and is rated low risk, sends e-mail in English or Swedish. It is signed by "Uncle Roger in Hornsand, Sweden," who complains in a message about being discriminated against in the Swedish school system.

Subject lines include:

  • Screensaver advice.

  • Spy pics.

  • GO USA !!!!

  • G.W Bush animation.

  • Is USA a UFO?

  • Is USA always number one?

  • LINUX.

  • Nazi propaganda?

  • Catlover.

  • Disgusting propaganda.

Ganda also sends a message in Swedish to e-mail addresses apparently belonging to Swedish journalists.

Additional Information:

    W32.Ganda.A@mm W32.Ganda.A@mm   (Symantec)
    W32/Ganda@MM W32/Ganda@MM   (McAfee)

Last updated:   27 January 2008

David Mikkelson founded the site now known as snopes.com back in 1994.