Ganda Virus

Virus name:   Ganda.

Status:   Real.

Origins:   A new e-mail worm surfaced in March 2003 that purports to show screensavers of U.S. spy satellite pictures of Iraq or animations that are either patriotic or that mock President Bush, a computer security company warned Thursday.

The worm, dubbed Ganda-A, spreads by sending itself to e-mail addresses on an infected machine and tries to disable anti-virus and other security software and infect certain files on the hard disk.

Ganda, which does not appear to be spreading and is rated low risk, sends e-mail in English or Swedish. It is signed by "Uncle Roger in Hornsand, Sweden," who complains in a message about being discriminated against in the Swedish school system.

Subject lines include:

• Screensaver advice.


• Spy pics.


• GO USA !!!!


• G.W Bush animation.


• Is USA a UFO?


• Is USA always number one?


• LINUX.


• Nazi propaganda?


• Catlover.


• Disgusting propaganda.

Ganda also sends a message in Swedish to e-mail addresses apparently belonging to Swedish journalists.

Additional Information:

	W32.Ganda.A@mm   (Symantec)
	W32/Ganda@MM   (McAfee)