W32/Ganda.A is a mass mailing worm. This worm will infect Windows systems. It spreads using the email addresses present in the Windows addresses book.

The worm infected email has the following characteristics:

The language of the mail subject will be either in english or sweedish.

The worm arrives with any one of the following subject (English);

Catlover.
Disgusting propaganda.
G.W Bush animation.
GO USA !!!!
Is USA a UFO?
Is USA always number one?
LINUX.
Nazi propaganda?
Screensaver advice
Spy pics

The worm arrives with any one of the following subject (Sweedish);

Avskyvä rd_reklam.
Go ack ack ack....
Hakkors.
Katt, hund, kanin.
Korkad president.
Olaglig_skärmsläckare?
Rashets eller inte?
Suspekta semaforer.
Är_USA_ett_UFO?
Överviktiga_förnedras.

The content of the mail will be from any one these;

Are you a windows user who is curious about the linux environment? This screensaver gives you a preview of the KDE and GNOME desktops. What's more, LINUX is a free system, meaning anyone can download it.

-------------------------------------------------------------------------------------------------------------------------------------------------

Do you think this screensaver could be considered illegal? Would appreciate if you or any one of your friends could check it out and answer as soon as humanly possible. Thanx !

-------------------------------------------------------------------------------------------------------------------------------------------------

Have a look at this screensaver, and then tell me that George.W Bush is not an alien ;-)

-------------------------------------------------------------------------------------------------------------------------------------------------

Here's the animation that the FBI wants to stop. Seems like the feds are trying to put an end to peoples right to say what they think of the US administration. Have fun!

-------------------------------------------------------------------------------------------------------------------------------------------------

Here's the screensaver i told you about. It contains pictures taken by one of the US spy satellites during one of it's missions over iraq. If you want more of these pic's you know where you can find me. Bye!

-------------------------------------------------------------------------------------------------------------------------------------------------

If you like cats you'll love this screensaver. It's four animated kittens running around on the screen. Contact me for more clipart. Have fun! ;-)

-------------------------------------------------------------------------------------------------------------------------------------------------

This screensaver has been banned in Germany. It contains a number of animated symbols that can be related to the nazi culture. What do you think, is it a legitimate ban or not? Please answer asap. Thanx!

-------------------------------------------------------------------------------------------------------------------------------------------------

This screensaver animates the star spangled banner. Please support the US administration in their fight against terror. Thanx a lot!

-------------------------------------------------------------------------------------------------------------------------------------------------

Some misguided people actually believe that an american life has a greater value than those of other nationalities. Just have a look at this pathetic screensaver and then you'll know what i'm talking about. All the best.

--------------------------------------------------------------------------------------------------------------------------------------------------

The name of the infected attachment will be random with .SCR as extension. Upon execution of the infected attachment, it copies itself as SCANDISK.exe, tmpworm.exe to the Windows folder. It also copies a file to the Windows folder with randomly picked eight characters name, which carries .exe extension. It tries to overwrite files with .exe extension.

After this, it creates modifies the Windows registry at the following location to load itself each time Windows is restarted.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\

Later on, using its own SMTP engine, it attempts to mail itself to all the email addresses found in the Windows addresses book. It also tries to terminate security related softwares.

This worm first appeared on 17th March 2003.

Other names of W32/Ganda.A worm:

This worm is also known as W32.Ganda.A@mm, Ganda, W32/Ganda@MM