W32/Ganda.A
Worm
Information
about the W32/Ganda.A worm:
W32/Ganda.A is a mass mailing worm. This
worm will infect Windows systems. It spreads using the email addresses
present in the Windows addresses book.
The worm infected email has the following
characteristics:
The language of the mail subject will be either in english or sweedish.
The worm arrives with any one of the following subject (English);
Catlover.
Disgusting propaganda.
G.W Bush animation.
GO USA !!!!
Is USA a UFO?
Is USA always number one?
LINUX.
Nazi propaganda?
Screensaver advice
Spy pics
The worm arrives with any one of the following
subject (Sweedish);
Avskyvä rd_reklam.
Go ack ack ack....
Hakkors.
Katt, hund, kanin.
Korkad president.
Olaglig_skärmsläckare?
Rashets eller inte?
Suspekta semaforer.
Är_USA_ett_UFO?
Överviktiga_förnedras.
The content of the mail will be from any
one these;
Are you a windows user who is curious about the linux
environment? This screensaver gives you a preview of the KDE and GNOME
desktops. What's more, LINUX is a free system, meaning anyone can download
it.
-------------------------------------------------------------------------------------------------------------------------------------------------
Do you think this screensaver
could be considered illegal? Would appreciate if you or any one of your
friends could check it out and answer as soon as humanly possible. Thanx
!
-------------------------------------------------------------------------------------------------------------------------------------------------
Have a look at this screensaver,
and then tell me that George.W Bush is not an alien ;-)
-------------------------------------------------------------------------------------------------------------------------------------------------
Here's the animation that
the FBI wants to stop. Seems like the feds are trying to put an end to
peoples right to say what they think of the US administration. Have fun!
-------------------------------------------------------------------------------------------------------------------------------------------------
Here's the screensaver
i told you about. It contains pictures taken by one of the US spy satellites
during one of it's missions over iraq. If you want more of these pic's
you know where you can find me. Bye!
-------------------------------------------------------------------------------------------------------------------------------------------------
If you like cats you'll
love this screensaver. It's four animated kittens running around on the
screen. Contact me for more clipart. Have fun! ;-)
-------------------------------------------------------------------------------------------------------------------------------------------------
This screensaver has been
banned in Germany. It contains a number of animated symbols that can be
related to the nazi culture. What do you think, is it a legitimate ban
or not? Please answer asap. Thanx!
-------------------------------------------------------------------------------------------------------------------------------------------------
This screensaver animates
the star spangled banner. Please support the US administration in their
fight against terror. Thanx a lot!
-------------------------------------------------------------------------------------------------------------------------------------------------
Some misguided people
actually believe that an american life has a greater value than those of
other nationalities. Just have a look at this pathetic screensaver and
then you'll know what i'm talking about. All the best.
--------------------------------------------------------------------------------------------------------------------------------------------------
The name of the infected attachment will be random with .SCR as extension.
Upon execution of the infected attachment, it copies itself as
SCANDISK.exe, tmpworm.exe to the Windows folder. It also copies a file to
the Windows folder with randomly picked eight characters name, which
carries .exe extension. It tries to overwrite files with .exe extension.
After this, it creates modifies the Windows registry at the following location
to load itself each time Windows is restarted.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Later on, using its own SMTP engine, it attempts to mail itself
to all the email addresses found in the Windows addresses book. It also
tries to terminate security related softwares.
This worm first appeared on 17th March 2003.
Other
names of W32/Ganda.A worm:
This worm is also known as W32.Ganda.A@mm,
Ganda, W32/Ganda@MM
Click
here to download a 30 day Evaluation Copy of Protector Plus anti virus software for your operating system
|