It's called the Ganda-A worm, and it turns around public interest in the pending U.S.-Iraq war. The virus writer – said to be protesting Swedish education – uses such email subject lines as "Spy pics," "GW Bush Animation," and "GO USA!!!!" and message bodies to lure e-mail readers into opening up an executable file analysts say launches a rather mundane worm.
Swedish antivirus researchers and programmers Sophos Anti-Virus say Ganda-A has yet to travel widely, but its use of war themes as lures gives a hint about how other, more sophisticated virus writers might ensnare the unwitting approaching and during the war.
Created in Sweden, Ganda-A essentially promises war-related screensavers and other visuals, when its actual payload is a virus. And according to Sophos, the author may be exercising a grievance against Sweden's education system. The actual worm reveals this text once it's opened: "[WORM.SWEDENSUX] Coded by Uncle Roger in Hõrnsand, Sweden, 03.03. I am being discriminated by the swedish schoolsystem. This is a response to eight long years of discrimination."
"At a time of international crisis, it is understandable that computer users will be interested in finding out the latest news from the Middle East, and many may be tempted to share breaking news with their friends and colleagues via email," Sophos senior technology consultant Graham Cluley in a formal statement. "The author of this virus is exploiting interest in current affairs by deliberately presenting his virus in this way. The message to users is simple: Be suspicious of all unsolicited emails.
"We don't know what Uncle Roger's problem is with the school system in Sweden," Cluley continued. "But whatever his problem is, a worm is not an appropriate way to complain about it."
Ganda-A is not the first virus drawing on world events to trap its victims. Mawanella in 2001 both used and highlighted tension between Sri Lankan Muslims and Buddhists, according to the BBC, while Injustice – also known as VBS/Staple-A – disseminated pro-Palestinian propaganda while spamming email addresses linked to Israel's government.
