Sophos

Talk to our experts

Find your local press contact

Resources

Info feeds

What are info feeds?

21 March 2003

Ganda virus writer pleads for a better education

Satellite photo of IraqA possible motivation behind W32/Ganda-A, the email-aware worm that entices users by claiming to offer secret spy satellite photographs of war in Iraq, has been uncovered by anti-virus experts from Sophos.

The Swedish author of the virus, who goes by the pseudonym "Uncle Roger", has programmed his creation to not only spread, but also to forward a rambling email to a number of Swedish journalists.

The email, written in the Swedish language, claims that Sweden is controlled by the mass media and therefore he is forwarding his complaints to journalists as well as the school authorities.

In the email Uncle Roger claims he has been excluded from the educational system for eight years due to his difficulty in presenting himself verbally. As a result of this, he claims, he cannot work and support himself and, as he puts it, "create an economy". He goes on to question the Swedish democratic and welfare system.

Finally he claims that he is seeking genuine advice on how he can gain educational qualifications in order to go to university and eventually get a job. He encourages recipients of his letter to reply to him at a Hotmail email address.

"Uncle Roger seems quite an odd fellow - even by typical virus writer standards," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "It's possible if he leaves too many clues as to his identity that he might soon get a visit from the Swedish computer crime authorities, none too impressed with the way his worm has infected innocent users."

The W32/Ganda-A worm also contains the following encrypted text, which does not get displayed:

The text of the email sent by the worm to Swedish journalists reads as follows:

See also: