VIRUS INFO
Naziv virusa:	I-Worm.Ganda
Alias:
Tip:	worm
Način širenja:	e-mailom
Veličina:	45 056 Kb
Destruktivan:	da
Datum aktiviranja:	otvaranjem pristiglog attachmenta
Otkriven:	17.03.2003.

OBJAŠNJENJE
Stiže kao e-mail sa sledećim karakteristikama:

Subject: Screensaver advice
Telo poruke: Do you think this screensaver could be considered illegal? Would
appreciate if you or any one of your friends could check it out and
answer as soon as
humanly possible. Thanx !
-------------------

Subject: Spy pics.
Telo poruke: Here's the screensaver i told you about. It contains pictures taken by
one of the US spy satellites during one of it's missions over iraq. If
you want more of these pic's you know where you can find me. Bye!
-------------------

Subject: GO USA !!!!
Telo poruke: This screensaver animates the star spangled banner. Please support the US administration in their fight against terror. Thanx a lot!
-------------------

Subject: G.W Bush animation.
Telo poruke: Here's the animation that the FBI wants to stop. Seems like the feds are
trying to put an end to peoples right to say what they think of the US
administration. Have fun!
-------------------

Subject: Is USA a UFO?
Telo poruke: Have a look at this screensaver, and then tell me that George.W Bush is not an alien. ;-)
-------------------

Subject: Is USA always number one?
Telo poruke: Some misguided people actually believe that an american life has a
greater value than those of other nationalities. Just have a look at
this pathetic screensaver and then you'll know what i'm talking about.
All the best.
-------------------

Subject: LINUX.
Telo poruke: Are you a windows user who is curious about the linux environment? This screensaver gives you a preview of the KDE and GNOME desktops. What's
more, LINUX is a free system, meaning anyone can download it.
-------------------

Subject: Nazi propaganda?
Telo poruke: This screensaver has been banned in Germany. It contains a number of animated symbols that can be related to the nazi culture. What do you
think, is it a legitimate ban or not? Please answer asap. Thanx!
-------------------

Subject: Catlover.
Telo poruke: If you like cats you'll love this screensaver. It's four animated
kittens running around on the screen. Contact me for more clipart. Have
fun! ;-)
-------------------

Subject: Disgusting propaganda.
Telo poruke: Hello! My 12 year old doughter received this screensaver on a CDROM that was sent to her through advertising. I find it disturbing that children
are now being targets of nazi organizations. I would appreciate to hear
from you on this matter, as soon as possible. Thank you.
-------------------

Subject: Olaglig_sk„rmsl„ckare?
Telo poruke: Hej!
Min son visade mig denna sk„rmsl„ckare som jag misst„nker kan
bryta mot lagen om hets mot folkgrupp. Eftersom du „r verksam som
jurist, s† vore jag tacksam f”r en fackmans syn p† saken. Tack
p† f”rhand.
-------------------

Subject: Rashets eller inte?
Telo poruke: Hejsan!
Min datal„rare gjorde mig uppm„rksam p† att denna
sk„rmsl„ckare m”jligen kan t„nkas vara ett verk av rasister. Nu
vet jag varken ut eller in, eftersom jag hade t„nkt anv„nda den p†
min skoldator. B”r jag att forts„tta att anv„nda den?
Svara helst
snarast.
Tack p† f”rhand.
-------------------

Subject: Hakkors.
Telo poruke: Hej!
Min klassf”rest†ndare gick i taket n„r hon fick se
sk„rmsl„ckaren som jag har anv„nt under tv† terminer. Hon
anklagade mig f”r antisemitism eftersom den ibland visar ett hakkors.
Tycker du att jag b”r acceptera detta fr†n henne? Vore tacksam f”r
ett utl†tande fr†n dig. Svara helst s† snart det g†r.
-------------------

Subject: Suspekta semaforer.
Telo poruke: Hejsan !
I skolan hittade jag en CD skiva som inneh”ll bl.a denna
sk„rmsl„ckare. En l„rare som r†kade kasta ett ”ga p† den
avf„rdade dess inneh†ll som ren rasistisk propaganda. Sj„lv tycker
jag inte att det „r n†got att
orda om. Vore tacksam f”r din uppfattning. Tack p† f”rhand.
-------------------

Subject: Avskyv„rd_reklam.?
Telo poruke: Hej!
Min minder†rige son fick denna sk„rmsl„ckare p† en CD skiva via
ett massutskick av reklam. Jag uppr”rs ”ver det s„tt p† vilket
rasistiska och nazistiska propagandister till†ts f”rmedla sin
avskyv„rda ideologi till barn. Jag ”verv„ger nu att polisanm„la detta tilltag s†
snart du, i egenskap av juridisk fackman, delgett mig din †sikt. Tack
p† f”rhand.
-------------------

Subject: ™verviktiga_f”rnedras.?
Telo poruke: Hejsan !
Jag ”verv„ger att polisanm„la denna sk„rmsl„ckare. Jag anser
att den har en nedl†tande attityd gentemot ”verviktiga personer. Jag
skulle bli ytterst tacksam om du kunde bidra med din syn p† saken.
Tack p† f”rhand.
-------------------

Subject: Go ack ack ack....
Telo poruke: Hej igen!
Den h„r sk„rmsl„ckaren verkar vara en amerikansk parodi p†
n†got som svenskarna g”r p† midsommar. Skratta inte ihj„l dig
bara. :-)
-------------------

Subject: Korkad president.
Telo poruke: Hej igen!
H„r „r sk„rmsl„ckaren som jag snackade om. George W Bush verkar
inte vara allf”r bright om man ska tro brittiska komiker. <GARV> :-)
-------------------

Subject: Katt, hund, kanin.
Telo poruke: Hej igen!
Om du gillar djur s† m†ste denna sk„rmsl„ckare vara n†'t f”r
dig. Mjau, Voff, Arf Arf.... ;-)

Attachment predstavlja fajl sa dvostrukom ekstenzijom oblika *.OC.SCR ili *.PC.SCR.

Kada se pristigli fajl startuje, crv ce kreirati 3 fajla
C:\WINDOWS \ SCANDISK.EXE
C:\WINDOWS \ QAKUESIA.EXE
C:\WINDOWS \ TMPWORM.EXE

i dodaće sledeći ključ u Registry bazu kako bi se startovao svaki sledeći put kada korisnik startuje Windows:
HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run
" ScanDisk"= " C:\WINDOWS\ \ SCANDISK.exe"

Crv će pretražiti sve fajlove sa sledećim ekstenzijama *.EML, *.HTM*, *.DBX i Windows Address Book u potrazi za e-mail adresama na koje će se poslati bez znanja korisnika.
Da bi se zaštitio da AV i firewall programa, crv će isključiti sve procese koji u nazivu imaju sledeći tekst: VIRUS, FIREWALL, F-SECURE, SYMANTEC, MCAFEE, PC-CILLIN, TREND MICRO, KASPERSKY, SOPHOS i NORTON.

REŠENJE
Preuzmite cleaner. ( )