The W32/Ganda-A worm, which appears to have been written in Sweden, uses a variety of different e-mail subject lines and message bodies to try and encourage computer users to run its viral attachment.
The worm, which is regarded as fairly low risk and has failed to make a great impact so far, uses a variety of different subject lines and message bodies, in both English and Swedish. The subject lines include the phrases, “Spy pics”; “GO USA!”; “G.W Bush animation”; and “Is USA always number one?”
"At a time of international crisis it is understandable that computer users will be interested in finding out the latest news from the Middle East, and many may be tempted to share breaking news with their friends and colleagues via e-mail," said Graham Cluley, senior technology consultant at Sophos.
"The author of this virus is exploiting interest in current affairs by deliberately presenting his virus in this way. The message to users is simple: be suspicious of all unsolicited e-mails."
Sophos has recommended that companies consider blocking all Windows programs at their e-mail gateway. It is rarely necessary to allow users to receive programs via e-mail from the outside world, Cluley said. There is so little to lose by blocking all mailed-in programs, regardless of whether they contain viruses or not, he added.