Suspected Ganda Virus Author Questioned by Swedish Police

Sophos has today reported that according to commentary in the Swedish press, computer crime officers in Sweden have identified and questioned the suspected author of the Ganda worm (W32/Ganda-A). The worm, which posed as a screensaver offering spy satellite photographs of Iraq, caused concern when it began to spread last week.

Reports from publication Tidningen Angermanland indicate that Swedish police authorities searched the suspect’s house and seized computer equipment for analysis. The authorities found that the worm offered valuable clues as to the author’s likely location, believed to be in the H?µrn?¶sand area of Sweden.

According to Torbj?¶rn Ull, an IT crime specialist working for the Swedish police, the suspect (whose name has not been made public by the authorities), is believed to have admitted his involvement in spreading the virus during questioning.

“The authorities appear to have moved quickly in locating this virus author,” said Carole Theriault, anti-virus consultant at Sophos. “It is good to see computer crime authorities around the world taking the virus threat more seriously. The author of this worm was particularly sneaky in using current events to spur computer users into double-clicking on the infected attachment.”

The Ganda worm spread via email in either English or Swedish using a variety of email subject lines and message bodies. The worm appears to have been particularly successful in spreading in Sweden. Infected users in Sweden may have been lulled into a false sense of security when they received an email in their native language, rather than the English adopted by many viruses.

More details of the Ganda worm are available at
http://www.sophos.com/virusinfo/articles/ganda.html