Worm catches worm, good?

Computer viruses can do some good, at least some of the time, it appears. A German who allegedly produced computer-based child pornography gave himself up to the police after having been convinced by the Sober e-mail worm that the authorities could prove he had visited illegal websites.

The worm tricked the 20-year-old into believing that he was being investigated by Germany's Federal Crime Office (known as the BKA) and he phoned the police to confess. Officers in the city of Paderborn, near Hanover, said that investigations later found child pornography on his computers and led to charges.

The widely-distributed Sober worm had been doing the rounds for months, telling recipients that they were being investigated by the FBI, the CIA or the BKA. It claimed that the authorities knew they had been visiting illegal sites and urged them to turn themselves in.

It was viewed as a nuisance, annoying the FBI so much that the American agency uncharacteristically released a statement in November denying that it was sending the e-mails. So it came as a surprise to the anti-virus community that it had actually succeeded in netting a criminal.

"We're used to explaining to people that there's no such thing as a good virus," said Graham Cluley, senior technology consultant at UK anti-virus company Sophos. "But in this case it appears that the Sober-Z worm has accidentally scared an internet paedophile into contacting the police.

"If he had been scanning his e-mail for viruses he would never have received the message. If jailed he'll have plenty of time to reflect on whether he should have believed everything that was sent to him via e-mail."

The latest variant of the Sober worm e-mail, which Sophos said accounted for 78 per cent of recent virus reports, typically appears as below. When recipients click on the attachment, the worm is let loose on their computer.

Dear Sir/Madam,

We have logged your IP-address on more than 30 illegal Websites.

Important: Please answer our questions! The list of questions are attached.

Yours faithfully,
Steven Allison
Federal Bureau of Investigation-FBI-
935 Pennsylvania Avenue, NW , Room 3220
Washington , DC 20535
Phone: (202) 324-30000

The Sober report came as anti-virus software companies were warning users of internet instant messaging services to beware of a Santa Claus worm, seemingly carrying a festive message from one of their known contacts, but which once downloaded, inflitrates the host computer and spreads its virus to other contacts.