May 17, 2005
Tuesday

When Jeremy Dibbell opened his e-mail at work Monday, he found 300 messages with German subject lines often emphasized with multiple exclamation marks.

Problem is, he doesn't speak German.

Like people across the country and around the world, Dibbell, an archives specialist at Union College in Schenectady, New York, was barraged by spam e-mails, some linking to extremist Web sites, apparently timed to coincide with the 60th anniversary of the Allied victory during World War II.

"I didn't open any of them. I decided that probably wouldn't be a good idea," Dibbell said. "It's certainly annoying having to go through and sort through which ones you have to read and then those ones in German."

The e-mails, which contained links to Web sites ranging from legitimate German publications to right-wing political propaganda, began appearing Thursday, said Vincent Gullotto, vice president of the anti-virus research team for McAfee.

The e-mails were sent from computers infected with the Sober worm, which first showed up in 2003. The main purpose of this version seems to be to spread information rather than harm, Gullotto said.

But recipients should delete the messages without opening them as a precaution, he said.

At Quest Technology in Sacramento, Calif., Matthew Sick estimated that 30 to 40 percent of the spam that Quest's software filtered out for its clients over the weekend was in German.

Quest manages e-mail and other computer services for small- and medium-size businesses.

While Sick called it a "larger outbreak," he noted that none of it appeared harmful and was generally contained by the company's spam-filtering systems.

The England-based computer-security company MessageLabs, which screens 110 million e-mails a day, has intercepted "vast amounts" of the e-mails, said Maksym Schipka, a senior anti-virus researcher.

The e-mails have about 72 varying subject lines and are something of a breakthrough for spammers because the virus was able to update itself.

The last version of Sober worm, Sober P, hit computers earlier this month, Schipka said. The virus, on computers that weren't purged of it, searched online for a new version and downloaded Sober Q, usually without the computer user even realizing it.

"This is a new thing," Schipka said. "Bad guys are trying to use the machines of users who become infected. If the machine becomes infected, it keeps updating itself so it remains competitive (with anti-virus programs)."

It also makes spammers harder to trace because the e-mails are sometimes being sent unbeknownst to the actual sender.

The e-mails highlight the need for multiple layers of security on every computer, said Dave Cole, director of product management for Symantec.

The Internet security company screens about a quarter of the world's e-mail traffic and has seen tens of thousands of these German-language spams.

"At the end of the day, it's tried and true that you have to have a variety of security measures to combat something like this," Cole said.

While frustrating to those inundated with the messages, the virus doesn't compare to the My Doom worm which struck hundreds of thousands of computers last year, Gullotto said.

"This is a little thing of a virus," he said.

But for Dibbell, cleaning out his inbox Monday was a peek into the future.

"I feel like we're in this sort of arms races. They develop a new spam blocker and the spammers figure out how to get by it," he said. "I hear the tele-marketers are going to be calling our cell phones soon too. I suppose it's one thing after another."

Sitnews
Stories In The News
Ketchikan, Alaska