As Michael Dickopf of the Federal Bureau of IT Security (BSI) explains it, the variant of the Sober virus that has been sending out right-wing emails since last weekend is not a new virus, just a new variation. "The thing was reloaded," he says. Technically speaking, the virus itself is exactly the same as the World Cup worm that popped up last week -- it was just given new orders.

"The affected computers were instructed to go out on the Internet on May 11 and look for new orders," Dickopf says. "In this case, the new orders were to grab email addresses out of Outlook, but also from other programs and documents, and to start sending them these emails on May 15."

Not only would the addresses then get hammered with the spam emails, but they would appear to come from acquaintances of those on the receiving end. For this reason, Dickopf sees "loss of face" as the biggest potential damage -- beyond network abuse -- caused by the flood of email.

Clearly, no organization wants to be mistaken as a disseminator of right-wing propaganda. And media outlets -- including SPIEGEL -- weren't exactly thrilled to discover their articles being misused to augment neo-Nazi arguments.

User Input Required

Ultimately, there's very little that one can do, though. The only people who can make much of a difference are the owners of infected computers. Says Dickopf: "It's incredibly important that these people bring their anti-virus software up to date." And by "these people" he means just about everyone. Since the current Sober virus doesn't negatively affect infected computers, the computer's owner will likely be unaware that his or her PC has been turned into a spam making machine.

The exact scope of the spam attack still isn't clear. In the most current virus statistics, Sober versions O, P or Q play a minor role, according to Carsten Liebl of the German anti-virus firm, AntiVir. System administrators from the various large free email services -- where the new Sober.P virus emails are about as common as Sober.O emails were until recently -- have reported "few problems." This is hardly a surprise, given that the new virus is really just a "refreshed" version of the old one.

In many other companies, however, the problem is much worse. At SPIEGEL ONLINE, the publicly available e-mail addresses of the editors have been hit by up to 25,000 mails each -- and that within just 48 hours. Furthermore, hundreds of desperate victims have been writing in begging to be taken off SPIEGEL ONLINE mailing lists -- apparently misled by the fact that many of the spam emails include links to SPIEGEL ONLINE articles.

"It's a perfidious problem and a small time bomb," says Dickopf. At the same time, however, he says he is relieved that the worm with its built-in Trojan virus doesn't cause any damage to hardware or software.

But it may not remain benign. The Sober Worm has a built-in update function that can easily integrate new commands. And it's already clear when the next spam attack is coming, says Liebl from AntiVir: "In ten days it will be getting new commands," he warns. But what exactly the worm will send out is impossible to know.

Already, though, it is shocking the extent to which this worm has managed to disseminate itself. After all, the spam wave can only be sent out from computers whose owners have failed to update their anti-virus programs. According to the well-known virus expert Christoph Fischer, "the distribution of the virus shows how many users have (unknowingly) downloaded the worm but haven't yet deleted it from their computers."