I checked my gmail account via POP at 05/15/05 10:58 – the first time for 2 days: I only received 1 such spam mail, so google seems to adjust it's filters quite fast.

i have hundreds too – not via google though, on my standard pop (spamassin "protected" or not as it appears). ditto symantec hasn't stopped it even though i update every day.

I've gotten tons of these e-mails too. Thanks for posting about it. I found this blog on Google while searching one of the e-mail's titles in an effort to find out if I was alone in receiving them.

sI've got some of those spam mail in on my email account (not Gmail). As you wrote all of the lead to political right-winged articles. Maybe you're are right that those email are linked to the debates which always arise at the annual celebration of world war II. When I received the first spam I had something different in mind: To me it looks like a campaign for the right-winged party NPD, whose pages are linked in some emails. I also think that the NPD is not the real author of theses mails because such kind of spamming is forbidden in Germany. But there will be an election in the biggest german state (northrhine-westphalia, 19 million inhabitants) next sunday. There is a coalition between two right-winged parties (NPD and DVU) and it seems to me that they do more work than usual to gain the 5 percent of votes to enter the parliament.

yeah I got about 500 in the last few hours. its about time people got serious about spam. it should be illegal for ISPs to knowingly allow spam to pass over their network, with maybe 20 years inside if they turn a blind eye. Im sick of retarded right wing nutters wrecking email.

My ISP is usually pretty good about spam filtering and I've also received about 50 of these stupid emails since yesterday. Really annoying...

These spam mails are apparently once again
produced by a variant of the Sober worm.
See Kasperskys web log at
   http://www.viruslist.com/en/weblog

One "nice" feature of this thing is, that ones mail
address may well appear as the From-address
on some of these mails.

Dirk, you could be right. The German Heise magazine suggests the same:
http://www.heise.de/newsticker/meldung/59562

I also received 50 responses to emails I "sent" to random addresses. None of these are in my sent box.

While gmail usually does a good job filtering, my SpamSieve does a great job detecting Spam. Not this time – 50 or so since yesterday evening. Many from slightly relevent senders whose computers are obviously not virus-free. Anyone have suggestions, or do we just wait out the German election?

Yahoo did not filter out the German spam. In addition, somehow or other, one of the spams came from my own earthlink account! Has anyone else discovered this?

I'm glad for this discussion. It came up in a Googles news search for German spam.

BK

The sender address is not related to the infected PC. The worm probably scans the infected PC for mail addresses and inserts one of those as the from address.

To locate the infected PC you have to analyze the recieved-lines in the mail headers, which will give you the IP address of the PC. However, as most of the systems infected by Sober.P will be home PCs, the IP address will not help you much.

On the other hand, the mails all match a simple pattern, so Spam filters will soon be able to block them.

I got slammed too.

My wife and I also got a few dozen of these emails in our accounts. Very strange these bypassed the Gmail spam filters.

i'm not sure how its harvesting email addresses...

i recieved spam in my gmail box from my college email (in addition to everyone else)... which i registered less than a month ago and havent used for anything but facebook.

weird eh?

Well,

these people never die. What I do not understand is that URI Lists are not listing npd.de in their Blacklists.

Nevertheless Aloaha (http://www.aloaha.com) and put them in their blacklists.

Thanks for these information.

Aloaha

Yes... I am getting this stuff too... i was wondering if someone accidentally signed me up for this as a prank, but seeing that you got 'Massenhafter Steuerbetrug durch auslaendische Arbeitnehmer' too... then something going around.

Happening all weekend. Wonder why google isn't on top of this...

I got about five today... I am smart, and did not click the links...

I am getting these too! They are so annoying! I sent an email to gmail-abusegoogle.com. I suggest everybody with a GMail account does this, maybe they'll notice it? The links aren't dangerous Snafu, they're just articles, but getting email after email in German is really annoying! And plus, they all come from different email addresses so you can't just block one!

I've getting that spam as well.. so far around 120 mails... grrr....

Germany's Spiegel has a nice English round-up of the spam issue:
http://service.spiegel.de/cache/international/0,1518,356140,00.html

Seems to be a worm/virus according to Jim:
http://trainedmonkey.com/entry/2210

He also has a link to spamassassin rules.

I've received over four thousand in the last 24 hours, about a third with one of my site's emails spoofed as the outgoing address. I've spent most of the day putting in filters to keep them out, but I'm afriad that my site's reputation will be damaged. I hope that the creator gets strung up.

Thanks for this information, especially the link to the Spiegel article. One thing I have noticed about this worm, which has not been mentioned here, is that it creates fake email addresses like epostedomainname.com, X-Userdomainname.com, privatedomainname.com. I have "catch-all" enabled on one of our email domains, so I see these emails in my inbox. It seems to be a very opportunistic virus.