"It just goes to show that computer worms aren't always destructive," a spokesperson for the police in the German city of Paderborn told Reuters.

"Here it helped us to uncover a crime which would otherwise probably have gone undetected," he said.

Trapped by Malware

The 20-year-old alleged pedophile was trapped by Sober-Z, a variant of Sober, a prolific Internet worm that has invaded PCs over the past few months, sending out messages from multiple fabricated e-mail addresses.

The e-mail received by the alleged pedophile said that "an investigation is underway." The e-mail listed the sender as Germany's Federal Criminal Police Office, the Bundes Kriminal Amt (BKA).

Paderborn police charged the man after finding pornographic images of children on his home computer, Reuters said. The man has not been named.

Good Worm?

"It's funny to us as we're so used to worms and viruses being bad news rather than making the world a better place," said Graham Cluley, senior technology consultant for UK-based antivirus firm Sophos.

"But it seems, in this instance, that the German man who received an e-mail from the Sober-Z worm thought he had been rumbled by the police and decided that to give himself up would be the best policy."

The fact that the man took fright and handed himself in to the authorities was never the intention of the Sober worm's creators, Cluley said. "The worm wanted to infect as many people as possible, but it's good to know that something positive has come out of it," he said.

Secret Disguise

The W32/Sober-Z worm, which is presently accounting for over 78 percent of all viruses reported to Sophos, can disguise itself as a message from investigators at the FBI, CIA, or BKA.

According to Sophos, a typical e-mail generated by the worm would look like the following:

Dear Sir/Madam,

We have logged your IP-address on more than 30 illegal Web sites.

Important: Please answer our questions! The list of questions are attached.

Yours faithfully,

Steven Allison
Federal Bureau of Investigation, FBI
935 Pennsylvania Avenue, NW , Room 3220
Washington , DC 20535
Phone: (202) 324-30000

"There's a lesson for the general public here too," said Cluley. "Always keep your antivirus software up to date and don't be too quick to believe everything you receive via e-mail."

If this alleged child-porn offender had been running up-to-date antivirus software or not believed the worm's disguise, said Cluley, then he probably wouldn't now be looking at a criminal sentence.