You receive a notice that your email is undeliverable because of a virus, but you did not send the email. Scanning all files with Norton AntiVirus (NAV) or Symantec AntiVirus with the latest virus definitions does not detect anything.
Some viruses spread by searching an email program's address book, instant messaging program databases, or local files for email addresses. The virus then chooses one of the harvested email addresses for the sender's address and another for the recipient. This can make it appear that another person's computer is infected when in fact it is virus-free.
For example, Alex is using a computer that is infected with the W32.Klez.H@mm virus. Alex is either not using an antivirus program or does not have current virus definitions. Both Beth and Chris have sent email to Alex in the past. When W32.Klez.H@mm performs its emailing routine, it finds the email addresses of Beth and Chris. It inserts Beth's email address into the "From" field of an infected message. It adds Chris's name to the "To" field and then sends the infected email to Chris. Chris receives the message, which appears to have been sent by Beth. Chris then contacts Beth and complains that she sent him an infected message, but when Beth scans her computer, her antivirus program does not find anything--as would be expected--because her computer is not infected.
Note: Because these worms do not use the email address of the infected computer in the email that they send, there is no way to track which computer sent the infected email.
Here is a partial list of common viruses that spread in this manner: