Email indicates that you have sent out a virus, but scanning all files with current virus definitions does not detect anything

Symantec.com > Enterprise > Support > Knowledge Base

Email indicates that you have sent out a virus, but scanning all files with current virus definitions does not detect anything

Question/Issue:
You receive a notice that your email is undeliverable because of a virus, but you did not send the email. Scanning all files with Norton AntiVirus or Symantec AntiVirus with the latest virus definitions does not detect anything.

Solution:
Some viruses spread by searching an email program's address book, instant messaging program databases, or local files for email addresses. The virus then chooses one of the harvested email addresses for the sender's address and another for the recipient. This can make it appear that another person's computer is infected when in fact it is virus-free.

For example, Alex uses a computer that is infected with the W32.Klez.H@mm virus. Alex either does not use an antivirus program or does not have current virus definitions. Both Beth and Chris have sent email to Alex in the past. When W32.Klez.H@mm performs its emailing routine, it finds the email addresses of Beth and Chris. It inserts Beth's email address into the "From" field of an infected message. It adds Chris's name to the "To" field and then sends the infected email to Chris. Chris receives the message, which appears to have been sent by Beth. Chris then contacts Beth and complains that she sent him an infected message, but when Beth scans her computer, her antivirus program does not find anything—as would be expected—because her computer is not infected.

Note: Because these worms do not use the email address of the infected computer in the email that they send, there is no way to track which computer sent the infected email.

If you are using a currently supported Symantec antivirus program with the most recent virus definitions, and no threats are detected by a full system scan, then it is unlikely that your computer is infected with any known virus.

Here is a partial list of common viruses that spread in this manner:

W32.Bugbear@mm
W32.Klez.gen@mm
W32.Klez.E@mm
W32.Klez.H@mm
W32.Yaha@mm
W32.Yaha.C@mm
W32.Yaha.E@mm
W32.Yaha.F@mm
W32.HLLW.Fizzer@mm
W32.Sobig

For further information about a specific virus, please consult our online Virus Encyclopedia.

Available Translations:

Document ID: 2002102416271448
Last Modified: 10/21/2005
Date Created: 10/24/2002
Operating System(s): Windows 2000, Windows XP 64-Bit Edition 2003, Windows Server 2003 32-bit Edition, Windows Server 2003 64-bit Edition, Windows XP Media Center Edition 2005, Windows 98, Windows Me, Windows 95, Windows NT 4.0, Windows XP, DOS/Windows 3.1x
Product(s): Symantec AntiVirus Corporate Edition 10.0, Symantec AntiVirus Corporate Edition 8.0, Symantec AntiVirus Corporate Edition 9.0, Symantec Client Security 3.0, Symantec AntiVirus 10.1, Symantec Client Security 3.1
Release(s): SAV 10.0 [All Releases], SAV 8.0 [All Releases], SAV 9.0 [All Releases], Symantec Client Security 3.x [All versions], Symantec AntiVirus 10.1, Symantec Client Security 3.1