Sounds like KLEZ and it picks names from cache, files, address lists and all over the computer.

I had a strange one a few weeks ago, and I do have a firewall and up to date Norton. Somehow my PWP index.html became a 5k file. I don't know if someone dumped it there or what. But when I opened it to edit, and see what it was, suddenly my floppy drive lit up and it tried to access it. (no disk) So I just deleted the "bad" index and picked up a backup from a couple of weeks ago.

Bruce, if Norton doesn't find anything, it's possible there is no virus on your system. That's why you can't find it. No reason to re-format everything, if nothing is wrong. Make sure, before you create a headache for yourself, that isn't necessary. The return address can be spoofed, but tracking, might also have some diversions.

On way of knowing that, is virus messages are sent from your address, when you computer was not operating at that time. Like the ones that I got from myself, when I was away for three days. IMPOSSIBLE but they said they came from me, to one of my manager accounts elsewhere. Pretty odd stuff.