I have heard this from time to time and it definitely seems possible. This keeps their services in constant demand, and ensures that they always have the fix for it released shortly after the virus is "discovered." Tangent - I'm just waiting for somebody to use the Klez virus with a more destructive payload. There will be some serious trouble then - it's still running rampant months after it was released. (I work at an ISP and still see customers with it all the time). That guy (Norton? ) did a great job writing that one up.