Platform: Windows 7 Up to date Email: Thunderbird 31.6 Virus Tool: McAfee up to date Payload: It may have been dormant for two weeks: A client receieved a virus in the form of soo attached Report.zip which contained a virus. The virus disabled an upto date McAfee Anti Spam addon and install an addon called ???Client_1. This then read the collected addresses and built emails to propagate adding the emails in sent items. The add-on likely had built in error detection in that it attempted to send 96 emails as bcc which errored on send and it changed to 95 (also failed with invalid email), It then tried 22 and succeeded. It was detected atthis point after the user noticed the errors. The payload was not detected by McAfee or AVG but as an exe in a zip clearly contains email dll's from microsoft. Remedial Steps: Take Thunderbird off line. Examine addons. Remove weird Add-On and disable McAfee anti spam (as it did nothing) Export Address book. Delete Addresses. Restart Thunderbird Turn on-line. Check network bytes. Fix emails Apologise on resend (without virus) Tell you guys and AVG/McAfee You should NOT be able to have an addion without permission. Updates great but initial NO. Good luck and keep up the great work. I have the file if you want to add it to a vm to see the addon (sorry I did not keep it). Cheers. Arvid.