Norman Sandbox detects most types of viruses.

Since the sample we're testing for viral activity is run on a simulated computer system in a simulated network, they can either spread locally on the system, or try to infect other machines. They can also use services of remote machines, like SMTP, News, IRC, DNS etc.