Yes, Klez sets the from address at random.. -----Original Message----- From: Nicholas Wong (HK) [mailto:nwong@xxxxxxxxxxxxx] Sent: Thursday, May 16, 2002 8:14 AM To: [ExchangeList] Subject: [exchangelist] Klez.H attack http://www.MSExchange.org/ I found some people use our company's address as display name to send out spawn mails. I have received many complain mail. But I don't know where is the sender. I think they are infected by Klez.H worm. Any one have any idea to deal with this? Nicholas Wong Network Systems Administrator ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: robert@xxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') **************************************************************** This mail was content checked for malicious code and viruses by MailSecurity. MailSecurity provides email content checking, exploit detection and anti-virus for Exchange. Spam, viruses, dangerous attachments & offensive content are removed automatically. Key features include: Multiple virus engines; Email content & attachment checking; Exploit shield - email intrusion detection & defence; Email threats engine - analyses & defuses HTML scripts, .exe files & more. *************************************************************** In addition to MailSecurity, GFI also produces the FAXmaker fax server & LANguard network security product ranges. For more information on our products, please visit http://www.gfi.com This disclaimer was sent by Mail essentials for Exchange/SMTP.