I have had a little luck looking at the header info and finding who it really came from or at least the domain name of the sender and with the help of the end user we where able to track down the person with the virus since it most likely is someone that they know. -----Original Message----- From: Nicholas Wong (HK) [mailto:nwong@xxxxxxxxxxxxx] Sent: Thursday, May 16, 2002 2:14 AM To: [ExchangeList] Subject: [exchangelist] Klez.H attack http://www.MSExchange.org/ I found some people use our company's address as display name to send out spawn mails. I have received many complain mail. But I don't know where is the sender. I think they are infected by Klez.H worm. Any one have any idea to deal with this? Nicholas Wong Network Systems Administrator ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: dkell@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')