OK, but he was sending Love.scr (infected with the W32.Yaha.K@mm virus).
All reports I have read say it is a fairly simple virus and does not try to
"cloak" the sender.   In any event, he seemed to fix it right away.

                            Rick Glazier

From: "David Gillett" <[log in to unmask]>

>   The "Klez" virus is famous for sticking in faked From: address, found in
> the address book of the infected machine (if A knows B and A knows C, it
> figures there's a reasonable chance B knows C).
>
>   On several of the copies of Klez that I've received, however, there was an
> additional "Reply-To:" header which the virus had not changed, pointing to
> the actual infected machine.

> On 8 Jan 2003, at 14:18, Rick Glazier wrote:
> > That virus does NOT seem to fake the senders address though...
> > I checked that first since if if did, anything this "simple" would
> > have been a waste of time.
> >
> >                                Rick Glazier
> >
> > From: "Don Weagant" <[log in to unmask]>
> > > as I don't know you or him. Mr Clarke's ISP is in Wales. Yes, there are
> > > different bodies in the letter, but contain the same scr. I have received
> > > about 15 letters from this address, I wrote to that address, and it did
> > > not bounce, and the mail seems to have stopped from there.

               The NOSPIN Group Promotions is now offering
              Mandrake Linux or Red Hat Linux CD sets along
             with the OpenOffice CD...  at a great price!!!
             http://freepctech.com/goodies/promotions.shtml