>Hi Tamar,
>
>The headers do not accurately portray the originator of the virus with this one because it uses spoofing. See:
>
>http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html

The From address is spoofed, but I'm actually reading the email headers and pulling the computer name out of the last Received line. I'm pretty sure that's not being spoofed, particularly because the prior thread I started on this subject resulted in another machine getting cleaned up.

Tamar