Norton won't run if you have the Klez.H virus if norton gets infected with it. easiest way is to take that tool i supplied at the beginning and run it with /scanfiles, if its there it will detect it even if its laying dorment. No sam, i wasn't upset with you, i was upset with Ron for assuming something that he shouldn't have. I want to know how it got your guy's header when the virus doesn't modify the whole header, the sender wasn't even modified like its sapose to. Its really anoying yes, and being the first virus thats managed to get threw to me in over 3 years, it is something that i am concerned about. Considering its ur guy's full header, and looks to be the same besides one minor ip difference ( 24.92.226.122 vs. 24.92.226.169 meaning both machines are on the same subnet) I can only figure maybe its coming from the mail server.