Sharen, The part of the header that says: " Received: from Sharen (roc-66-66-101-140.rochester.rr.com [66.66.101.140]) by mailout5.nyroc.rr.com (8.11.6/RoadRunner 1.20) with SMTP id g6BLMYL177988 : You'll see where it says Sharen there. That doesn't have to be the return email address but rather the computer's name, or the user's name on the computer. Basicaly, the computer identifies itself. Now, that header is very difficult to fake. But, the only real pointer would be the ip 66.66.101.140. Then again, I'm not sure, if Klez is able to fake headers that indepth or not. So I ain't saying it's you. Was just replying to where I lost you :) The thing you can do is test your computer's IP. If on a windows machine on Win98 you can go to Run and type in winipcfg. In the box that pops up it will give you the ip. If an NT based, like Win2k or XP go to Run and type in cmd, then when the command line pops up type in ipconfig, hit enter and it'll give you your IP there. Hope that helps some. If on a MAC, sorry I haven't done anything with them in too long to tell you how to navigate it's TCP anymore. Tom