check the headers for the i.p it came from
here is header info from someone who sent a virus
Return-Path: <
[email protected]>
Delivered-To:
[email protected]
Received: (qmail 15945 invoked from network); 26 May 2003 06:57:53 -0000
Received: from unknown (HELO MATT1) (204.210.44.85)
now go to
http://www.cotse.com/cgi-bin/lookuptools
and enter the i.p in this case 204.210.44.85
and u will see it does not resolve to microsoft.com but rather this...
Hostname: dt0a1n55.san.rr.com
IP Address: 204.210.44.85
Decimal Address: 3436325973
see san francisco road runner was the origination not microsoft
please man i am not that dumb