First off I'd check with an AV site to see if the virus spoofs. I personally
use http://vil.nai.com because I use their AV software, though any site will
do.
If it spoofs, don't bother trying to find them. If it doesn't spoof, reply
to the email.
--
acmp<><
(e-mail address removed) <not real duh!
acmp at ntl world dot com