I use Eudora. Here's the message with the headers expanded to show all the information (the virus was in the attachment which has now been zapped).
Return-Path: <9.FCD0BD98@home.ease.lsoft.com>
Received: from celeron1 ([213.48.235.184]) by mta04-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20040303111331.YUVU20489.mta04-svc.ntlworld.com@celeron1>
for
[Admin Edit(Mick): Email address Removed.];Wed, 3 Mar 2004 11:13:31 +0000
Date: Wed, 03 Mar 2004 11:15:49 +0000
To:
[Admin Edit(Mick): Email address Removed.]
Subject: Notify about your e-mail account utilization.
From:
support@NTLWORLD.COM
Message-ID: <hbxjfhuibnebiblsecj@NTLWORLD.COM>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------snxkidupvhljxcojtdok"
Dear user of "NTLWORLD.COM" mailing system,
Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.
For details see the attached file.
For security purposes the attached file is password protected. Password is "32585".
Kind regards,
The NTLWORLD.COM team
http://www.nTLWORLD.COM