The virus that pretends its from support@microsoft.com came from IP address 217.57.140.195, message Subject: Re: Movie All information is in the attached file.
name="screen_doc.pif"

Full header

Received: from host195-140.pool21757.interbusiness.it (217.57.140.195)
by mail15c.boca15-verio.com (RS ver 1.0.80vs) with SMTP id 4-033685454
for ; Thu, 22 May 2003 06:47:35 -0400 (EDT)