[Declude.Virus] Klez and IP

[Heimir Eidskrem]

We are stopping tons of klez infected mail using the same sender address.   My question is regarding the reported remote ip address - the ip address reported using the %remoteip% is that the actually ip address of the computer sending the virus or is that also forged by the virus?   So far I have logged 25 different ip addresses using the same sender address.   Thanks, H.