RE: [Exim] Spammer or new virus?

> 1) Klez forges the envelope From too? (not just header From)

> 2) Klez will look up the MX for the forged From and attempt to send the
>    mail through there?

Klez attempts to guess the MX to use based on email addresses it harvests
from your system.
Klez does not require a correctly configured email client to spread.