Virus Sent From My Subnet

[Matt]

W32/Klez.H at mm is getting to be a real pain.

I understand it lies about the email address it comes for its own
protection.  I wondered if there is a way to have Mailscanner send me an
alert everytime a certain virus(this one in particuliar) orginates from an
IP in my subnet.  That way, even if it lied about the email address I could
look up in my logs to see who had that IP and tell them to clean there
system.

Another way that could work.

"Warning: E-mail viruses detected"  could be changed too: "Warning: E-mail
viruses detected *local-origin*"

Is that viable?

Matthew H