sounds f***ed... I dont think its a virus sending these... How do you know its not using cloaking? (By the word cloaking, i assume you mean false emails) It's not hard to use a fake email, even if you with most progs no longer can send from @hotmail and @msn cuz they have some sort of security authentication method now... But for example you can send from [email protected] . (Note the dot to the left) Try getting his IP (You should find it in the header of the mail, if u have problems finding it give me the entire header and ill get it 4 u) Also, have u tried to open the zips? Whats in them?