It sounds like a common W32/Klez virus. It can and does spoof e-mail return adresses so it looks like its comming from a friend. he or she doesn't have to be infected for it to use their addy. The from and replyTo header in an email are merely symbolic, you can set them to whatever you want.

For the returned emails, it looks like a returned email but it really isn't. Although, if you download the attached "email" to see what exactly it was that you supposedly sent your friend, the virus gets into your sysem in the download and infects your machine. Thank heavens that real viruses don't act that way. Could you imagine getting a visit from your mom, only she's not your mom, but a virus who looks like your mom to trick you? It's too scary to think about.

So always have an antivirus program running and having auto-protection always on. If you are using Windows and you don't have an antivirus program, please don't go online, because you won't go very far.

Jinn