Oh well, I've finally got round to scanning the attachments in Windows (something which on reflection, I should have done before). Even though the emails have different subjects, bodies and the attachments have different names, PC-Cillin detects them both as worm.klez.GJon