Path: csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod From: Jimmy Johnson Newsgroups: linux.debian.user Subject: Re: [OT] Has my e-mail account been hacked? Date: Tue, 13 Oct 2015 08:40:02 +0200 Message-ID: References: X-Original-To: Stephen Powell , debian-user@lists.debian.org X-Mailbox-Line: From debian-user-request@lists.debian.org Tue Oct 13 06:37:05 2015 Old-Return-Path: X-Amavis-Spam-Status: No, score=-6.798 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .nm8-vm8.access.bullet.mail.gq1.yahoo. - helo-domain: .yahoo.) FROM/MX_MATCHES_NOT_HELO(DOMAIN)=0; rate: -5 Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1444718207; bh=CGpN81MSPhk+Z3adupNcHKzL7LupEuKnwKLA+PfMYm4=; h=Date:From:To:Subject:References:In-Reply-To:From:Subject; b=HGY2Jr6yGZAnfBl0jnlqtrqTq7WjW9qrYOKLZYKTi8ThTWicqvXR/aDhW1aCL2Y0bxLq2GYhI03lLJVRm15j29OZUwdydBFQ7T791hf7+nhJzjC55ImdsjQ2IPKxlUD1XpKH4YopN1uTnRjnYTQIsRdTs7SkvUCCN/+KpmBLdY5KAQeTYDibXlWimPOhqzFyY/04f/vKsXOeOG/B8RTIGbB/48VJA7wMWMSbdDBqf3dFIQM663a6uNZ/SixGIOOVwnrvgedBE094cDDkjIE3fnOwJkwMeVeM0kxnayOnxoH9X5Ex2nMdDu7oo4VvhxSLfckOYgARbOuVQCwI9XCkYg== X-Yahoo-Newman-ID: 923156.89640.bm@smtp114.sbc.mail.gq1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-Ymail-Osg: Vzr8mwQVM1m8WTprEW8eVpvoOfVeOqUtdtEUgh81bb6yLzH d6sWhNtjQeeLr_n1b1YQ3w21j9jS4p3063FJDJExt35yhiAD2.b4Tu_uITYK HyK5yH7kFaH4V.avethn7XtNWXTNZ0LrIvRQ.htn6VCdLEN4ErvF8qwJnvRk bllpCkX323zSD88_LP5gwuIf2EqLQVGVZyiYXrW9xzMMm8KBDq_3g.m9jMoT xWaNnKd3SOnbBaoMFyYiUcttMW7d5Qsz2U6KlKqBzvaKecM7EI5F6Xkp6ARo m5SM25ju4BZBX_O.7v9g0STL8UW7bIMbE.hTI.8Gb7S5qOu4wMaTa9M4CjZM fuNyk_j5eR1mXssc12UwoTaXqO8FjJIr_DDK8aNYcKe3iDru1bubBzaKDnvp CXGy7mHkZmDg35kloXRybEA.iC1n14gSdnFO68FzMLwVuNWbLu16P1MPZYiY hFfKccoJc4sVp2.KdY4fkNbd_kQ7dhfxrPusTurG6l3eVEUa63mBPGJR9IX3 0aDX2.q6umpcXo5D.a9yZXciPTpjzXs4i2brE8blScw-- X-Yahoo-SMTP: RZ3gxciswBBgk2GT.bh.53dvHFPBUq3_nlS3fqI- Organization: PC Repair User-Agent: PC Repair and Better Built Computers MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Mailing-List: archive/latest/698469 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/561CA67E.2010009@gmail.com Approved: robomod@news.nic.it Lines: 31 Sender: robomod@news.nic.it X-Original-Date: Mon, 12 Oct 2015 23:36:46 -0700 X-Original-Message-ID: <561CA67E.2010009@gmail.com> X-Original-References: <1667908699.49175606.1444661022955.JavaMail.zimbra@wowway.com> <561BCA45.9060505@craneworks.de> <561C1DB1.8060901@longlandclan.id.au> <1539111333.49518996.1444694339269.JavaMail.zimbra@wowway.com> Xref: csiph.com linux.debian.user:159012 On 10/12/2015 04:58 PM, Stephen Powell wrote: > On Mon, 12 Oct 2015 16:53:05 -0400 (EDT), Stuart Longland wrote: >> >> I'd check the backscatter case, as this requires no skill on the part of >> the attacker and is the most likely case. >> ... >> It's worth knowing how to read the headers of emails in this >> circumstance as it can give you vital information for knowing what is >> going on. > > Unfortunately, I don't. Attached below is one of the mail delivery > failure notices, which includes the headers of the original message. > But I don't understand what it all means. Perhaps you or someone else > out there can make some sense of it and advise me accordingly. > Remember, I never sent the original e-mail. I just got the delivery > failure notice. > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2800.1081 < > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081 Looks like it was mailed from MS Windows. Maybe mailed from a Windows OS with a virus. Do you run Windows too? -- Jimmy Johnson Debian - Wheezy - KDE 4.8.4 - AMD64 - EXT4 at sda1 Registered Linux User #380263