[mythtv-users] OT - Spam bounce

Wed Sep 3 09:00:23 UTC 2014

I've just noticed two messages in my junk folder which appear to be spam bounces.

These purport to show that I have sent something to this address which has been 
rejected but of course I have not.

Examination of the source shows a forwarded original message from me to the 
mythtv mailing list, unfortunately it is in Unicode and the message content has 
been base-64 encoded; I'm guessing that it isn't the original message. I can't 
even read the header as it is in German.

What I suspect has happened is that a subscriber's mailer program has been 
compromised. If anyone wants to follow this up please contact me by direct message.

Header of the forwarded message:

Received: from zugspitze.alpenland.local ([192.168.180.252]) by 
zugspitze.alpenland.local with Microsoft SMTPSVC(6.0.3790.4675);
	 Mon, 1 Sep 2014 13:36:25 +0200
X-hMailServer-ExternalAccount: everwake POP3
Return-Path: <mythtv-users-bounces at mythtv.org>
X-Original-To: faichele at alpenland.local
Delivered-To: faichele at alpenland.local
Received: from localhost (localhost [127.0.0.1])
	by everwake.alpenland.local (Postfix) with ESMTP id 60D1B5E00DB
	for <faichele at alpenland.local>; Mon,  1 Sep 2014 13:33:16 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at everwake.alpenland.local
X-Spam-Flag: NO
X-Spam-Score: 0.001
X-Spam-Level:
X-Spam-Status: No, score=0.001 required=5
	tests=[HEADER_FROM_DIFFERENT_DOMAINS=0.001]
	autolearn=ham autolearn_force=no
Received: from everwake.alpenland.local ([127.0.0.1])
	by localhost (everwake.alpenland.local [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id Q-rERrrZRaeP for <faichele at alpenland.local>;
	Mon,  1 Sep 2014 13:33:08 +0200 (CEST)
Received: from everwake.alpenland.local (localhost [127.0.0.1])
	by everwake.alpenland.local (Postfix) with ESMTP id F343D5E00DA
	for <faichele at alpenland.local>; Mon,  1 Sep 2014 13:33:07 +0200 (CEST)
Received: from mail.primusnetz.de [88.198.196.222]
	by everwake.alpenland.local with POP3 (fetchmail-6.3.26)
	for <faichele at alpenland.local> (single-drop); Mon, 01 Sep 2014 13:33:07 +0200 
(CEST)
Received: from coulomb.primusnetz.de (coulomb.primusnetz.de [81.169.212.19])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by einstein.primusnetz.de (Postfix) with ESMTPS id 6083B44B8FC
	for <faichele at einstein.primusnetz.de>; Mon,  1 Sep 2014 13:30:09 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by coulomb.primusnetz.de (Postfix) with ESMTP id 11B35BC0087
	for <faichele at einstein.primusnetz.de>; Mon,  1 Sep 2014 13:30:09 +0200 (CEST)
X-Virus-Checked: by primusnetz.de
Received: from coulomb.primusnetz.de ([127.0.0.1])
	by localhost (coulomb.primusnetz.de [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id Mhye02YVQU4G for <faichele at einstein.primusnetz.de>;
	Mon,  1 Sep 2014 13:30:06 +0200 (CEST)
Received: from alcor.mythtv.org (alcor.mythtv.org [140.211.167.130])
	by coulomb.primusnetz.de (Postfix) with ESMTP id D3F54BC0083
	for <faichele at primusnetz.de>; Mon,  1 Sep 2014 13:30:05 +0200 (CEST)
Received: from alcor.mythtv.org (localhost [127.0.0.1])
	by alcor.mythtv.org (Postfix) with ESMTP id 05370810C5;
	Mon,  1 Sep 2014 11:29:44 +0000 (UTC)
X-Original-To: mythtv-users at mythtv.org
Delivered-To: mythtv-users at mythtv.org
Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.130])
	by alcor.mythtv.org (Postfix) with ESMTP id 7D779810B4
	for <mythtv-users at mythtv.org>; Mon,  1 Sep 2014 11:29:41 +0000 (UTC)
Received: from [192.168.xxx.xxx] (hostxxx-xxx-xxx-xxx.rangexxx-xxx.btcentralplus.com
	[xxx.xxx.xxx.xxx])
	by mrelayeu.kundenserver.de (node=mreue004) with ESMTP (Nemesis)
	id 0Lzna3-1YTKC01Gyp-014yRP; Mon, 01 Sep 2014 13:29:39 +0200
Message-ID: <540458A2.7000606 at randomtraveller.org.uk>
Date: Mon, 01 Sep 2014 12:29:38 +0100
From: Mike Perkins <mikep at randomtraveller.org.uk>
User-Agent: Mozilla/5.0 (X11; Linux i686;
	rv:31.0) Gecko/20100101 Thunderbird/31.0
MIME-Version: 1.0
To: Discussion about MythTV <mythtv-users at mythtv.org>
References: <1482c47371d.11f4ba24d393354.1915634764417821679 at zoho.com> 
<B9BA6298-66C9-4687-8EB1-37FCE848E691 at dinkum.org.uk> 
<1482cda8523.113244823397395.8851958127158506186 at zoho.com> 
<540395D0.5070907 at randomtraveller.org.uk>
	<7F8951DE-3ACD-471A-A472-78DE6C444B53 at dinkum.org.uk>
In-Reply-To: <7F8951DE-3ACD-471A-A472-78DE6C444B53 at dinkum.org.uk>
X-Provags-ID: V02:K0:cIITX4usSlsw/5jT/o8rIfT8j9B8FOCgUZTIzJ5mBPv
	/mKgzLHV0f9tygrf+u6JNC1HSNp6itWTxHBLAQ04Bmmo5yeXRt
	MmWAwxSVCYPMEPwuT0j10WeHqduK+E6fudMBgNJCOz2ThpCBp9
	JhsduE5EEg1Z31zjZ/kEt1ZG9lKo88aUCtdVsTyU53OKIO0MDN
	zMWP1x09Bg7PBmD5UjWJ7KMKbGe5i0z0VuwngWNg3ZkqEALVAB
	VEl8a+seagvjSIJMzLRc0ijCOSnAAZOpm2k4lo2vRjxKnAxKC6
	bg4z5o+Eg6lSUiI7ow6mHVJdXMKUoUt0u/NPovwDQzZ9j/IEdS
	zmP2p2rfyORXq6hJKVgY=
X-UI-Out-Filterresults: notjunk:1;
Subject: Re: [mythtv-users]
  =?utf-8?q?upgrading_to_kenel_3=2E16=3F_=28PCTV_292?=
  =?utf-8?b?ZSB0cmlwbGVzdGlja8KgwqDCoMKgc3VwcG9ydGVkKQ==?=
X-BeenThere: mythtv-users at mythtv.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Discussion about MythTV <mythtv-users at mythtv.org>
List-Id: Discussion about MythTV <mythtv-users.mythtv.org>
List-Unsubscribe: <http://www.mythtv.org/mailman/options/mythtv-users>,
	<mailto:mythtv-users-request at mythtv.org?subject=unsubscribe>
List-Archive: <http://www.mythtv.org/pipermail/mythtv-users/>
List-Post: <mailto:mythtv-users at mythtv.org>
List-Help: <mailto:mythtv-users-request at mythtv.org?subject=help>
List-Subscribe: <http://www.mythtv.org/mailman/listinfo/mythtv-users>,
	<mailto:mythtv-users-request at mythtv.org?subject=subscribe>
Content-Transfer-Encoding: base64
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Sender: mythtv-users-bounces at mythtv.org
Errors-To: mythtv-users-bounces at mythtv.org
X-OriginalArrivalTime: 01 Sep 2014 11:36:26.0548 (UTC) FILETIME=[F70D3740:01CFC5D8]

(Then follows the base-64 encoded stuff)

-- 

Mike Perkins