Spam email from android, help with questions

[matt9468]

I found out today that my android is sending out emails. I received a failure notice and in the header information it makes reference to my android.

I have ONLY my AT&T account on my droid but what makes me curouis is that the header makes reference to yahoo and the only thing yahoo on my phone is messenger. The email sent out had my att email on it but went through yahoo servers...doesnt make sense to me, any ideas? Is it an app or what? I downloaded a malware scanner and that came up clean.

Below is the header information from the failure notice

Received: from [98.139.44.104] by nm17.access.bullet.mail.sp2.yahoo.com with NNFMP; 27 Oct 2011 16:00:17 -0000
Received: from [98.139.44.90] by tm9.access.bullet.mail.sp2.yahoo.com with NNFMP; 27 Oct 2011 16:00:17 -0000
Received: from [127.0.0.1] by omp1027.access.mail.sp2.yahoo.com with NNFMP; 27 Oct 2011 16:00:17 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: 81779.98512.bm@omp1027.access.mail.sp2.yahoo.com
Received: (qmail 72614 invoked by uid 60001); 27 Oct 2011 16:00:16 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1319731216; bh=wcp8kvtlHenosANRLSBrh6RLIy0EnysZY3BOAiyxD70=; h=X-YMail-OSG:Received:X-Mailer:Message-IDate:From:Subject:To:MIME-Version:Content-Type; b=z6yTTSEwgc/eKIB+tseRo0LieQ6ghQxiIkXNJXhrF1H/TTgEJErTXX+mCYxBdgDU6SDCvd99LlaF10j2Y+3fTGnJ/2Y90m3c5gXP9splXV9BPm7sX/bLZpjDAvx1R+CzSLf+HXDKcUeRFabFv//2vKfydavX+bhTVybpEqjL1gY=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=X-YMail-OSG:Received:X-Mailer:Message-IDate:From:Subject:To:MIME-Version:Content-Type;
b=aMdBnMdi2OdK6weQQNm30gOi2ZIlqklcYUx0JWsaIRLVQ3F+2L7OKGASPvxfpaHQ7F5y1oR3WyaoFQ0sUY+NAFO8pNHU6vlB7PL35J+AOqU4Wn3hSgf4BwMtcNI7X1GsUSs26bHZB3Z2nD5OlNLaMrdn7zexuChuYgQ5i2StGJc=;
X-YMail-OSG: Y75Wq44VM1mWFHyz.AS9KheE7TyJ5YxVcQuAHw960YREC1f
agSY07pMtFGoVn9Xtk8hxxfp291AGAf.uhmtKmAaHIAIsmc3_Og.ODHx4y4Y
Ap0OR44xUZAcm7WEFCcevLKz2COm5DC0gWiUC5OVf6Wg.DRyksNWeN2CD_qp
.CR.gN6nslPbSfdHkgVHhddJog5l6BFUWJ_w8UE18PgaxRBQe6LgN2.DsgWM
7HZMws7nckyqJ1LMBj6QrjLCAqQ4uUs_M8_Ejfbexq5U2YOazJbWDBTMRzHd
W.y4KXhpmN.DIYbt5tsoHhCARkWPJdHCFSpcRAvsQ.WKV4UNuQ0GOpgUhQrY
em38hgG4D8mzVIX8WR6ifBqvIHsGlanZYNvyXxy8G9Xpmf.vnqoyeTmQsfvZ
2wwrvLCK_RWviQ.A3RP8PDa0Up0yBuraMDRtm3DGYBNjlV80rbIVWAtOCEnT
HIz3Vi8srfImz.iZF0w19AhmTZscqOBncHJgbYtLNmIDTpL3UnsSLwA--
Received: from [92.114.73.44] by web180507.mail.gq1.yahoo.com via HTTP; Thu, 27 Oct 2011 09:00:16 PDT
X-Mailer: YahooMailWebService/0.8.114.317681
Message-ID: <1319731216.63869.androidMobile@web180507.mail.gq1.yahoo.com>
Date: Thu, 27 Oct 2011 09:00:16 -0700 (PDT)
***I took this line out since it had my email address***

 

[zuben el genub]

Yahoo address books are loved by spammers. They can spoof your address, and at least in mail, you will see replies about unwanted junk from your friends to you in your mail.I keep no addresses in mine. This probably included the IM list, too.

 

[zuben el genub]

Change your password or Yahoo, too.

 

[John Redcorn]

Received: from [92.114.73.44] by web180507.mail.gq1.yahoo.com via HTTP; Thu, 27 Oct 2011 09:00:16 PDT
X-Mailer: YahooMailWebService/0.8.114.317681

Those 2 lines make it look like its not an android but a web browser that sent the failed message.

Change your pw and change your security questions just to be sure but it's a lot more likely that the 1st reply is correct, probably not compromised, someone's just spoofing your address.

I have a yahoo account I still keep that I'm signed up to some sites from long ago with, it got hacked via my security questions, make of car and birthplace. Both dictionary words. I had to call yahoo on the phone to change those, since if you change them yourself it seems you can just bypass the new security questions and go right to your old ones and you're in.

Mother's maiden name "!wf6H.B9j" is better than "smith"