On 04/18/11 1:20 AM, Ljubomir Ljubojevic wrote: > Are you telling me that trojan manipulated webmail account??? Hm, I > think it might be Chat client (Live Messenger, Yahoo, etc.) rather then > mail client itself, in that case. the mail headers indicate the email may have been sent from 79.113.161.75 Received: from [79.113.161.75] by web31702.mail.mud.yahoo.com via HTTP; Sun, 10 Apr 2011 04:21:42 PDT is that on your network, or is that elsewhere? whois says thats inetnum: 79.113.160.0 - 79.113.163.255 netname: RO-RCS-RDS-FIBERLINK descr: RCS& RDS S.A. descr: FiberLink Customers descr: Galati country: RO admin-c: RDS-RIPE tech-c: RDS-RIPE status: ASSIGNED PA mnt-by: AS8708-MNT source: RIPE # Filtered