Think my gmail was hacked but password still working - spam link sent

MORPH3US

Morning all,

I've just logged into my gmail this morning and had a load of "this message could not be delivered" bounce back e-mails...

It was strange because they were from people that don't work at this particular company any more, I don't ever speak to them and wouldn't have e-mailed them...

Anyway the bounce backs seemed to relate to an e-mail that I apparently sent at 5am this morning... the subject line was "relax" and all that was in the e-mail was a link for a .exe file download.

I am going to post the link below so that if it has happened to anyone else and they google the link then they can find this thread.....

PLEASE DO NOT CLICK THE LINK!!!!

http://rapidshare.com/files/276752531/install.exe

I thought I would download the file and virus scan it but it came back clean which was strange but might just be my scanner not picking it up.

I have also e-mailed everyone that this person e-mailed and told them not to open the link and just delete the e-mail.

Now i'm wondering though how the hell someone can hack into my gmail account?

Has this happened to anyone else?

aliEnRIK

The most common way for this to happen is someones watched you typing in the password, somones retrieved the password details off your computer (If its saved) or youve a password thats easy to crack/workout
Its also possible but highly unlikely that someones hacked into your router and reading your information (This takes some skill which most people simply dont have)
Its also possible that somone with access to your computer has already run that exe file which has resulted in the problem you have
So change your password for gmail into something hard to crack and change the security for your router (Allowing only 'your' computers if you wish)

dekh

Bounce back emails are most likely due to your email address being spoofed into the reply address of outbound spam emails. The spammers don't want the bounce back messages coming to them, or to give out an email address associated with them.

Quite often you get spam adressed to you which seems to come from you. This is just the spam software putting the same email address in the to field as the from and reply to field in the email.

It's unlikely that they were actually sent from your account.

Change your password anyway though.

You probably shouldn't have bothered emailing anybody either.

davester

The idiot that has the rapidshare account can be reported via fileshare , giving them that full link in your email. It will get the idiot removed from the site, just shows you rapidshare don't virus scan all the things people place on their servers.

MORPH3US

dekh wrote: »

Bounce back emails are most likely due to your email address being spoofed <snip>

It's unlikely that they were actually sent from your account.

<snip>

You probably shouldn't have bothered emailing anybody either.

I'm affraid not.... I checked my sent mail folder and it was in there. They had also sent it to my girlfriends e-mail so I checked her account and it was in there from me.

So I do think e-mailing people and warning them is better than not e-mailling them and having some friends and colleagues downloading this file "from me" and then having a virus / losing important documents / photographs of family / music etc...

EDIT

Just used the Kaspersky online virus scan and got the following:

install.exe - infected by Packed.Win32.TDSS.y

davester

Where do you use a computer?

Just cause the emails are 5am time stamped doesn't mean your computer was on when they was sent. Home PC or work PCs need to be scanned for everything too. best in safemode too,

Let IT know but let them know you didn't click that link so they can't blame you for infecting their machine. more than likely someone else infected it and you got stung if it was at work.

kwikbreaks

As was pointed out the other day the easiest way to reveal your email password is to use the same combination when registering on a website. Use a different password on each site.

spud17

http://windowssecrets.com/comp/090806

http://windowssecrets.com/comp/090813 (Scroll down)