Help! My Gmail is Spewing Spam

jaqian

My Gmail account is sending spam for Sdivert.com, don't know how to stop it. I only use webmail (no outlook/thunderbird) and my computing platforms are my android smartphone and my ubtuntu desktop pc.

I changed my password is that enough?

Rob

yoyo

Changing your password should sort it, but keep an eye out all the same. Scroll down to the bottom of the Gmail page and look for "Last Activity: " click details to see if anyone else is accessing/has accessed the account

Nick

bonzodog2

It is trivially easy to send email pretending its from any email address you like, e.g. your gmail address. It would need no interaction with gmail's servers either.

Possibly someone, or a botnet has found your email address somewhere and is spoofing emails from you.

Post some email header lines of sample emails (sanitized!) and you may get more advice

jaqian

Checked last activity and last time I checked I'd never been to China (220.181.118.170).

All the emails are in my sent box so defo sent from my account. Will keep an eye on it but hopefully new password will put a stop to it. Thanks.

yoyo

jaqian wrote: »

Checked last activity and last time I checked I'd never been to China (220.181.118.170).

All the emails are in my sent box so defo sent from my account. Will keep an eye on it but hopefully new password will put a stop to it. Thanks.

Yeah the account was accessed by the spammers, changing the password and only logging in on machines you trust should avoid this problem happening again

Nick

pixbyjohn

Also any addresses you have in your contact list add an extra m as in someone@gmail.comm This will stop the spammer sending to youir contacts. You just have to remember to delete the extra m when you use the contact legimately. But I think changing your password will cure the problem really.

yoyo

pixbyjohn wrote: »

Also any addresses you have in your contact list add an extra m as in someone@gmail.comm This will stop the spammer sending to youir contacts. You just have to remember to delete the extra m when you use the contact legimately. But I think changing your password will cure the problem really.

Or even better:
http://support.google.com/accounts/bin/static.py?hl=en&topic=1393839&guide=1056283&page=guide.cs . I would highly reccomend any Gmail user set this up

Nick

jaqian

I had 2step verification setup but wouldn't work with Android for some reason. Might try it again.

vibe666

jaqian wrote: »

I had 2step verification setup but wouldn't work with Android for some reason. Might try it again.

I had the same problem (and my gmail was hacked).

i actually got a notification from gmail saying someone had accessed my account from spain and that i should check it and change my password and set up multifactor authentication, so i did that, but i prefer to use the android browser for gmail instead of tha app and it just wasn't playing nice, so i just chose a mad random password that i could still memorise and disabled the extra authentication.

yoyo

jaqian wrote: »

I had 2step verification setup but wouldn't work with Android for some reason. Might try it again.

You need to create a password for application for android when using 2 step verification, its in my accounts>authorize application or something like that

Nick

jaqian

Like I said my password was changed I have been keeping an eye on the account and it hasn't been accessed by anyone other than me, yet I'm still finding loads of sent messages in my sent folder.

I assume if someone was spoofing my email I would be receiving email that looked as if it had come from me and nor see actual email in my sent folder.

Here is a copy of a recent email...


****************************
Date: Thu, 15 Dec 2011 16:13:40 -0800
From: Jaqian <jaqian@gmail.com>
To: bounce-mc.us1_1211649.1243110-jaqian=gmail.com@mail32.us1.rsgsv.net
Message-ID: <CAA6JT5uF6QgXnF8iXhq2NdiYmwOVpyXuSivEfvGtUVC73i04jA@mail.gmail.com>
Subject: I hope you like it! Re: Why Your Schedule Should Have a Weekly Appointment Dedicated to "Thinking Time"
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Precedence: bulk
X-Autoreply: yes

2011 Sdivert.com Boxing Day Sale Now

Christmas is coming. I would like to introduce you a good website for
shopping: Sdivert.com they export all kinds of digital products and
offer really competitive and reasonable price and high quality goods.
And they will provide the best sales-after-service. I bought a digital
camera with very low price. From 23rd , Nov to 28th, Dec, they have
various christmas decorations for the coming christmas as free gift
for you.

Act quick and check online!

****************************

I don't understand how it still be sending email, any ideas?

wonderfulname

Check your mail settings under accounts and imports, see if you have given access to an odd account.

EDIT:Full checklist for hacked a/c:

If your Contacts received spam from you, or if you find access activity that you can't account for, we suggest taking the following steps as soon as possible.

Make sure your operating system is up-to-date. Be sure you've downloaded and installed any critical Windows updates from Microsoft, or Mac OS updates from Apple. We recommend enabling automatic updates.
Check for viruses and malware. Run a scan on your computer with a trusted anti-virus software. If the scan detects any suspicious programs or applications, get rid of them immediately. Note: We have no connection with these companies and can't comment on their effectiveness. We can tell you, though, that trying all of these programs often makes a difference, as does having the latest versions.
Google Pack - Norton Security Scan, Spyware Doctor
Kaspersky Free Virus Scan
Spybot Search and Destroy
Lavasoft Ad-Aware
MacScan
Change your password. Make sure you choose a password that contains a combination of numbers, characters, and case-sensitive letters. Never reuse your Gmail password on any other website. These steps will help strengthen the security of your account.
Update your recovery email address and your security question. Should you ever lose access to your account, these two items will be vital to recovering your account. Make sure that you have access to the email address listed as your recovery, and the answer to your security question should be easy for you to remember, but hard for others to guess.

Check your Settings. Click Settings at the top of any Gmail page and verify that the following items have not been changed:
On the General tab: Your Signature, Vacation Responder and Browser Connection.
On the Accounts and Import tab: Send mail as.
On the Filters tab: Look for any filters you did not create, especially filters that forward your mail.
On the Forwarding and POP/IMAP tab: Look for any changes you did not make.
Use a secure connection when signing in to Gmail. In your Gmail settings, select 'Always use HTTPS.' This setting helps protect your information from being stolen when you are signing in to Gmail on a public wireless network, like at a cafe or hotel.
Also, to make sure that no one gains unauthorized access to your account:

Never tell anyone your password or security question and answer, and don't write them down.
Never send this information by email.
Never give out your gmail password after following a link sent to you in an email. Access gmail directly by typing mail.google.com in your browser's address bar.
Don't reuse your Gmail password on other websites.
Periodically change your password and security question.
Keep your recovery address up to date.

jaqian

wonderfulname wrote: »

Check your mail settings under accounts and imports, see if you have given access to an odd account.

EDIT:Full checklist for hacked a/c:

Thanks, found it. The "Out of Office AutoReply" was switched on with the above message.

What a relief

papajohn12

jaqian wrote: »

My Gmail account is sending spam for Sdivert.com, don't know how to stop it. I only use webmail (no outlook/thunderbird) and my computing platforms are my android smartphone and my ubtuntu desktop pc.

I changed my password is that enough?

Rob

i would say that changing the password is not enough, this ip has also been reported here for hacking a Facebook account. I say it's not enough because the root cause of the password leak was probably a trojan installed on your PC.

Sorry to say this, but best thing is to reinstall your OS imo (not on your mobile devices of course)

yoyo

papajohn12 wrote: »

i would say that changing the password is not enough, this ip has also been reported here for hacking a Facebook account. I say it's not enough because the root cause of the password leak was probably a trojan installed on your PC.

Sorry to say this, but best thing is to reinstall your OS imo (not on your mobile devices of course)

It was likely a phishing scam or logging in on a machine with a keylogger, I'm guessing phishing though, if it persists I'd look into a trojan but don't do anything that drastic yet!

Nick

jaqian

yoyo wrote: »

papajohn12 wrote: »

i would say that changing the password is not enough, this ip has also been reported here for hacking a Facebook account. I say it's not enough because the root cause of the password leak was probably a trojan installed on your PC.

Sorry to say this, but best thing is to reinstall your OS imo (not on your mobile devices of course)

It was likely a phishing scam or logging in on a machine with a keylogger, I'm guessing phishing though, if it persists I'd look into a trojan but don't do anything that drastic yet!

Nick

Silly question but do you get