3

I just logged in to my gmail and was shocked by the amount of automatic responses I got in my inbox. I then looked at my sent messages folder and noticed that apparently, thousands of spam e-mails were sent using my gmail to all my contacts.

These people include trusted contacts such as university and work application managers aswell as other important people.

Now that the e-mails have already been sent, what can I do to control the damage done as much as possible? Should I send all those contacts another e-mail explaining the situation? Note that that would mean that another 5000+ e-mails are being sent from my account (which is probably already flagged as "spam"). If I don't clarify however, this will lead to awkward situations.

I checked the IP history and it also says that some IP has logged in to my account 45 minutes ago. I do not know this IP, so the mails must've been send at an other location with my password. I changed my password, but the mails have already been sent.

I am lost here and only see very bad outcomes of the situation, whatever I do. Should I maybe contact google? What do you recommend?

Improve this question

4 Answers 4

Reset to default
7

You did the right thing by changing your password. I'd also check that all the contact details (alternate e-mail addresses etc.) are still correct. Monitor the account closely and make sure that no one gets in again. The worst case is that you've got a keylogger installed so you might want to consider changing the password again from a different computer, and running a full scan of your machine.

As to the problem of all the e-mails sent - don't send out a mass e-mail, you'll only be compounding the problem and you might be marked as a spammer. It's important to note that most of the e-mails might not have been delivered if the various mail servers involved have decent, up to date spam and virus filters.

By all means contact the most important people individually - but it's sad to say that with all the spam going around and e-mail spoofing most people get spurious e-mails at some point.

Improve this answer
10
  • Should I format my PC? I actually formatted two weeks ago to install windows 7. I did download a few applications meanwhile though, but these came from reliable sources. Spybot search & destroy returned 0 results, and so did avast anti-virus and Ad-Aware.
    – Tom
    Nov 21, 2009 at 15:03
  • @Tom - formatting is one option (albeit the nuclear one) and not one I'd recommend as the first choice, but if you've not got much installed and are happy doing it then go for it.
    – ChrisF
    Nov 21, 2009 at 15:07
  • Could you please elaborate your answer a bit more? For example, I am obviousely very interested in what would be your first choice, keeping all the things I've already done in mind.
    – Tom
    Nov 21, 2009 at 15:09
  • Update: the question of the comment above should have been "Is it even possible to solve this situation when Spybot search and destroy, avast anti-virus and Ad-Aware all returned 0 results other than formatting the whole hard disk?"
    – Tom
    Nov 21, 2009 at 15:15
  • @Tom - my first choice would be to do what you've done and then closely monitor the account for further hacking attempts. If nothing else happens then you've fixed the problem without "going nuclear". However, some people would recommend reformatting straight away.
    – ChrisF
    Nov 21, 2009 at 15:16
2

I just logged in to my gmail and was shocked by the amount of automatic responses I got in my inbox. I then looked at my sent messages folder and noticed that apparently, thousands of spam e-mails were sent using my gmail to all my contacts.

Thousands of spam emails ? I may be wrong, but some vague memory assures me that google has some sort of spam filters, that prevents you from sending a mail to more than a certain number of people.

Never do send mails to a lot of people, so never cared about it. Therefore the uncertanty.

These people include trusted contacts such as university and work application managers aswell as other important people. Now that the e-mails have already been sent, what can I do to control the damage done as much as possible? Should I send all those contacts another e-mail explaining the situation? Note that that would mean that another 5000+ e-mails are being sent from my account (which is probably already flagged as "spam"). If I don't clarify however, this will lead to awkward situations.

Yes, if you do care, send a carefully worded mail of explanation.

I checked the IP history and it also says that some IP has logged in to my account 45 minutes ago. I do not know this IP, so the mails must've been send at an other location with my password. I changed my password, but the mails have already been sent.

I am lost here and only see very bad outcomes of the situation, whatever I do. Should I maybe contact google? What do you recommend?

Well, it has nothing to do with google (just like if you crash your car, it isn't Peugeot's fault), but do:
- try to find out as much as you can about that spyware (I never heard of any exploiting gmail)
- try to clean it
- change your gmail password (after cleaning the spyware) - check if the sended mails had any sort of attachment with them

Improve this answer
7
  • First, there's actually only 6 e-mails but with thousands of target addresses, resulting in thousands of e-mails being sent. I checked my sent history, and these are sent. I did check the numbers. Second, Google is hosting my data and has direct control over my account. Peugeot is not in control of my car. I can not find anything about the spyware itself, that is why I am here. I have been unable to clean it. I did change my password. The sended mails did not have any attachments.
    – Tom
    Nov 21, 2009 at 15:26
  • Wish I could edit comments to correct spelling mistakes.
    – Tom
    Nov 21, 2009 at 15:27
  • What I ment to say is, google is supplying the tool but it's yours houw you use it. Not their problem. // Then how do you know it was a spyware ? A spyware which logs passwords, or exploits gmail, then sends it to someone ... IMHO, pretty complex. More probably someone (by ways unknown) got your password. Clean your system from all (just reformat and reinstall if you can). Safest that way. How can you be sure if it is a keylogger, it hasn't got a hold of the second password ?
    – Rook
    Nov 21, 2009 at 16:09
  • I am no expert. But, please enlighten me what else could have stolen my password and then inform someone else about it as I am positive that noone I know in real life could possible have seen it. Such a digital transfer of my sensitive data to the guy who caused it is, as far as I know, always considered as spyware.
    – Tom
    Nov 21, 2009 at 18:50
  • No need to get bitter ... I'm just trying to help. // Keyloggers are not usually, per se, considered spyware. They fit into their own category. // Third, you first said, and I quote, "thousands of spam e-mails were sent using my gmail to all my contacts", then you said, it was actually send to only 6 mail adresses (which is completely different, because then they distribute it further). Third, if someone used your account to send spam, and he send it to those 6 adresses, how did he know to choose exactly those six (because, I'm sure you have more than 6 adresses in your contacts list).
    – Rook
    Nov 22, 2009 at 3:07
2

Apart from the fact that your account was hacked, there's the possibility that your email address is now logged in some hacker's database together with all your contacts. In that case, having closed off access to your account won't stop spam from your address from arriving, as it can still be sent from other computers and tricked-out to look like it was sent by you.

The best solution is to abandon your email address, so as to allow your contacts to add it to their black list. For all you know, some anti-spam software on their side might have already done so automatically when receiving email that's obviously spam.

The best tactic in my opinion is:

  1. Several antivirus scans on your computer, or re-installation of Windows,
  2. Change your email address.

If you don't like the idea of installing multiples antivirus programs, Google for "antivirus online scan" and use a couple of the best-known ones to scan the computer (each takes some hours to complete).
Some that I like are Trend Micro House Call and Kaspersky Labs Free Virus Scan.
Please note that they might require you to use Internet Explorer as your browser.

Improve this answer
4
  • 1
    Using a different e-mail address will be a lot of hassle, but it might indeed be the only way. I assume that, considering all answers, there is no way to control the damage done however.
    – Tom
    Nov 21, 2009 at 18:49
  • 1
    Yes, what's done is done.
    – harrymc
    Nov 21, 2009 at 18:57
  • The damage caused by what is done can sometimes be limited though.
    – Tom
    Nov 23, 2009 at 12:26
  • Treating infection by cauterization is somewhat drastic, but think of the alternative.
    – harrymc
    Nov 23, 2009 at 12:52
0

Check your computer for viruses and malware, worst case scenario is that it might happen again.

Improve this answer
2
  • Right, I am also wondering on what I should do to control the damage that's already been done. Is it best to ignore it?
    – Tom
    Nov 21, 2009 at 15:05
  • 1
    I'd leave it. People get a lot of spam every day and most of them will know that you would never send that kind of stuff.
    – Niels Bom
    Dec 7, 2009 at 9:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .