Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A colleague of mine seems to have had their hotmail account hacked - lots of spam is being sent from their account to their contacts, and the spams show up in their Sent folder so they're definitely being sent from that account.

Curiously, though, the hacker has not changed the hotmail password (to lock the original owner out) and also even though the owner has changed their hotmail password several times, the spam emails continue to be sent.

Does this mean that one of the owners computers has been compromised (so that the hackers get access to the new password after each password change), or is there some hotmail hack that can bypass the password check altogether?

So basically, how can my colleague fix their hotmail?

share|improve this question
the computer being compromised is a possible reason it might be a rootkit or a email client vulnerability on his PC or as simple as a keylogger. – Vineet Menon Dec 15 '11 at 12:05
I've had several contacts whose Hotmail account appears to have been compromised in this way. (It's happened again today!) I've not experienced this with other webmail services. – w3dk Jan 13 '12 at 9:08
Somewhat off-topic, but worth mentioning in this thread: Forward spam to to have it investigated for possible law enforcement actions. (Be sure to include the "raw" format mail, with all the headers.) Also, most major financial institutions and the like have spam/spoof investigators. Eg, American Express has – Daniel R Hicks May 25 '12 at 21:17

There are several possibilities:

  1. One of your colleague's computers is infected with some sort of keylogger.

  2. One of your colleague's computers is infected with a password sniffer.

  3. One of your colleague's computers is a zombie (part of a botnet) and sends the mails directly (possibly using the hotmail cookie).

Since only the hotmail account seems to be compromised, I'd rule out 1 (credit cards are much more interesting).

MSN Messenger and Internet Explorer are both vulnerable to password sniffing, so if your colleague stores his passwords, 2 is also an option.

Option 3 is different from the other two (and easier to detect), since it implies that the emails are actually sent from one of your colleague's computers.

  • If you look at the time the emails have been sent, you should be able to figure out which computers where turned on at the time.

  • Also, each email sent by hotmail contains a X-Originating-IP header that will help identify the computer it was sent from. Just ask one of the affected contacts for this information.

In any case, the fix is the same:

  1. Identify the infected computer.

  2. Remove the malware (virus scanner, browsing registry keys in safe mode and formatting the hard disk are your basic options).

  3. Change the hotmail password one last time.

share|improve this answer
Very complete explanation. I would point out that 3 is much more likely than 2. Also, this is might be a good time to make sure your browser and or e-mail client are relatively secure. Firefox (with noscript) and Chrome are more secure than IE on the browser side. – TimothyAWiseman Dec 19 '11 at 16:12
Yeah, I'd bet on 3. Probably a botnet has figured out how to send Hotmail email, which is why @w3d reports several similar Hotmail scenarios. – Daniel R Hicks May 25 '12 at 2:35
@DanH: I'd usually agree, but I've been receiving quite a few scam mails lately that were generated using 2, and only from Hotmail accounts. My bet is on sniffing the password from Messenger. – Dennis May 25 '12 at 2:40
@Dennis -- Either way, the computer's infected. That's the main take-away. – Daniel R Hicks May 25 '12 at 11:42
@Dennis -- BTW, how can you tell whether it was 2 or 3 from the receiving end? – Daniel R Hicks May 25 '12 at 11:43

It all sound plausible, but I do not think this is what happens.

I think a hacker deliberately targets your EMail address at Hotmail by intercepting an internal message and then pinches your password. I do not how they do it. But the remedy should be to change your password.

At least I hoped this works because I was hacked and spam sent out on 20 May 2012. The hack may have occurred a couple of weeks earlier.

At first Hotmail blocked my account because somebody was attempting to send out spam. I changed my password and then the account was compromised. This all happened in May after the bug was meant to have been fixed.

In trepidation in case it occurs again. My password for Hotmail was different from other passwords, so it was not obtained elsewhere. No malware or viruses were found on my computer.

share|improve this answer

It could be that the hacker is joe jobbing which means that they haven't really hacked your colleagues account, but that they are sending emails out pretending to be him/her by forging the "from" addresses and email headers.

To find out, you're going to need to compare the headers from a valid email from your colleague against one of the spam messages. If they are radically different, then the good news is that I would be right.

However if I am right, then the bad news is that they are going to have problems preventing the spammer from doing this. Complaining to the upstream provider might work, but it could easily fall on deaf ears.

share|improve this answer
Forging the headers does not leave messages in the account "sent mail" folder. – Axeman Dec 15 '11 at 12:39
As Axeman said, I don't think its joe-jobbing because the sent spam shows up in his sent folder. – codeulike Dec 15 '11 at 13:16
Sorry, I missed that bit. You're right, it's not joe jobbing. – Richard Dec 15 '11 at 13:26

You must log in to answer this question.

protected by nhinkle Jul 6 '12 at 6:36

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .