[Gwd440]

Hi

I have a Hotmail email account. Yesterday an email was sent by my email address to what looks like my whole address list. A number of people have replied to me saying the link didn't work and one person has said that it looked as though it was trying to re-direct him to some website.
I didn't send this email, and wasn't online anywhere when it was sent. The email doesn't appear in my Sent Items.

Is this something I should worry about? I'm tempted to close this account and open another one, but this will be a lot of hassle.

Does anyone know how this has happened?

[Dellinsp531]

First change your password to hotmail.

Second, scan your computer for viruses. It might be that your computer is infected with a virus that
is sending out emails.

If there are not virus, than it might be that your account was faked on the email. Ask your friends to forward
the email with full header and see if the IP in the email is your IP address.

If it is your IP address, that there has to be a virus on your computer. How do you check your email?
Do you use the browerser or mail program like Windows Mail?

If it is not your IP address, that it seems your account is hacked. Changing the password should help.
Contact hotmail and let them know so that they can investigate.

[coastie65]

I went through this a few months back ( MSN LIve Mail ). Change your password and make make sure you use the password to get into your email account ( or homepage ). If you have it to just click to access, you are leaving yourself open to this.

[Evildave]

And of course, once they HAVE that email address and list of contacts, even if you change your email address, this might not be the last fake email from 'you' that your friends & family get.

Because they can forge your 'from' address pretty readily.

They can get this information by compromising ANY address book, be it on your local computer, or your web mail, or some form of social networking.

They can even get it because you send out crap to 'everyone' in your address book, with long 'to' and 'cc' lists, making the mailing list public to all. You never know how often that 'neat thing' you wanted to share will be forwarded again (and again, and again), or where it will end up. Don't forward chain letters or cute crap to 'everyone', because these tend to grow an ever expanding list of email addresses associated with senders, ripe for harvest.

Any server that such an email passes through on its way to your recipients can harvest that information on the way through it, too.

See if one of your more technically savvy 'recipients' can forward the email header back to you. All we're really interested in is the list of IP addresses from where the email came from, not the email addresses. The mail may not have even been sent from Hotmail at all. Forged.

If the address is forged, or the mail doesn't stop, you may have to make a new email address. It sucks, but most web servers have a way to export/import your contacts, even for different email services, so it should be relatively painless to make a new account, import your old contacts, and send out a few emails telling your friends/family/etc. that you changed your email. Many email services (like gmail) will also collect email from other accounts on the back end, to deliver them to you, so any stragglers using the old address will still get through.

Oh, and DO NOT EVER use the windoze built in address book. This thing is ALWAYS compromised by every kind of malware, because there is a standard API to access it. If you do use it, export it. Most OTHER email clients and webmail clients will import that content seamlessly. Then when that is accomplished, delete everything in it. Or better, delete the actual files that it uses for its storage.


Also, NEVER, EVER use the same password for email (or your bank, for that matter) as you do on secondary crap, like forums. One compromised password becomes ALL OF THEM compromised. Not all forums are safe from being harvested for passwords, and many don't require an HTTPS connection to send them, so you're sending credentials in the clear. I'm only askin' you to remember three different passwords (forumz & crap, EMAIL, BANK). LONG passwords composed of normally spelled words, making lyrics or phrases (you know, that you can REMEMBER) are actually better and more secure than shorter 'L337' passwords. A haiku/limerick. A verse from a song. A quote.

[A41202813]

@Gwd440

I Am A GMAIL User.

Every Week I Receive Some Messages Supposedly Sent By Me To Me.

If I Was The One Sending Messages To Myself, I Could Of Been Doing It From:

A - My Email Client OUTLOOK - Would Those Messages Not Be In The OUTLOOK Or GMAIL Sent Folders ?

B - My GMAIL Address - Would Those Messages Not Be In The GMAIL Sent Folder, As Well ?

Anyway, GMAIL Has A Feature That Lets You Know, And Deactivate, In The Past 72 Hours, What IP Addresses Were Using Your Account And Which Country Those IP Addresses Belong To.

In Case Some Other Country And / Or IP Address Were Using Your GMAIL Account, You Could Do These Steps:

C - Change Your Password In GMAIL, And,

D - Request The Deactivation Of All GMAIL Sessions ( The One You Are Using Is Never Included ).

[coastie65]

Evildave, on 23 December 2011 - 11:53 AM, said:

And of course, once they HAVE that email address and list of contacts, even if you change your email address, this might not be the last fake email from 'you' that your friends & family get.

Because they can forge your 'from' address pretty readily.

They can get this information by compromising ANY address book, be it on your local computer, or your web mail, or some form of social networking.

They can even get it because you send out crap to 'everyone' in your address book, with long 'to' and 'cc' lists, making the mailing list public to all. You never know how often that 'neat thing' you wanted to share will be forwarded again (and again, and again), or where it will end up. Don't forward chain letters or cute crap to 'everyone', because these tend to grow an ever expanding list of email addresses associated with senders, ripe for harvest.

Any server that such an email passes through on its way to your recipients can harvest that information on the way through it, too.

See if one of your more technically savvy 'recipients' can forward the email header back to you. All we're really interested in is the list of IP addresses from where the email came from, not the email addresses. The mail may not have even been sent from Hotmail at all. Forged.

If the address is forged, or the mail doesn't stop, you may have to make a new email address. It sucks, but most web servers have a way to export/import your contacts, even for different email services, so it should be relatively painless to make a new account, import your old contacts, and send out a few emails telling your friends/family/etc. that you changed your email. Many email services (like gmail) will also collect email from other accounts on the back end, to deliver them to you, so any stragglers using the old address will still get through.

Oh, and DO NOT EVER use the windoze built in address book. This thing is ALWAYS compromised by every kind of malware, because there is a standard API to access it. If you do use it, export it. Most OTHER email clients and webmail clients will import that content seamlessly. Then when that is accomplished, delete everything in it. Or better, delete the actual files that it uses for its storage.


Also, NEVER, EVER use the same password for email (or your bank, for that matter) as you do on secondary crap, like forums. One compromised password becomes ALL OF THEM compromised. Not all forums are safe from being harvested for passwords, and many don't require an HTTPS connection to send them, so you're sending credentials in the clear. I'm only askin' you to remember three different passwords (forumz & crap, EMAIL, BANK). LONG passwords composed of normally spelled words, making lyrics or phrases (you know, that you can REMEMBER) are actually better and more secure than shorter 'L337' passwords. A haiku/limerick. A verse from a song. A quote.

It isn't just Windows Live mail. I have seen this with Yahoo as well as I was getting them from friends with Yahoo that had been hacked. I don't keep bank records on anything that has an internet connection period as I don't do online banking, with the exception of making a credit card payment at times in between the statements.

[Evildave]

I didn't say it was 'just' Windoze live mail.

But that 'standard' address book in windoze, with its standard API is a sweet crop that malware routinely harvests.

The same could be said of the 'standard' address book on any other OS, even tablets, phones, etc., if there were literally MILLIONS of kinds of malware for any other OS besides windoze.

[Kathi201]

You have to change your password then, if you have good anti virus then update if not then download, and remove your cookies because it also create problems,,,,try this hope you get solution