Email Account Compromised

[Charolotte Caxton]

Hello.

So I found out my Second Life email account is sending out spam to all of my contacts. I deleted all of my contacts. They are still getting spam.

Any ideas?

Thanks.

[ROB34466IIIa]

Disable IM to Email perhaps ?

 

Very odd though.. your SL account mails your contactlist in SL ? How would it know their email adresses ?

 

Are you sure your own email isn' t infected by a worm ?

[Charolotte Caxton]

Nope.

Let me rephrase.

I have an email account for Charolotte Caxton. I only exist as a Second Life avatar. In that sense, I use Charolotte Caxton's email only for Second Life purposes.

Which means, my real life chick, me, has her own email accounts.

So, my Second Life email account is sending out spam, does anyone have experience with this or ideas on what I can do to stop it?

I have deleted all my contacts and run several virus scans. I read though that it may not be a virus and that in fact it may just be a spammer using my email address as a sent address, but they know my contacts so that makes me think my account is compromised  

[Peggy Paperdoll]

Close the email account.  Don't just abandon it, have the provider close it.

 

Pain in the butt when you get infected like that. 

[Charolotte Caxton]

Noooo, really?

 

[Dilbert Dilweg]

Many 0 days exploits do exist and anti viruses sometimes wont catch them or they can have the ability to hide from your anti virus systems.

I would try running a housecall from Trend micro and see if they find anything. Something sounds fishy from your personal end to me

 

worth the effort to double check

[Peggy Paperdoll]

It does look like your account has been compromised.........change your password immediately.

 

I'm on your friend's list and I haven't recieved any spam from you. 

[Peggy Paperdoll]

Yeah, if someone is using your email to send spam then the only way to stop it is to remove the email.  Have the provider close it for you.  An explanation would probably hurry the process.

[GothGirl Demonia]

If you used your own Second Life account and it is sending SPAM then I would disable Second Life IM to email and see if it still occurs.

If it is a spammer who is using your email address such as EmailHere@yahoo.com , and using the spoofing phishing type of email I would have your friends check the headers because it will give the info on which it was sent from.

Another thing I don't know s if you are using Yahoo, or Hotmail aka Web Mail login, or a private email server such as an ISP server as there is a major difference when it comes to email hacking, and Trojans sending out emails as if you are infected with a worm they can easily effect windows mail and such.

A good trick is to add AAAAAA@AAAAAAAAA.com to your address book so that if you do have a worm it will try to send an email there you will know you are infected, maybe add BBBBBB@BBBBBBB.com too.

Change your passwords as well don't use something like a birthdate, your name, or anything family related use something for example instead of the word password as a password use. PÄ$sW0rD9O5a$ and how you remember it is up to you there are a number of ways but a lot harder for a hacker to guess or use.

Norton & McAfee SUCK, I don't know how many times I have to say this one, but there is an internet meme called Not Even Norton Can Protect You, hell even Norton, was comrpomised back aways, and even StopSign those old Veloz guys who advertised back in early 2001-2005 had their StopSign/Services compromised as well.

There is also a couple of worms/Rogue Exploit going around which will completely bypass any type of virus scanner on your pc as well disable it and make it so the virus runs at startup it includes keyloggers, steals passwords, creditcard info etc. I know about this one because I got infected with it, and I knew it right away but it did get through my AntiVirus even with advanced and custom settings, however now I have their code stores on a disk for personal use later if I so please and believe it or not I tested it recently when I was hit like 5 months ago Microsoft still has no fix for it.

So basically if I understand it all correctly it is your email account sending a bunch of spam to your friends, or people in Second Life, and you have never used this email on any other service such as Blogger,Facebook,YouTube, or Twitter?

IF this is the case then I would have your friends check headers, possibly someone spoofing you who wants revenge on you in Second Life or something, and yup I would check sent mail as well as all common things too.

[Charolotte Caxton]

Ok. Thanks.

[Charolotte Caxton]

---

Peggy Paperdoll wrote:

Yeah, if someone is using your email to send spam then the only way to stop it is to remove the email.  Have the provider close it for you.  An explanation would probably hurry the process.

---

Shut down my email?

[Madelaine McMasters]

Charolotte, I compared the source IP addresses for both valid e-mails from you and for the spam. They're different. Yet both kinds of messages pass through Hotmail servers, suggesting that your hotmail account is being used by someone else (though I could certainly be wrong). Change your password and see if the spam stops.

ETA: check to see that no other changes have been made to your account. Sometimes there are secondary e-mail addresses where password reset messages may be sent. A spammer could insert an address there that would keep them abreast of password changes you make. (I don't know if Hotmail does this, I've seen e-mail systems that do.)

Good luck.

[Charolotte Caxton]

I did change the password, and the security questions, now it asks me if I am real, lol.

[Madelaine McMasters]

I just added to my reponse, go back and re-read it to make sure you catch a potential additional loophole.

[Charolotte Caxton]

Ok, yes, I checked all my creds and they seem fine, no secondary emails and my fave pet is still snooky, so I am all good there.

[Peggy Paperdoll]

Email that is compromised.  I'm assuming it's the email you associated with SL when you joined......and it sounds like it's not your primary email.  So shut it down.........if, of course, your contacts are being spammed from that email.

That's what I would do........gmail accounts are easy to start.

[Charolotte Caxton]

Ok, I shut it down and then what if it happens again? Just keep shutting down emails? I like this account

tears stream down her face

[Peggy Paperdoll]

Well it depends on whether or not whoever has compromised your email is doing it.  If they are sending spam using your email it will stop.  If they are sending spam from a different email and spoofing the sender address then it won't stop but you can advise your contacts that any email from anyone using your old email address as the sender is not from you. 

I do hope you advised your email provider about what has happened..........they could possibly start tracking down the culprit.  It's a mess I know.

Do you know how your email was taken over?  It seems to have started with something SL.  But, since I haven't gotten any spam from you I don't think it occurred in-world.  That web thing.....MySecondlife maybe?  I haven't even looked at mine and I have no contacts through it.

[Dilbert Dilweg]

You need to find the hole. If your PC is compromised, they will use your emails, that you continue to create..

They/it cant get your email password from Sl, and they can't send emails from SL

[Darren Scorpio]

Charolotee, as GothGirl said, what you have is a worm which accesses your email to send itself to everyone on your contact list. You DO NOT need to abandon, close your account as others have said. However you do need to do the following. It does not matter how many times you change your password right now because your PC is still infected and any new password will sill be revealed to the spammer.

- First clean your PC thoroughly: this means first disconnect your PC from the internet (unplug the wire if you have to). Run your antivirus in deep scan mode. (this will take a while). After you have already done so, reboot your PC in recovery mode (this will make Windows load only the necessary files needed to run windows, why you need to do this is because viruses can hide themselves as legitimate files on your computer and thus your anti virus will not find it on a first scan). Now in recovery mode run your antivirus again in deep scan mode.

- Run Malwarebytes, it will help you find additional malware that your antivirus did not find. 

- Reboot and now go and change your email password.

This takes a long time and you will be tempted to stop the process but understand that if you have such a worm you are putting other accounts at risk as well. My advice is never open emails you get from your contacts which have random links (your friend is already infected). Do not share your email publicly on any website including such places like FB. Good Luck.

 

EDIT: Others are just suggesting to close the account. You don't need to do that and it does not solve the problem. Making a new account will only make the new account accessible to the spammer. Clean your PC. 

[Charolotte Caxton]

I agree, Dilbert. I would like to find the breech so that I can make sure it is closed.

Peggy, sorry I think I may have presented my situation incorrectly. When I say it sent spam to my contacts, I meant my email contacts, not my SL friends. What I mean is that in my email contact list I have people I email, they are also some of my SL friends, but not all of my SL friends are on my email contact list.

So far I have run virus checks. None found.

Changed password and security questions.

The only other place I can think of that I have used this email address is doing those surveys here in the forums. I have given them that address so they would pay me lindens for taking the survey. I never thought someone knowing my address could be bad. I didn't know you could spoof the Sent From address

[Charolotte Caxton]

---

Darren Scorpio wrote:

Charolotee, as GothGirl said, what you have is a worm which accesses your email to send itself to everyone on your contact list. You DO NOT need to abandon, close your account as others have said. However you do need to do the following. It does not matter how many times you change your password right now because your PC is still infected and any new password will sill be revealed to the spammer.

- First clean your PC thoroughly: this means first disconnect your PC from the internet (unplug the wire if you have to). Run your antivirus in deep scan mode. (this will take a while). After you have already done so, reboot your PC in recovery mode (this will make Windows load only the necessary files needed to run windows, why you need to do this is because viruses can hide themselves as legitimate files on your computer and thus your anti virus will not find it on a first scan). Now in recovery mode run your antivirus again in deep scan mode.

- Run Malwarebytes, it will help you find additional malware that your antivirus did not find. 

- Reboot and now go and change your email password.

This takes a long time and you will be tempted to stop the process but understand that if you have such a worm you are putting other accounts at risk as well. My advice is never open emails you get from your contacts which have random links (your friend is already infected). Do not share your email publicly on any website including such places like FB. Good Luck.

---

Thanks Darren, I posted my previous post while you were posting this I suppose.

Ok, I will do as you say. I don't want mine or any of my friend's accounts at risk either. I can be patient, I have a phone I can do SL on and a different computer.

In searching for solutions I read about the Malwarebytes, so I will do that.

Thank you for taking the time to write me. Hope this works

[Darren Scorpio]

---

Charolotte Caxton wrote:

The only other place I can think of that I have used this email address is doing those surveys here in the forums. I have given them that address so they would pay me lindens for taking the survey. I never thought someone knowing my address could be bad. I didn't know you could spoof the Sent From address

---

There's the breech.

Never fall for such things Charlotte, those scams are phishing scams aimed to getting your email for the purpose of sending you a worm. Clean your PC and you will be ok.

[Charolotte Caxton]

---

Darren Scorpio wrote:

---

Charolotte Caxton wrote:

The only other place I can think of that I have used this email address is doing those surveys here in the forums. I have given them that address so they would pay me lindens for taking the survey. I never thought someone knowing my address could be bad. I didn't know you could spoof the Sent From address

---

There's the breech.

Never fall for such things Charlotte, those scams are phishing scams aimed to getting your email for the purpose of sending you a worm. Clean your PC and you will be ok.

---

Really? Aww, I thought I knew better

 

[Perrie Juran]

Some viruses have gotten very good at hiding from your anti virus once they are on your machine.  And they have timers in them that implement more problems as time goes on.  This is an example:

http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/how-do-i-remove-vista-home-security-2012-virus/1e3ea9ab-8b1b-486f-b840-1d1fd4988322

I have cleaned this bugger off of a few computers now for friends.  Don't let that page scare you...it makes things look more complicated than they are as far as clean up goes.

I have found lately that I have needed to take two steps to remove some viruses.

First, use system restore to return your computer to a previous configuration.  For example:

http://windows.microsoft.com/en-US/windows7/products/features/system-restore

Then run a complete boot scan with your Anti Virus.  You may have to google for this to see how to do it with your anti virus.  A complete boot scan can take a couple of hours to run.

One other note.  Many E Mail services provide a pass word recovery feature where you provide them an alternate E Mail to use should you forget/lose your password.  Double check that this has not been changed or activated.