Member Avatar for TBWG

Hi

First post so be gentle with me cos when it comes to IT I am about as sharp as a sausage!!

Someone has hijacked my contact list in Hotmail on my XP machine and is sending out weekly recommendations of sites to visit to buy goods, nothing harmful but very annoying.

I have updated and run Avast & Spybot plus immunized as well as an MSN PC check. However If this does not work someone suggested changing my Hotmail password.

I can't see how that would make any difference without changing my e mail address, which I do not want to do. But then what do I know, not a lot it appears!

Thanks in anticipation of any advice

TBWG

  • 2 Contributors
  • 2 Replies
  • 140 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by TBWG

Dani AI

Generated

Two different failure modes produce the behaviour described by : either the Hotmail credentials have been used directly (attacker logging in to the web mailbox and firing mail to the address book), or a program on the PC harvested contacts and is sending mail independently. Each path needs a different immediate response.

Recommended immediate actions (in order):

  • Change the Hotmail/Microsoft account password from a known-clean device (phone or another PC), then review and remove any unfamiliar recovery addresses, app passwords, mail rules or automatic forwarding in the webmail settings.
  • Check the Sent/Deleted folders and the raw message headers of a sent recommendation to see whether the mails originate from the provider (indicating account access) or from an external SMTP source (indicating possible spoofing or local sending).
  • Sign out all sessions / revoke app access and enable two-step verification on the account if available.

System-level cleanup and verification:

  • As recommended, run up-to-date anti-malware and rootkit scans; if malware persists or scanning tools disagree, perform an offline rescue scan or clean OS install after backing up needed files.
  • Clear saved passwords in all browsers, remove unknown browser extensions, and change passwords for any other services that used the same credentials.
  • Check the home router for changed DNS or admin credentials—router compromise can re-direct traffic and capture logins.

Follow-up and cautions:

  • Advise contacts that the messages were unsolicited and may contain links; do not reuse the old password. If the compromise continues after the machine is clean and the account secured, escalate to Microsoft support or consider a new address/alias.

Recommended Answers

All 2 Replies

Member Avatar for Rik_

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...are_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

Once done, download HJT from here - http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html and pst the log from that too.

Member Avatar for TBWG

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...are_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

Once done, download HJT from here - http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html and pst the log from that too.

Thanks for prompt reply RIK, will get onto that straight away!

TBWG

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.