Steps to take after E-Mail Hackery

Taramoor

Hello Dear Friend it is long time since seen, please click [link] to help new investment!


That message greeted everyone on my contact list about two hours ago.

So my e-mail was hacked. The hotmail account I've used for just about everything since 1996.

Yeah.

I'm panicking, despite knowing perfectly well that it does no good, and I'm not the kind of guy to panic.
Trying to access my account proved ineffective, and it sent e-mail to everyone I know.

t doesn't seem to be a malware or virus situation as all of my security software says I'm running clean, and I don't tend to visit sites of a questionable nature.

What are the steps to follow after something like this?

TetraNitroCubane

First, don't panic. Be cautious, but panicking just raises your blood pressure without reason. You can easily get through this.

An email account can be compromised through a number of different methods, so it's difficult to say exactly what happened in this case. The credentials might've been stolen through a hack or a leak, or your machine might be compromised with eavesdropping/keylogging software. Or, someone might've jacked your session cookie through an XSS attack.

First things first: Change your passwords. Get to a known-secure computer and change them. Particularly if you share the password your used for your email on any other accounts. IMMEDIATELY for accounts where that hotmail account was your contact/recovery email. You say that trying to access your account proved ineffective, so you're going to want to do whatever you can to recover the account, too. Secret question/backup emails are sometimes used, and in a last effort you might have to contact Hotmail (Which I believe is now LiveMail).

Second, run more than one scan on your computer to ensure malware is not present. I don't know what you used, but I'd recommend MalwareBytes, TDSSKiller, and Hitman Pro to begin with. These are all on-demand scanners, so they won't mess with your current security software. If any of them come back with an infection, I would reformat and reinstall. If they come back with a rootkit infection, I would certainly reformat and reinstall. Some rootkits can survive a reinstallation these days if you don't reformat first - that's how nasty infections are getting.

Third, once you've recovered your accounts, changed your passwords, and cleaned your systems, start thinking about tightening up security to prevent this in the future. I'd recommend migrating your email to Gmail, so you can use their 2-Factor authentication to prevent email intrusions. I'd recommend using NoScript, an Ad-blocker, and a Flash blocker for your browser. I'd recommend some variety of sandboxing for your browser (though this last one is perhaps overkill for some folks).

You say you don't "visit sites of a questionable nature". Well, have you ever used Google Image Search? Because in the last few months, that's been the largest malware distribution vector on the web. Not porn or piracy sites, just straight up Google Image Search. Tightening up your browser can really help prevent these things from getting to you.

Overall, to summarize: 1) Secure your account, change your passwords from a safe computer. 2) Scan your computer with multiple scanners, and take measures to remove any malware, and 3) Increase security after the fact to help give you peace of mind in the future.

TetraNitroCubane

(Browser derped, and I double posted. Sorry. Can't seem to find a way to delete posts anymore.)

Siska

First, have you tried resetting your password? http://windowslivehelp.com/solution.aspx?solutionid=6ea0c7b3-1473-4176-b03f-145b951dcb41

Is the hotmail account connected to an xbox live account that you have spent money on using a credit card? Both products are owned by microsoft, so having a credit card connected to it can help you prove ownership. That is if you're looking to recover the account and the normal account recovery option isn't working.

When you get your hotmail account back, make sure you check that the hackers haven't added their e-mail address as alternate e-mail. Or they can just steal it back again.

Taramoor

Account recovered. Passwords and securities changed on just about every single internet thing that I do, though. Which was a hassle, but I think it was worth it.

As it turns out, one of my old friends from college works on the Hotmail coding staff and he was able to speed up the recovery process for me. Keep in mind I've had this e-mail address since at least 1996, and there are all kinds of memories and important things in there, so just letting it go wasn't sitting well with me. I've checked over all of the privacy and association settings and it doesn't look like anything is awry. I'm going to have my friend give it a once over just to make sure.

I just hope none of the PA People I have in my contacts were dumb enough to click the link in that spam mail at this point.

Now it's as secure as I think I can make it. The Trusted PC thing looks like it will help out next time this happens.

Sticking with my G-mail account for the foreseeable future, since I re-routed everything to there, but it's nice to have my archive back.

Thanks to Tetra for calming me the hell down after the initial panic stage.