Gmail

[lonewolf]

I have a question, about two weeks ago the wife's gmail account started to send spam e-mails to everyone on her contacts list. I told her to change her password remove her auto log on features. For some reason today it started it again. E-mail is on Googles server, she is not using evolution or any other program to pull it from the site to a computer. Everything should be on Googles side should it not? If so why is it sending spam?

[maboroshi]

Are the messages appearing in her sent box? If so sounds like her Gmail got hacked... My Gmail got hacked one time so I deleted it.

Is the password strong?

Does she have malware on her system?

if the email is not in her sent box then is there a form attached to that account like on a personal web site of hers or anything?

Anyway just some things to think about

[ph0bYx]

Well if her account was hacked that means that somebody cracked/stole the password and got in, so changing the password, preferably to something stronger, and changing the secret question and/or the emergency email should do the trick, right?

[Broken Angel]

If non of the other work you can also try and switch to dual authentication that Google recently started. Now what hapeens in this is even you are key logged having a RAT on your PC or anything like that be it a phishing page or the lamest thing like shoulder spying and the person knows your passowrd he/she wont be able to log into your account without the application that Google made you install on your phone.

Google will want you to download an Application to your phone (probably has to be Android or iPhone I think) and that application won't need a data connection nor a service provider nor any kinda sim to work. You just need to enter your passoword of gmail and then open the app to get a unique code that only you can see cause it is on your phone and not on mine. So this code keeps on changing all the time and thus you are even more secure. I feel this should do the trick if someone is really stealing the passes some how?

[DNR]

yea several possibilities -

1. you are infected, a malware is positioned between browser and her - she logs in to gmail, she logs the malware into google so it can spam (so it has permissions). IP will be hers, but check the headers for sender info. Maybe browser addon tool. (try another browser, download FF or chrome to test)
2. someone is using the account, they guessed the hint or password. Trace the IP on the spam email by checking the full headers.
3. Blind spoofing. trace the IP of the spam email by checking the full headers.

DNR

[lonewolf]

Thanks everyone for the help and the suggestions.

It seems that her e-mail has been accessed 3 separate times from Russia before she changed her password. One e-mail kicked back from a discontinued address gave a lot of interesting information along with a bcc e-mail address. Humm might have to send a thank you
bug, I mean letter.

[Broken Angel]

Humm might have to send a thank you
bug, I mean letter.

lol... do it